Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

● Home

● About Us

● Ongoing Series

● Tech Policy Events

● Podcast

● Subscribe

Technology Liberation Front

Keeping politicians' hands off the Net & everything else related to technology

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy ●

Paternalist)
by Berin Szoka on February 11, 2010 · Comments The Technology Liberation Front is the tech policy blog
dedicated to keeping politicians' hands off the 'net and
everything else related to technology.
I’m a big fan of CNET’s “Buzz Out Loud” podcast and often enjoy co-host Molly Wood’s occasional “Molly Rant” but I’m Learn more about TLF →

disappointed to see her jumping on the Google-bashing bandwagon with her latest rant: “Google Buzz: Privacy

nightmare.” Instead of appreciating the “privacy by design” features of Buzz, she seems to be rushing to privacy

paternalism—just as I feared many would when I blogged about the Buzz launch.

Molly’s primary complaint, repeated several times, is that “you automatically follow everyone in your Gmail contact list,

and that information is publicly available in your profile, by default, to everyone who visits your profile.” Actually, while ●

Buzz does automatically follow some users your contact list, it does so only for the ones you chat with most using Gmail

(which I believe means only other Gmail users). After that, Buzz simply tells you when other users follow you, and makes
Search
it easy to follow them.
powered by

So what’s the big deal? Molly’s concern, shared by a number of other bloggers, is that, before a user can start Buzzing, ● Digital Policy Reading List

they have to set up Google Profile (another Google product launched last August, which typically appears on the bottom of
❍ Are You An Internet Optimist or Pessimist? The Great
the first page of Google search results for that name) and the default setting for Google profiles is to “Display the list of Debate over Technology’s Impact on Society
people I’m following and people following me.” In this respect, your Google Profile is a lot like your Facebook profile,
❍ The Digital Decade’s Definitive Reading List: Internet &
except that users can decide to hide their followers/followees on their Google profile. (On Facebook, that information is Info-Tech Policy Books of the 2000s
part of the limited bucket of “publicly available information” and can’t be hidden by the user from their profile, but users
❍ The 10 Most Important Info-Tech Policy Books of 2009
can opt-out of having their profile accessible at all through search engines or Facebook search.)
❍ Cyber-Libertarianism: The Case for Real Internet
Freedom
There are essentially three ways of dealing with this concern about inadvertent sharing of sensitive contacts:

1. Buzz could autofollow no one—in which case many users would probably log in, see no Buzzes from other users
● Recent Posts
because they’re not yet following anyone, wonder what all the fuss is about, and abandon the service without really

getting the sample experience that having a small set of automatically added followers provides. ❍ We’re from Government and We’re Here to Help (Save
Journalism)
2. Gogole could change the default setting for Google profiles not to “Display the list of people I’m following and people ❍ Can These Numbers Be Right? FCC Paperwork
following me.” This change in default would make a huge difference in just how easy it is to build out one’s social Nightmare = 57 Million “Burden Hours”!
network, since the best way to find friends you may not have in your own contact book is to look at the list of users ❍ PFF is Hiring!
your friends are following.
❍ Should Court Reject Google Books Settlement On
Privacy Grounds?
3. Google provide clearer notice to users to remind them that their most frequent contacts may be publicly visible on

their Gooogle profile—which is exactly what Google implemented earlier today by adding the text shown in this splash ❍ NetChoice Takes a Plane to Maine to Testify—Again

screen for initial creation of a Google Profile: ❍ Apple v. HTC: The Plot Sickens

❍ The Real Reason the Google Convictions in Italy are

Bad Precedent

❍ Welcoming Larry Downes to the TLF

❍ My Swan Song Moment: I Will Take Elmo Hostage in

the Name of First Amendment Freedoms!

❍ A Bailout for Newspapers? The Onion Gang Says NO!

