Comment by delroth | Hacker News Reader

Comment by delroth | Hacker News Reader

Parent Full thread

The article seems to imply that this is a recent addition to the privacy policy. Google keeps archived versions of their privacy policies (https://www.google.de/intl/en/policies/privacy/archive/), and you can easily see that the "telephony log information" was added in the March 1st 2012 revision of the Google privacy policy.

You can see a summary on https://www.eff.org/deeplinks/2012/02/what-actually-changed-...

As the EFF mentions, this was a big privacy policy change, and it was widely announced. For example, I searched through my emails right now and found an email from Google (on my @gmail.com address) on 2012-01-28 announcing the change and asking me to "please take a few minutes to read our updated Privacy Policy and Terms of Service at http://www.google.com/policies".

For completeness sake, the diff from the changes on June 28th: https://www.google.de/intl/en/policies/privacy/archive/20160...

Disclaimer: I work at Google, but not on anything related to this. I speak for myself, not for the company.

EDIT: Interestingly, the language in the 2012 unified privacy policy matches very closely the language that was used in Google Voice's privacy policy since 2009: https://web.archive.org/web/20090315193708/https://www.googl...

> Google's servers also automatically collect telephony log information (including calling-party number, forwarding numbers, time and date of calls, duration of calls, SMS routing information, and types of calls).

The problem is that at the time they added a lot of "vague language" that maybe allowed them to do this, or didn't. But because Google may not be doing a certain collection of data then, it means journalists can't really attack Google for it, because everyone would point out that "it's just vague like that for legal reasons, but Google wouldn't actually do that." So whoever suggests they would do it gets shut down pretty quickly because he or she has no proof Google is doing that right then.

But then a couple of years later they turn on that data collection without anyone realizing, and it may take a few years before some do.

This happened with Microsoft do. When it was suggested that Microsoft can collect every key stroke because that's what their privacy policy says, most said "but that's crazy! Microsoft wouldn't actually do that" (even if that's what the policy says it can do). But the reality this we'd have no idea if Microsoft does indeed do that, maybe not for advertising purposes, but for law enforcement purposes (especially since half of the requests come with gag orders now, as Microsoft recently said when it launched the lawsuit against DoJ).

The default understanding of a privacy policy should be "if the policy allows something, then we should assume the company is doing exactly that." No other understand makes sense in practice.

According to that diff, Google moved from opt-in sharing of DoubleClick cookies, to...potentially default-in, with a possible opt-out option buried in some unidentified settings page?

gotta love the double standard.

when verizon did their super cokie, everyone went crazy (as they should).

now that its google (doing that since before verizon it seems) the top coment is a googler throwing the issue to the side in a hitchhikers-guide-to-galaxy way ("you should have checked the alpha centaury records in 2012")

I think the right reaction to this is moving to Android without the mothership. That is an Android stripped from any Google services.

I was quite sceptical about Android, partly because it has a foreign userspace and partly because there were no nice vanilla Android forks without Google code and with a focus on privacy.

I'm now tired of waiting for any Maemo successor to catch up and I reckon F-droid has become a pretty nice ecosystem. Also the announcement of CopperheadOS, Guardian Project and F-droid joining forces is exciting [1].

[1] https://guardianproject.info/2016/03/28/copperhead-guardian-...

I've gone the Google-free route a little while ago, and it's really been not nearly as bad as even I thought myself. The only thing that I'm still sort of missing, is the automatic calendar and contact backup. You could do that with something like OwnCloud/NextCloud or a CalDAV-service, but yeah, it is a non-trivial effort.

Otherwise, in case you do try it, here's some things that I found useful: If the apps on F-Droid aren't enough for your taste, you can also use Aptoide [0] to access a big portion of the apps that are available on the Play Store.

The Amazon Store is also an option, although their store is also not really the greatest when it comes to not invading your privacy.

And if you cannot live without some of the apps on the Play Store, or if you've paid for some apps there and would prefer to not lose access to them, I can recommend Raccoon [1] for accessing them.

There's also some online-services, like for example Evozi [2], which can download unpaid apps from the Play Store for you, but well, for one, usually only unpaid apps, and secondly, I have yet to find one of those services which is not hopelessly overloaded.

I think, if you look more into app-piracy tools, you might also find a web-service which let's you download paid apps, but I've personally just stuck to Raccoon, so I can't make any recommemdations there.

Finally, if one of your apps really does need Google Play Services, there's a project aiming to reimplement the functionality without the privacy problems, called microG [3]. I haven't personally tried it yet, but I think, it's somewhat hit-and-miss, so while it's probably worth trying, you shouldn't expect too much from it...

[0]: http://www.aptoide.com/

[1]: http://www.onyxbits.de/raccoon

[2]: https://apps.evozi.com/apk-downloader/

[3]: https://microg.org/

Mailbox.org gives you contact and calendar sync and backup for 1 euro a month. Plus email with your own domain.

Default language on their page is in German but everything is available in English (including support).

As for calendar and contacts you could pay for a provider who hosts them for you, usually with email. Unless that's not enough and want to get more self-hosted route, not just Google-free.

> when verizon did their super cokie, everyone went crazy (as they should). now that its google...

to be fair, one was a thing that happened, the other is a "by my reading of the ToS, they could do this"

also verizon was an actual man in the middle attack on their users.

