Google is selling all my personal information in Google Domains to Squarespace?
twitter.com
twitter.com
It's self-evident that acquisitions can happen and that data will be transferred as a result. Most most attention is typically on other aspects of how Google handles data and this seems like an attempt to latch onto that.
I personally feel better about basic data security and processing under Google than I would under a company like Squarespace. I know Google have faced nation state attackers so they've got some security chops. I feel that they'll enforce reasonable contractual requirements on the purchaser, but those won't override Google being a safer bet with the basics.
I mean it's not that surprising though? The better option would've been to allow the user to opt out of transfer to squarespace and move their domain to somewhere else in the meantime?
I don't mean to downplay the overall idiotic nature of this sale, but you've always been free to transfer your domains out of Google Domains at any time (or any other registrar for that matter).
Everyone can already do this.
It’s not like Google didn’t know filing these notices were gonna go unnoticed.
Correct, which is one of the big reasons why I do my best to avoid all data collection I can, even if I fundamentally trust the company doing the collecting.
"We don't sell your data" is a plainly worded claim, and is blatantly false if/when a company is sold. Companies should be required to say "We don't sell your data unless acquired" or "We don't sell your data now but might in the future".
Allowing consumers to make an informed choice is critical for properly functioning free markets, let's enforce this.
i.e. Encouraging everyone to protect themselves inadvertently slows down the fixing of the root problem?
I’m personally very torn on this subject. In smaller circles where I have relationships, it’s easy: publish and recommend the workaround protection. But in humanity at large I’d really like the underlying problem to get fixed rather sooner than later?
Personally, I don't feel that I have any right to tell others that they need to put themselves at risk in order to make the conditions right for accelerated change.
But I do agree that simply engaging in self-protection without also doing what you can to actually change the situation is ethically dubious.
It isn't rare for one company to buy another entirely so they can get the customer data.
It's important to remember that Gergely is in the business of clicks and views. While I've enjoyed some of his reporting, it's very clear that he's optimizing his reporting based on what gets engagement. On places like Twitter, sensationalizing topics and riding waves of outrage is a cheap way to drive engagement.
This material plays well to certain subsets of Twitter, HN, Reddit, and other social media sites where people thrive on sensationalism and outrage. His previous thread about leaving Google Cloud because it might be abandoned at any minute (lol) was sensationalist enough that even the usual outlets were starting to call him out on it, but I'm afraid the engagement may have only incentivized returning to the well for another dip into the "Google Bad" outrage pool.
This isn't the only Substack author I've followed who veered into audience capture like this. There's something about the ultra-tight feedback loop where authors/influencers can see the real-time engagement with their topics and continue pressing whatever button drives the most engagement.
It was an entirely predictable outcome of Medium-/Substack-/Patreon-based journalism. People were complaining about mainstream media reporting being biased, and cheering on democratization of journalism; but Substack more directly ties specific stories to financial rewards foe the authoe. Pandering to your audiences biases will make you more money, so why would you ever report on anything outside of their bubble (or contradicts their worldview) when that hits your pockets?
I don’t care about the views or clicks or “engagement” or “driving attention” or similar. I understand talk is cheap so I have asked dang to blacklist all tweets from my Twitter account (this URL) going forward on HN, which should significantly reduce such views and clicks.
The tweets are not editable, and I often type them out as I go. I shared this, for example, after talking with a current Googler who was very, very frustrated exactly because of this. I thought it’s an interesting angle, especially as I’m also a Domains customer.
“Sensationalist” is something I would definitely like to avoid. I used to “break” layoff news at tech companies the fall of 2022 (before or as they happened) which had very high “engagement” but sat increasingly poorly with me - and it did feel sensationalist - so I stopped doing all of this, regardless of anything I learn ahead of some other outlet sharing it. I’m happier for it.
I do have my own opinions and experiences with Google as a customer, going back all the way to the massive GAE price increases in 2011 when I was an early customer, and of course this contributes to my - necessarily biased - outlook.
There is also truth to Twitter takes often feeling sensationalist - brewity doesn’t help with nuance - and I don’t want to get more views/clicks/ “engagement” on any of these or contribute to “outrage.”
(By the way, thank you for an earlier criticism that I took to heart.)
You don't seem to have any knowledge at all about how personal data transfers work in the case of a merger or acquisition. Which is a radically different scenario from two standing independent companies exchanging personal data.