❍ testimony at FCC’s Hearing on “Serving the Public

Interest in the Digital Era”

❍ Innovation at the Core Drives Innovation at the Edge (&

Vice Versa)

❍ Misdirected Blame on Internet Companies for Failures

in International Affairs & China

❍ Stats, Stats, & More Stats (@ the Net & Online Media)
Somehow, I suspect that won’t be good enough for her and many other users complaining about this. I wouldn’t be
❍ C-SPAN, Civic-Minded Programming & Public Interest
surprised to see the privacy paternalists at EPIC filing another complaint with the FTC arguing that users are too stupid to Regulation
figure this out for themselves, so the government has to do it for them—no matter the costs to other users in added

hassle and a less useful network. ●

There just isn’t anything wrong with encouraging consumers to use your product rather than making it hard for them to
❍ People ❍ Recent ❍ Popular
get involved. The success of any social network in achieving a critical mass of vibrant, broad-based participation depends

critically on differences as small as whether a user sees a few users when they first start out—or just an empty Inbox. Ban Most Discussed
things like autofollowing, no matter how transparent to the user and easy to over-ride they might be, and you’ll make it a ❍ Can These Numbers Be Right? FCC Paperwork Nightmare = 57
Million “Burden Hours”!
lot harder for the next social networking service to get off the ground—and pose a challenge to Google, Facebook and 6 comments · 9 hours ago

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (1 of 10) [3/8/2010 9:02:42 AM]

 Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

Twitter.
❍ “Special 301 Watchlist” Threatens Open-Source Software
30 comments · 3 days ago
Molly’s next complaint:

❍ Laptop Spying and the Fourth Amendment

let’s say you’ve customized your Google profile page with the vanity URL Google helpfully offers at the bottom of the 25 comments · 6 days ago

page. Well, that’d be your e-mail handle. Anytime anyone does an @ reply to you, they’ve broadcast your e-mail
❍ Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy
address to the world. Paternalist)
57 comments · 1 week ago

True indeed. But she fails to mention that the vanity URL (in my case, http://www.google.com/profiles/berin.szoka) is ❍ Call for Examples of Open-Source Money Makers
11 comments · 5 days ago
purely opt-in. When a user first sets up a Google Profile, they’re given a non-identifying string for their URL that doesn’t

tie to their email address. Just above the option to opt-in to the vanity email is this explanation (emphasis added): ❍ The 5-Part Case against Net Neutrality Regulation (Debate vs. Ben
Scott of Free Press)
15 comments · 1 week ago
To make it easier for people to find your profile, you can customize your URL with your Google email username. (Note

this can make your Google email address publicly discoverable.) This unique name will also be used in other

links to your content on Google. To help others discover your profile, in some Google services contacts who know your

email address will see a link to your profile

● Most Popular Tags

So… what more should Google to do? I guess they could bold and italicize the warning as I’ve done…
antitrust Apple broadband broadcasting cable
She’s even more clearly mistaken about the way Buzz works on mobile phones (as one commenter noted):
censorship children Comcast content ESRB
there are no preferences in the Android app–no way, near as I can tell–to choose to broadcast only to the list of Facebook Fairness Doctrine FCC Federal
people you follow or a group you’ve established, as you can in the Web interface. So be equally prepared for everyone Communications Commission Federal Trade
around you to know who you are and where you are when you post to Buzz from your phone. Yeah, no, really. I’m
First Amendment Free
Commission
totally not making this up.
free speech FTC
Press

Actually, Buzz is accessible through the mobile browser (not an app), and it gives users the same choice every time they
Google Internet iPhone Kevin Martin
post a new Buzz as to whether the Buzz should be public or private—just as on the desktop browser version. The default

setting is public, yes, but so what? Is it really that hard to click “Private?” When you do, you’ll get a list of whatever
media Microsoft MySpace net
contact groups you’ve created so you can share your Buzz just with that list—or you can start a new list.
neutrality Obama online Pacifica parental

