Comment by Animats | Hacker News Reader

Comment by Animats | Hacker News Reader

If this is correct, Google is lying about when they look at your data. Google should not be looking at your spreadsheet. They claim they don't.[1]

You decide what content is shared & with whom

The content you save on Google Docs, Sheets, & Slides is private to you, from others, unless you choose to share it. Learn how to share or stop sharing files in Google Docs, Sheets, & Slides.

Google respects your privacy. We access your private content only when we have your permission or are required to by law. With the Google Transparency Report, we share data about how the policies and actions of governments and corporations affect privacy, security, and access to information.

If you have a work or school account, your organization can review logs of actions taken by Google when accessing content. Learn how to view logs with Access Transparency. Learn how Google protects your organization's security and privacy.

Start by trying to get a log of accesses to the spreadsheet. Follow up with a California CCPA complaint.

[1] https://support.google.com/docs/answer/10381817?hl=en

>Google is lying about when they look at your data

No they aren't. The TOS and similar clearly spell out that they have automated checks for malicious content, copy-righted works (remember when Google drive was a popular piracy vector for a hot second?), CSAM, etc. It's not Google's fault you haven't read that, or that you are taking a support article about sharing docs with other people and incorrectly extrapolating that to the internal technical functionality of google docs. The very next sentence after talking about end to end encryption:

>Your Google Account comes with built-in security designed to detect and block threats like spam, phishing and malware. Your activity is stored using strong industry standards and practices.

What has likely happened is that one or some of those domains probably got hacked and are pushing malicious JS or something triggering Google to view them as malicious, so some security product looks at a spreadsheet full of "malicious" URLs and it got sent into the void for that.

If their marketing materials say they don't look, but their terms of service say say they do, that's false advertising.

This is a paid service. Google is more constrained than with a free service.

> We access your private content only when we [...] are required to by law.

The ellipsis is doing a lot of work there. The full sentence is:

> We access your private content only when we have your permission or are required to by law.

They will claim that you gave them permission by acknowledging the TOS.

The two subclauses of "when we" are joined by an "or", so only one of them has to be true to fulfill the "when" condition.

I think what he is saying is that if they get the user to agree through TOS then they always have permission via the first subclause you omitted.

I was initially agreeing with you until I read this point "Google respects your privacy. We access your private content only when we have your permission or are required to by law."

They specifically spell out themselves.

> It's not Google's fault you haven't read that

We really need to invert that responsibility.

Corporations are hiding behind their TOS and playing "gotcha" when it turns out that you haven't read the thing that nobody reads.

True. But not enough people care, it's rather the opposite.

Maybe Google is required to access all your documents "by law?"

Reply on news.ycombinator.com