The privacy policy actually says you don't have to check:

>Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent.

All fine, but it is left conveniently unspecified what is meant by "reduce your rights". In fact, I don't even know my rights as I was not explicitly presented them in the form of a list in the first place, making the "reduction" ambiguous.

Admittedly it is not as easy to spin this as a more explicit ToS, but I am sure that with a sufficient number of legal experts, this has considerable leeway in terms of interpretation.

On the other hand, if a court found them to have violated their own policy of not reducing rights without notification then they could get heavily fined.

Yes, it doesn't appear users have any explicit rights under the policy.

Obviously my rigth to privacy is not part of my rights under this privacy policy.

because they did change that, according to this very thread. With nice diffs and all.

To disable it on Android go to: Settings -> Google -> Ads -> Opt out of interest-based ads

But the surprise twist is that Apple does the same thing!

To disable it on iPhones go to: Settings -> Privacy -> Advertising -> Limit Ad

That setting on iOS refers to iAd, a service that died because it respected your privacy too much, and was therefore not appealing to advertisers. It seems unfair to compare Apple and Google on user privacy. They are poles apart.

> That setting on iOS refers to iAd, a service that died because it respected your privacy too much

That is absurd revisionism: iAd died because Apple stipulated a minimum ad spend of $1 million. They later dropped the minimum spend to $50, but the damage was already done and the platform was in a death-spiral.

iAd died because Apple unsuccessful tried to capture the 'premium' end of the Ad Market, not because it "respected user privacy too much".

I stand by what I said. Citation: http://www.reuters.com/article/us-apple-encryption-privacy-i...

"Apple is loathe to use customer data to deliver targeted advertising or personalized recommendations..."

...is false. They are loathe to allow anyone else access to it, and sold ads as many exchanges (like Facebook) do - not sharing user info, but promising they can target the demographic you want with precision.

And just to drive home the point, they will still be using targeted data when they start showing App Store ads in iOS 10. If you think there is no targeting there, you're hiding your head in the sand.

My theory goes like this - Apple gets to still advertise, lose its full iAd sales team, has a captive audience and ad platform and so can set pricing however they want, use native (better) ads instead of banner (worse and dying) ads, and so on.

Even the opt-out seems backwards. I checked the setting, immediately saw that the button was disabled and thought, "Oh, I'm good." Until I read the description and thought about it. The switch needs to be "on" to opt-out. http://imgur.com/ZZTL3ct

Important to note is that it also says "...if you clear your cache, you will lose your opt-out setting." What cache?

Yeah, dark pattern of UX all over again. Seriously, how about "never send any data to Google unless I explicitly requested it"? I guess that is not in their short-term interest though. Yeah, don't do evil unless you can... :(

And: Settings -> Security -> Apps with usage access (turn off for each app). And probably countless other settings too. Good luck finding, understanding and setting them, let alone keeping up with them from one upgrade to another! My guess is they are there for legal and PR reasons: "well, if you don't like it, you can just turn it off in Settings -> Somewhere -> Makes no Sense... See? It's not us, it's just you..." Seriously, I am not even in their jurisdiction. How dare they spy on me?!?

Thanks, I didn't know about this. It's set to opt-out and I don't recall doing that but may have at some stage.i wonder what the default is? The explanation below is unusually readable and come across an an explanation rather than the standard dense legalese that is in eula.

I have no "Google" option under my settings. Nexus 4, Android 5.1.1

You might have a separate "Google Settings" app.

My guess this may be related to personalized ads that you can configure here: https://www.google.com/ads/preferences

You can control a lot of what you see from that page (which has been around for at least 6 years).

Yeah, it was so well announced that multiple HN readers -- including me -- who strongly tend towards the privacy sensitive are shocked that they're doing it.

I'm just quoting the EFF's opinion really:

> They did a great job of informing users that the privacy policy had been changed through emails and notifications

That's about the only positive statement on that page. Here's context.

The title:

   What Actually Changed in Google’s Privacy Policy
   
   It Shouldn't Take a Letter from Congress for Google to Give Straight Answers 
   About Privacy Policy Changes

and the sentence after the one you quoted

   Unfortunately, while the policy might be easier to understand, Google did a 
   less impressive job of publicly explaining what in the policy had actually 
   been changed.  In fact, it took a letter from eight Representatives to 
   persuade them to provide straightforward answers to the public about their 
   new policy.

and again

   Unfortunately, Google’s original explanation left much to be desired.  The 
   policy’s overview page said nothing about the substantive changes that were 
   occurring in the policy, and the FAQ was equally vague:

So yes, maybe Google notified people. But unless you view reading a large document written by lawyers as somehow pointing out that Google is now collecting the same data the NSA worked so hard to get their hands on -- the call logs of every android user -- that's nothing like notification.

Here's notification as written by someone who actually wants to notify rather than do the minimum possible to cover their ass while simultaneously obscuring what they actually collect:

   We will now record and store every phone number you call.

This goes a long way towards explaining why people trust Apple and distrust Google.

ps -- under substantial changes, nothing about telephony. So apparently the eff didn't see or didn't understand the change either.

All that says is that privacy-sensitive people are out of touch with reality.

This account belongs to a Google eng.

So what? He stated that, noted the sources for what he said. Genetic fallacy is a tired thing.

Reply on news.ycombinator.com