Moreover, “Show Nearby Users” feature only shows Buzzes from users who have decided to broadcast their location.
controls parents PFF Privacy radio ratings
regulation safety satellite speech
A number of these responses were raised by commenters on the piece. Most notable was this comment (originally written
technology television transparency TV Video
in ee cummings style, which I have punctuated for readability), which takes issue with Molly’s central complaint that there
Games & Virtual Worlds
should be more “setup required”:
● Contributors

i like your show for the most part, molly. but seriously, privacy on the internet these day is like having sex: it’s on us

to protect ourselves. it may say “no set up required.” but if we are concerned about things getting out that we don’t Adam Marcus Adam Thierer
want, always check the setting! it’s your virtual condom. wrap it up…
Alex Harris Berin Szoka

Crude, but exactly right: It’s one thing for Molly and others to suggest ways for Google to make the privacy controls for Braden Cox Bret Swanson
Buzz and Google Profile more accessible and easily understandable. Google’s already shown its eagerness incorporate Carl Gipson Cord Blomquist
constructive suggestions to that end. But it’s quite another thing for privacy paternalists to insist that we just can’t expect
Hance Haney James Gattuso
users to take any responsibility for their own privacy.
Jerry Brito Jim Harper
Instead of preaching “Sharing-abstinence-only” (which is what the paternalists’ cry for “opt-in” boils down to), we should
Julian Sanchez Larry Downes
be teaching users how to engage in “safer-sharing”—and encouraging companies like Google to build user interfaces that

make safety options as easy to use as possible without breaking the whole site. As with sex, there’s no such thing as
PJ Doland Ryan Radia
100% safe-sharing, but, hey, that’s life. We accept risks all the time—every time we drive, get on a plane or trust that the Solveig Singleton Sonia Arrison
restaurant meal we’re about to eat hasn’t been contaminated or poisoned. As Adam has reminded us, we need to keep in
Steve Titch Tom W. Bell
mind the “proportionality” of the risks involved compared to the benefits, and, ultimately, trust users to chose for

themselves. Wayne Crews

● Where We Work
Addendum: Given the discussion below, I want to reiterate the point I stressed when I first blogged about this,

responding to questions raised by Larry Magid in the initial Buzz launch press conference:
❍ Association for Competitive Technology
❍ Cato Institute
I’m glad that Larry is raising these concern as someone who has done yeoman’s work in educating Internet users, ❍ Competitive Enterprise Institute
❍ Dancing Mammoth
especially kids, about how to “Connect Safely” online (the name of his advocacy group). The fact that companies like ❍ Heritage Foundation
❍ Mercatus Center
Google know they’ll get questions like Larry’s is hugely important in keeping them on their toes to continually plan for ❍ NetChoice
Pacific Research Institute
“privacy by design.” ❍

❍ The Progress & Freedom Foundation

❍ Washington Policy Center
But I do worry that those with a political axe to grind will take these same questions and twist them into arguments ● Our Sites
for regulation based on the idea that if some people forget to use a tool or just don’t get care as much about

protecting their privacy as some self-appointed “privacy advocates” think they should, the government—led by
❍ Agoraphilia ❍ Privacilla
Platonic philosopher kings who know what’s best for us all—should step in to protect us all from our own

forgetfulness, carefulness or plain ol’ apathy. After all, consumers are basically mindless sheep and if the government ❍ Drew Clark ❍ ReadyMadeWeb

doesn’t look after them, the digital wolves will devour them whole! ❍ Jerry Brito ❍ Sonia Arrison

❍ Maximum Entropy ❍ Space Frontier

So, by all means, let’s hear some healthy criticism about how Google has implemented Buzz and talk about how the Foundation
❍ OpenRegs.com
“privacy by design” features can be improved. But let’s make sure to get our facts straight before rushing to assume the
❍ StimulusWatch.org
worst—or before calling in the Feds to take over. ❍ PJ Doland
❍ WashingtonWatch
Comments ShareThis Posted in: Googlephobia, Privacy, Security & Government Surveillance

Showing 57 comments
Sort by Popular now Subscribe by email Subscribe by RSS

Alan Jacobs 3 weeks ago

madalu liked this.

