Which specific factual aspect of this story do you believe contradicts those claims? I'm a Xoogler, not a Googler, but in my post-Google experience I haven't seen anything that was even in the same league as Google's privacy controls. In my personal privacy threat model I think Google scores 10/10. They protect my data against external attackers, which in my view is the main problem faced by personal data, and their protections against insider risk are also excellent. Other places where I've worked, that you've definitely heard of, have security and insider risk practices that are a complete f-ing joke. There's nobody at Google who is "the DBA" who can just covertly access your data, there's no ad-hoc logs access (every logs access flows through a proxy that ensures only limited access for pre-defined purposes), and there are software controls that trigger privacy incident response (by a 24x7 user privacy incident response team) whenever an insider attempts to access user data in excess of their authority. In protocol buffer definitions, every field has an annotation for whether it contains private, sensitive, or non-private information so that even in crash dumps and debug logs those fields are censored before being printed. I really think Google has a pretty strong privacy story, compared to virtually every other company (except Apple and Microsoft) who leave themselves highly exposed to both outside and insider attacks, software (and even hardware) supply-chain attacks, accidental leaks, leaks into debug systems, poor encryption practices, and generally wanton behavior.