It's common practice and common sense that you get access to customer data when you take over a company, how else would you even run it? This has been true and normal for centuries. The concept still stands when applying the strictest of modern privacy laws, it's called "legitimate business interest". Meaning: there is no business without this data, the personal data is required to deliver the service at all.
So no, it's not a selling of your data, it's a change of control. And no, it does not require your consent.
If you don't want to see accusations of "sensationalist" you shouldn't confidently spread hot takes on topics you don't even seem to comprehend the basics of. And if you then go wrong and get corrective feedback as is happening on the Twitter spread, perhaps not double down.
Google had not been in the business of selling its businesses until now (and thus was not selling customer data either). They were in the business of building own products (sometimes shutting them down) and buying other companies.
This is a first they shut off a division and also sell off customers’ data.
As to whether Google has done this before or not is completely irrelevant.
Google Domains and Google Cloud Domains is shutting down: no technology or people transfer happens. Customer accounts are what are sold, as laid out in black-and-white by Google:
“On June 15, 2023, Google entered into a definitive agreement with Squarespace, where they intend to purchase all domain registrations and related customer accounts from Google Domains.”
We can argue what it means to sell “customer accounts from Google Domains” from Google to a third party company.
My interpretation that this is selling customer data (that is needed for the buyer to operate them: it’s selling, none the less, to a third party who is not Google). To me, this sounds like a new era starting where customer accounts owned by Google can be sold (and this is the first). Which is fine: but then Google cannot claim they will not do this, going forward. This was the deal Google promised its customers - which implied they won’t sell off eg Gmail acccounts to a third party, YouTube accounts, or Google Domain accounts.
Google didn’t write that Squarespace is “getting access to customer data”. They wrote Squarespace is purchasing these accounts (likely this wording to avoid writing that Google is selling this: but same difference). Google’s wording: not mine.
https://support.google.com/domains/answer/13689670?hl=en#:~:....
This is just semantics on your part. Whether it's a company being sold, a division, or only a product, then reasonable companies will consider the data handling in a similar way with multiple gap analyses to mitigate concerns. Context is going to dictate what happens. Lesser companies will not consider this heavily and you can end up with the data being more of the value for the transaction. Whether we like it, or not, we are left to trust that these companies will make efforts to enact good policies and follow them.
What I'd expect to happen here is that Google and Squarespace will familiarize themselves with the posture on both sides and Google will want the standards to at least be maintained to a level which removes liability to them. They are very aware of the scrutiny and a big player here so they can force the acquirer to step up to a certain degree.
I don't know enough about Squarespace's security, or complete business model, but they'll be trying to work out what gaps they may need to fill. Google may have clauses that require that this data can't be co-mingled, or must be handled in specific ways for certain countries. The actual handling and what is communicated can take some time as the teams work out how they deal with any gaps. It's also possible that Google find some gaps on their side and have to resolve them before any transfer could actually happen.
Given the implications of service continuity if domains aren't transferred or operational, I can't imagine that they would ask customers to take some action. It creates a support nightmare with confused customers talking to support and then being unhappy they still took the wrong action when you ask them to approve the transfer.
Thanks for your comments, I appreciate it. Now is the part when I would want to go back and edit all my comments here (and on Twitter), but cannot thanks to the append-only nature. I can delete: but then e.g. this post points to nowhere and the context is lost. I deleted the orginal tweet given it's clear it has incorrect information / missing information, replaced with: https://twitter.com/GergelyOrosz/status/1671959124337217536?...
Some longer form thoughts, and also input from someone who is quite well versed in privacy: https://blog.pragmaticengineer.com/google-domains-to-shut-do...
Isn't that the whole issue in discussion? Google never did this before, and as a result they could always claim "we will never, ever, sell your information". This just changed as now they decided to sell that data to Squarespace. So they can't claim that anymore, right?
I understand that Google had no other option. As far as I know, ICANN requires a registrar to transfer domains to another registrar if they are going out of business. So either they support the service forever, or sell their user data to another registrar and remove that statement as they no longer uphold that statement.
They got themselves into that business. No one forced them to sign an agreement with ICANN that could one day force them to transfer that information to someone else, but they did.
I am pretty sure I was wrong, and you were right. Thank you. Deleted the original tweet, replaced with: https://twitter.com/GergelyOrosz/status/1671959124337217536
Perhaps trusting governments, since they have less silly financial reasons to break security is reasonable.