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (2 of 10) [3/8/2010 9:02:42 AM]

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

Adam's comment (the most recent as I write) is acute and clear — thanks for it. It is for just these reasons that, after several
years with Gmail and 30,000 messages, I have abandoned it for Fastmail. I have also abandoned Google Reader, perhaps for
Bloglines and perhaps for a desktop solution. Within the next month I hope to have eliminated my reliance on all Google apps,
and eventually I hope to delete my Google account altogether. The direction Google is quite forcibly taking its customers is one
I want no part of.

Flag● LikeReply

Adam 3 weeks ago

madalu liked this.

Berin, and anyone else who may think that opposition to the Buzz rollout is unfounded, I have a feeling that you may not have a ● Archives
complete picture of the situation. I agree that when one chooses to use such a service one should not expect total privacy, and
one should take care in configuring the settings and managing one's shared information appropriately. But I am a GMail user
with no interest in using Buzz; I have already disabled it, so whatever privacy issues may arise in the use of the service are Select Month
unimportant to me. My concern is the privacy failure which happened when Buzz was rolled out. Let me just lay out the facts
and then their implications:

1) On Feb 9th, all US GMail users were automatically opted in to Buzz without their consent. This seems lost on people who ● Categories
talk about "setting up" Buzz. It set itself up.
2) If you are such a user, Google also automatically made you follow some random people with whom you have had contact via
Google chat or GMail (I am not sure if any other Google services were used in this automatic process). Supposedly, this should
have happened with "frequent" contacts, but many people have reported auto-following one-time contacts, or people they don't ❍ Advertising & Marketing
know at all (probably contacts so old they've been forgotten). ❍ Antitrust & Competition Policy
3) If you have ever set up a profile for your Google account, then all the people you are following or who follow you are ❍ Biotech
published on that public profile. The profile is only visible to other users with profiles (but bear in mind that anyone could create ❍ Broadband & Neutrality Regulation
a profile in 2 minutes if they desired to see your contacts). ❍ Copyright
❍ DMCA, DRM & Piracy
Each of these actions is worse, to my mind, than the previous. ❍ E-Commerce Taxation & Regulation
❍ E-Government & Transparency
1) Being opted in to Buzz would simply be annoying.
❍ First Amendment, Free Speech &
Online Child Safety
2) Being made to automatically follow people is a serious privacy failure. Those may be people with whom you have stopped
Inside the Beltway (Politics)
communication. Now they will be led to believe you are interested in communicating again. If your account is on a shared ❍

computer, whomever you share it with will also see this false information. In my case, I found myself following some old ❍ Innovation & Entrepreneurship
coworkers, and one of them following me, and thankfully there were no unpleasant consequences. But I can only imagine the ❍ Intermediary Deputization & Section
fallout that has happened to some people, who may have automatically followed an ex-spouse or lover or even someone who 230
stalked or abused them in the past. People have already related such stories in the GMail support forums. ❍ Internet Governance & ICANN
❍ Media Regulation
3) Having some of your contacts revealed to some other contacts could be similarly devastating. I'm not going to leave it to ❍ Miscellaneous
your imagination. Your boss could have automatically followed you and clicked through to your profile only to find you are ❍ Open Source, Open Standards &
following a competitor. Journalists have probably have their sources revealed. Whistle blowers have probably been outed. This Peer Production
is awful, by any sane measure. ❍ Patents
❍ Philosophy & Cyber-Libertarianism
So what is the answer? Unfortunately, once information is leaked, it can't be put back in the bottle. It may have already been ❍ Podcast
noticed, or indexed by search engines. All that remains is to swiftly act to limit the damage, by un-following those contacts who ❍ Privacy, Security & Government
were auto-followed, deleting one's profile and disabling Buzz. Surveillance
❍ Sin on the 'Net
The only good news is that if you disable Buzz completely (Including un-following, and deleting your profile -- the "Turn off ❍ Space
Buzz" link alone does not do this), then the fact that you have followers has no visible effect and can be ignored. ❍ Tech Pork
❍ Technology, Business & Cool Toys
I will also add that I'm continually angered by to see that while Google has addressed some issues encountered by people who ❍ Telecom & Cable Regulation
want to use Buzz, improving it and so on, none of the three fundamental problems I have listed above have been so much as ❍ Things that Go 'Bump' in the 'Net
mentioned by the GMail blog or the Google employees in the support forums. If this were a really stupid mistake and Google ❍ Trademark
apologized and tried to make it better, I would be pissed off but understanding of human error. ❍ Video Games & Virtual Worlds
❍ What We're Reading
But one really has to conclude that all of this is completely intentional; Google expects people not to notice or care (and many
❍ Wireless & Spectrum Policy
do not). I do care, and unless Google addresses those issues in some meaningful way, I'll have to try to find another email
provider that does everything GMail does, without willfully trampling my privacy. ● Tech Policy