It is most common for both sides of a transaction to announce simultaneously. This was a bit weird in that SquareSpace made an announcement and there was nothing from the Google side. If Google was still preparing their communications, the norm would be SquareSpace waiting for Google to be ready.
This exact data already goes through many intermediaries in many different countries for the payment to successfully settle. So will you also complain that Google is selling your data to Visa/Chase/Stripe/PayPal and the hundreds of other companies they have agreements with?
Edited to add example.
Where are you getting this from?
Google says that Squarespace's privacy policy will be applicable, and that policy gives Squarespace the right to do plenty of other things with user data: https://www.squarespace.com/privacy
I will say, I'm super frustrated by the Domains sale as well. I also work on Payments, and can at least give some insight here. The amount of data given to a payment processor definitely differs by country and form-of-payment. But one big difference is that a full billing profile tends to have lots more data than just what is required to process a payment. Many payments (like credit cards), just need a payment description, name, address, and the card details. But this doesn't always include stuff like email address, IP address, phone #, etc. So the card processor will get the minimum info required to process the payment. There are also agreements in place with what these processors can do with this PII data.
I'll definitely be interested to see what Google does regarding data transferred to SquareSpace. It's unclear right now what kind of restrictions will be placed on any data (if any) that is shared with SquareSpace.
No, you cannot “buy” people’s personal data (name, phone #, address, email, etc) from Google.
Yes, sale of a business unit usually includes the customer contracts, leads and historical data of that business unit. No, there isn’t anything nefarious about that, and every other business you transacted with does the same thing.
Yeah sure there is a cottage industry trying to use google’s data to augment other data sources, but that’s not “Google selling my personal data”.
Coming from the guy who yesterday talked about how much of a reputational risk selling Google Domains is... It's ironic he doesn't see tweeting something this dumb as a reputational risk...
The bigger point though is that you are right, but it also applies to literally every business sale ever. What’s the point of talking about it now? Do you think GitHub sold your data to Microsoft?
I'm not one of those enraged over this, but it is both perplexing and disappointing.
It's the same thing with time; consent when given should not be eternal. I don't want to be contacted by a company I signed up to 12 years ago and forgot about to contact me about a new product.
One could argue that having your data with Google is more damaging to one’s privacy than having it with any other company, considering that Googles business model is the selling of ads based on your data, but that’s besides the point here.
You have a record of your details secured with locally stored biometrics and systems can reference that data with your consent (and an audit history) That way you don't need hundreds of accounts just to order food, products etc.
So the third-party never knows who you are, or where you're located, but are able to use your location by referencing your location record. That way they don't need to store any data about you.
So the value of data is a modern day business windfall, that can be argued as unfair. Or fair. Depending on your viewpoint.
What's dumb about that take?
Everyone believes they know the hard line Google will not cross for shutting down products, and everyone eventually is wrong.
1: GM also has a reputation for getting a product just right and then killing it.
You have your mail, storage, office suite, photos, chat, etc, hosted by Google, they made it easy to host your domain there working with all those services, and all that vertically integration kept us comfortably in their warm embrace.
Now they're selling it because... why? Only theory that holds water is it doesn't make _enough_ money. Well sure it isn't a huge revenue source but it isn't losing money either, and the intangibles felt like they more than justified keeping it in-house.
Hopefully the inside story comes out, as I would be fascinated to hear their thought process.
Is there anything noteworthy going on here, or are we just confused/pretending to be confused about the world and looking to put a spin on it?
If I (the first party) have given data to a company (the second party), and that company is sold to someone else (the third party), then my data was sold to a third party.
> Customer data is being transferred in the process, all the time.
Right. Being common doesn't mean it isn't problematic, though. This is one of the reasons to minimize the amount of data you reveal to any company.
Certainly. However, taking a common business/law(?) issue and making it a Google issue is lame.
EDIT:
> That sounds like a distinction without a difference to me.
> If I (the first party) have given data to a company (the second party), and that company is sold to someone else (the third party), then my data was sold to a third party.
Well. I can see where you are coming from, but we have to be able to differentiate between
a) an ongoing 1p<->2p relationship, where 2p is selling data to a 3p
b) a relationship, where the entire 2p gets replaced
These two setups are clearly not equal. There is a distinction. And a difference.
Suppose I let you borrow my car, on the condition that you not allow your son to drive it. When the car gets totaled, you tell me that you gave the keys to your spouse, and they were the one who let your son drive it. So I have no reason to be angry at you, because you didn't directly hand the keys to him.
If you draw an imaginary line around some of the people and assets in a company, declare that the data belongs within that imaginary line, and then say everything inside that imaginary line is being sold, that's the same sort of shell game.
> Is there anything noteworthy going on here, or are we just confused/pretending to be confused about the world and looking to put a spin on it?
Yes. There's a lie being told that "selling a business" and getting customer data along with it is somehow distinct from "selling data".
Google Domains *was* profitable, I confirmed internally. Growing extremely fast (~$120M ARR now, ~growing $40M/year)
We don't know what the expenses were. It's still possible it wasn't profitable.
The only real expenses would be dealing with customer service and card fraud. While it’s possible that those costs could be substantial, Google isn’t exactly known for throwing a lot of money at customer service.
So it doesnt matter, i speculate, if it was earning $1M in profit a year for 10M domains if they need to employ 50 call center staff - and for the next 10M domains they need to hire another 50 call center staff— I think they would rather pull the plug.
Which I personally would never do, but, it is in line with other decisions they’ve made and how I have heard key people talk about googles leadership externally.
This is 1000% true. The culture is that diminishing returns means linear scale will eventually turn into a cost center. Execs only care about 10x initiatives. My understanding is that Larry personally canceled gFiber b/c the margins, while profitable, were too thin.
It's a huge pain in the ass to deploy fiber. The cities that got Google Fiber mostly had to bend over backwards in order to do so. There's a lot of logistical (and legal) factors that just don't exist for pretty much any other Google product.
Like what approvals does Google need to release Bard? But you could make pages of approvals needed to deploy fiber to a city.
Well, for one they still need Ireland's DPA approval before they release it to the EU.
The point is that fiber would require a lot more approvals than many of the pure software projects. Also afaik, fiber never launched in EU and exists in many less locations than Bard.
That makes sense given "nothing linear", but I can't understand why they would have thought it could have been better. Same for domains. In what scenario would they grow exponentially?
like someone else in this thread said; in theory it’s a global distribution of 1kb in a database and a user interface.
if you are the best at AI, maybe you can solve the support burden. Or at least thats what they attempted.
Nevermind that non-linearity should have been achievable[0] via lobbying at the state/federal level.
[0]An advantage only really achievable by a company as large as google, with money and weight to throw around.
Surely that's a lot more trivially fixed with a small price bump than throwing the entire revenue stream & user sentiment into the trash?
Google Domains is currently charging $12/year for a .com domain, which we know from cloudflare the "at cost" price of that is $9.15/year. Comparing the $12/year to other providers it's kinda middle-of-the-road, not especially cheap or anything. Shopify is $15/year while porkbun is ~$10/year, so $12/year certainly appears to be a price that has adequate margin to either be profitable or if not only needs a small bump to be profitable?
The ROI on Domains is likely to be no where near that of, I don't know, GKE or BigQuery. You can argue all you want about how those are totally different projects with totally different considerations. But at the end of the day, unless Google wants to have a strategic investment in maintaining an end user facing Domain Registrar service, the ROI is all that matters. They are focusing and consolidating all their "developer facing" services in GCP. What makes sense will eventually move there, what doesn't will get cut.
ARR and YoY growth tell you nothing about profitability or the ROI. Google never shied away from deprecating services that they don't care about to focus on things they care about.
"Google Registry is currently offering .app, .dev, .dad, .phd, .prof, .esq, .foo, .zip, .mov, .nexus, .page, .new, .how, .soy, .day, .boo and .みんな. We also own .ads, .eat, .fly, .here, .ing, and .meme among others. We'll be using some of the domains we own, such as .google, .youtube, and .chrome, for Google products, so they won't be open to the public."
It seems Google will continue working with registrar partners, but not operate a registrar themselves anymore (Google Domains). It does not seem like anything will change for this wholly owned registry entity.
In the future we'll be renewing our .dev domains with other registrars who themselves register the domains with Google Registry / Charleston Road Registry as the TLD administrators.
> And for those saying: "well, better than shutting down Google Domains"
> Google Domains was profitable, I confirmed internally. Growing extremely fast (~$120M ARR now, ~growing $40M/year)
Which, I mean, obviously the product isn't so unprofitable that it needs to be shut down, or nobody would be interested in buying it.