Flag● LikeReply

❍ The 463 Blog

Stuyvesant Parker 3 weeks ago ❍ ACT Blog
❍ Broadband Politics
❍ Discovery's Disco-Tech
❍ EFF's Deep Links
❍ Freedom to Tinker
If only everyone could be as smart as you, man. Good post, good refutation. I find the "privacy concerns" post by bloggers ❍ Free State Foundation
posting under their real names with their email addresses visible pretty darn hilarious myself. ❍ The Long Tail Blog (Chris Anderson)
❍ Media & Communications Policy
Flag● LikeReply Blog
❍ Public Knowledge
❍ The PFF Blog
Ryan Radia 3 weeks ago ❍ Silicon Angle
❍ Space Politics
❍ Spectrum Talk
❍ Tech Daily Dose
Berin, do you think Google has made it clear that your "following" list is determined automatically based on the Gmail contacts ❍ Techdirt
with whom you regularly chat? ❍ The Technium (Kevin Kelly)
❍ Technology 360 (Dennis Haarsager)
The main beef in the blogosphere seems to be that the implications of having a public Google profile with a public follow list ❍ Technology & Marketing Law Blog
aren't clear when initially setting up Buzz. I'm sympathetic to this concern -- it does seem like a reasonable person might not (Eric Goldman)
realize that Buzz, unlike Twitter, auto-selects people to follow from otherwise-private Gmail contacts. ❍ TeleFrieden (Rob Frieden)
❍ Wired Threat Level
Or is there some obvious warning from Google that I've overlooked? ❍ Michael Zimmer

● Tech News
EDIT: Google's new notice, while an improvement, still doesn't provide any indication to users how following/follower lists are
selected. With Facebook and Twitter, you have to manually add in people to friend or follow. Arguably, Google is breaking with
tradition; why not simply be upfront about it?
❍ All Things Digital
Flag● LikeReply ❍ Ars Technica
❍ Between The Lines
❍ Broadband Reports
Berin Szoka 3 weeks ago in reply to Ryan Radia ❍ CNet's News.com
❍ Digg
❍ Engadget
❍ GamePolitics.com
When I first logged onto buzz, it showed me the list of users I was already following along with suggestions as to more users I ❍ GigaOM
might want to follow (or who were following me). While I agree that it wasn't exactly clear how that initial crop of followers had ❍ Multichannel News
been added, there was a big "UNFOLLOW" link next to each name. So even if I had objected to one of those persons being ❍ NYT “Bits” Blog
among my followers, I could have removed them. ❍ The Register
❍ Slashdot
With the new notice, I'd say it's pretty crystal clear that the default is “Display the list of people I’m following and people ❍ TechCrunch
following me" and equally clear how to uncheck that box. I suppose Google could make absolutely sure users haven't ❍ TechMeme
accidentally skipped past this by using the kind of extra warning used for Latitude and for other location-based services like ❍ WSJ.com Digits
Loopt—i.e., remind users later that they're sharing their follower/followee lists, just in case they really didn't mean to. ❍ Wired News