Maybe Google Domains isn't the company's most profitable product, and maybe Google would be able to make even more money by allocating those resources elsewhere. But the point that people are upset about is that Google is going against a principle it had publicly committed to. Principles don't count for much if you only follow them when there's no cost to doing so.
I thought they've been shutting down products for a long long time now?
> To make privacy real, we give you clear, meaningful choices around your data. All while staying true to two unequivocal policies: that Google will never sell any personal information to third parties, and that you get to decide how your information is used.
The parent commenter was presenting a false dichotomy, as if either selling the product or shutting it down were the only options. But there's no reason that has to be the case.
And even if it was -- which seems unlikely to me -- shutting down the product and giving users the option to switch to a different provider would be more ethical than just selling their data without asking for consent.
This is surprising to literally nobody who's paid even a cursory amount of attention to Google over the past 20+ (and especially 15) years.
(I know Google has the legal right to do this, but that’s not the issue here.)
If a user doesn't consent, then sure, you can go ahead and do whatever policy changes or mergers or acquisitions you want, but you don't get to include that user's data in the deal.
Apparently the Google Domains UI is sticking around too, although who knows how long that'll last.
Edit: If anybody disagrees, I have a question to ask you: How would you feel if Google sold your youtube view history to the likes of Facebook, Tiktok, or Palantir? Better for them to ask first, or simply delete it. This SHOULD be required by law.
Some folks -- perhaps those who believed the lies about "unequivocal policies" -- would rather have it shut down than have their data sold.
So it’s not “special” in terms of acquisitions in general, but directly defies the public statements of Googles CEO and is notable in that way.
And I am, I'm moving to Cloudflare. It's a superior service anyway and they support my TLDs. I never bothered moving before simply due to the minor effort involved.
They decided not to end service and allow you to migrate to your provider of choice, but to sell your account to another provider. Meaning your account was not valuable enough to continue service, but was valuable enough to sell to a third party.
They started this whole process by aggressively buying the .dev TLD domains and forcing TLS, breaking tooling that used that domain for development (even if that wasn't a great idea).
All for what? Too much ad money and no vision.
Why didn’t they transfer Google Domains stuff to their own cloud outfit?
FTA: "Once regulatory approvals are obtained and the transaction closes, the billing and support services for Google Workspace (including G Suite) subscriptions currently billed by Google Domains will be managed by Squarespace."
Google is handing over the personal information of its subscribers, and the responsibility for their accounts, to Squarespace. In return, Squarespace is giving Google a bunch of money (revenue).
Once the data is in Squarespace's hands, what's stopping them from using it for marketing purposes? The customer data obviously has marketing value. Google's announcement says that after the "transition" is complete, customer data will be handled subject to Squarespace's privacy policy, which (naturally) gives Squarespace permission to use it for marketing.
Fool me once, shame on you.
Fool me 483 times, shame on me.
That's the big deal here. Google has previously sold information like "show an ad to people who own domains" but not "give me an email list of people who own domains"
Google has over and over and over again collected as much information as possible about users, and then guarded it zealously against others (while profiting by exploiting it).
This is unequivocally different from collecting information and then giving it to others, which is what will happen as part of this sale.
I can't say with confidence that this is the first time that Google has sold personal information to a third party, but I'm not aware of any other cases, and certainly doing so has not been their traditional modus operandi.
My experience at Google (not recently) was that Google is/was so zealous about properly siloing and guarding PII that it was at times an obstacle to preventing criminals from defrauding Google for large sums of money. Never mind selling it to third parties, but in some instances teams would require high-level (director-level?) sign-off to let other teams (e.g. anti-fraud) see the information they'd collected. I cannot say if this is typical, but I saw it happen more than once. That is a pretty privacy-focused company.
Google is also zealous, though law-abiding, about pushing back on the government demanding information about users. That doesn't mean that the government never wins (so think twice about giving Google information that will get you in trouble with the government), but it's in stark contrast with the "welcome to Room 641A, yeah sure wiretap all our users" attitude of the telcos. Everybody talks like PRISM was the fault of "the tech companies", but that's literally backwards.
So, is this sale-of-personal-information an absolute first? As far as I know yes, but maybe not. But it's definitely not business-as-usual for Google.