● Other Bloggers
Flag ● LikeReply

Ryan Radia 3 weeks ago in reply to Berin Szoka ❍ Café Hayek

❍ Cato@Liberty
❍ Gene Healy
❍ Henry Jenkins
I see. It does seem like you'd have to ignore some fairly clear warnings to inadvertently share your follower list with the world. ❍ Julian Sanchez
Still, given that Google is really thrusting Buzz on Gmail users, and that accidentally revealing to the public a user's Gmail chat ❍ Safe & Secure (Larry Magid)
contacts does have potentially serious privacy implications, I do think more precaution on Google's part would be appropriate. ❍ Free Range Kids (Lenore Skenazy)
(To my surprise, Google's decision to stick Buzz in users' faces when they login to Gmail has even irked some of my ❍ Marginal Revolution
reasonably tech-savvy friends who are generally big fans of Google products.) ❍ Mark Cuban
❍ Megan McCardle
Consider this anecdote about Buzz's privacy issues from "Jim," a commenter over at Techdirt: ❍ Nick Carr
❍ OpenMarket
"My mother, several competing clients of mine, and a couple of young women who get naked for a living were all able to see ❍ Radley Balko
each other today, despite me clicking to not go to buzz, for some reason it was all turned on by default and it took me a while to ❍ Reason Hit & Run
realize exactly what the implication was and how to turn it off." ❍ Tim Lee
❍ The Volokh Conspiracy
Flag ● LikeReply ❍ Virginia Postrel
❍ Will Wilkinson

● Podcasts
gcr 3 weeks ago

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (3 of 10) [3/8/2010 9:02:42 AM]

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

❍ CNet "Buzz Out Loud"

So what's the matter here: ❍ EconTalk
❍ Intellectual Property Colloquium
http://fugitivus.wordpress.com/2010/02/11/fuck-... ❍ Harvard Berkman Center “Media
Berkman”
Flag● LikeReply

Berin Szoka 3 weeks ago in reply to gcr

Julian Sanchez liked this.

Yeah, I read that. Honestly, I don't understand what she's describing. She declined to opt-in to Buzz but somehow new
contacts were added to her reader? She's so angry, she's not exactly clear about what happened.

I'm not dismissing her complaint, but it's hard to respond without knowing more. So if anyone else can explain what might have
happened in her case, I'd love to hear it.

Flag● LikeReply

Julian Sanchez 3 weeks ago in reply to Berin Szoka

Unfortunately, I'm not crystal clear myself on either precisely what happened in her instance or, frankly, exactly how Buzz
behaves by default. The Reader items should only have been shared if they had already been set to "public" (and therefore
already visible) unless someone massively screwed up implementation. So it's certainly possible that either Buzz hasn't shared
quite as much as she thinks with as many people as she thinks, especially if they're only email contacts by way of forwarding
from an anonymous account, or (more worrying) some of the information had actually been shared all along.

But as for her list of contacts—and it's hardly mysterious why she might not want her ex knowing who she's dating now—I don't
think you've got to be "stupid" to (for instance) be hastily logging into Gmail and hit enter without looking too closely when some
window pops up. Making it that easy to inadvertently share information collected for a wholly different purpose is just bad
design: Non-stupid people routinely just click through dialogue boxes because nobody does or should expect that kind of
exposure to be the consequence of absently hitting "OK" in their e-mail software. Or if they don't, I'm a moron too, because for
all I know the Acrobat EULA stipulates that I agree to be streamed via webcam 24/7.

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Julian Sanchez

Good clarification on the first point, Julian.

As for the second point, I think you're suggesting she may have accidentally opted-in to using Buzz because she just clicked
through the initial "We've Just Launched Buzz - Would You Like to Join?" splash screen. I just tried going through the set up
dialogue box again with another gmail account and it's really a lot harder to miss the notice than you're suggesting and it's
nothing click just clicking through a EULA. When the user logs onto gmail for the first time since Buzz's launch, they're taken to
a completely new screen with a white background instead of a simple pop-up over Gmail. You can't just hit "enter" to proceed.
You have to click "Sweet! Check out Buzz" or "Nah, go to my inbox." I clicked on the latter. Buzz still shows up in the folder list
under "Inbox" but it's empty--with no followers.

Now, what WOULD concern me is if users who declined to opt-in to Buzz nonetheless had their top contacts added and their
Google Reader shared items sent to those folks. If that actually is what happened to our angry blogger here, I'd agree that
she's right to be pissed off and I'm glad she's raising the issue. But if that's really what happened, I'd also be pretty surprised if
Google didn't fix the problem quickly.

There's another issue lurking in the background here, which you put your finger on: some users may indeed have chosen to
make their Google reader shared items public and then be annoyed when Buzz shares those already-public posts with auto-
followed users on Buzz. This is what law professor Dan Solove would call "increased accessibility" and it's somewhat similar to
the fact that it was always possible to see the fact someone was a fan of a particular Facebook page if you just looked at that
Page—but some users complained when all their pages were made visible from their public profile (even though they can opt-
out of having that profile itself made accessible through Facebook search or external search engines).

Sites need to be able to make changes in accessibility over time because, in the social networking space, many features will
necessarily change accessibility of even previously public information. The trick, I think, is to figure out how to handle such
changes in a way that recognizes some basic contractarian principles. In principle, I'm in full agreement with the sentiment I
hear expressed here from my cyber-libertarian comrades-in-arms that the burden rests with a site to inform users about the
change. Again, that's where bolding key text and making an opt-out easy becomes essential—which is precisely what Google's
done with the revised splash-screen I included in my post above, to make it easier for users to change the "show followers"
setting on their Profile. Perhaps Google ought to go further still, such as by reminding users about the auto-following feature.
But it's worth noting that the initial "Welcome to Buzz" screen does point this out, as you'll see in this scren capture.

I've highlighted the key text. Perhaps Google should indeed bold that text. (I wasn't being snarky or dismissive when I
suggested that in my post above.) And perhaps some of this stuff merits a reminder email a la Latitude (see my response to
Eric below).

But... "privacy nightmare?" Really? My main point here is that you'd have to both have a pretty low opinion of the intelligence of
the average user and assume that Google really was out to screw its users here to reach the "nightmare" conclusion. If this
discussion highlights anything, it's just how strong the reputational pressure is on companies, even as big and successful as
Google and Facebook, to "get it right" when it comes to this sort of thing—and, if they don't get it quite right out of the box, to fix
real problems in ways that don't break the experience for everyone.

Let me emphasize something I alluded to above: Yes, obviously, Google has a lot to gain here by encouraging user
participation but so do Google users! Buzz would be a far more valuable tool for me and everyone else if it actually managed to
break beyond the narrow confines of techie-uber-geekdom and bring in users like my Mom or <insert your favorite relative
here>. I'd really, really love for a site to do what Twitter has not and succeed in making a new form of status updates
ubiquitously used in the same way gmail is. The value of such a tool was really driven home to me this past week as some of
my non-Twitter- and non-Facebook-using friends and relatives called me to ask how I was faring in the blizzard, whether I had
lost power, etc. I was happy to talk to them, of course, but I would rather not have rehashed basic information that they could
have gotten from simply looking at my latest Buzzes. With that information out of the way, we could have gotten on to much
more interesting conversations. And of course, the folks that actually called to check on me are just the tip of the iceberg
compared to all the people who simply had no idea what was going on and didn't think (or have time) to call.

So if I'm willing to cut Google some slack here for things like autofollowing, it's because I see great value for all users in trying
to invent something like "Email 2.0." If they want to make that happen half as badly as I do, they'll be listening very, very
carefully to complaints about how Buzz has rolled out and work to address these concerns by making sure privacy-sensitive
users know what they're doing. I much prefer that kind of innovation through trial-and-error to simply trying to revert to
restrictive default settings.

Flag● LikeReply

Julian Sanchez 3 weeks ago in reply to Berin Szoka

The setting you mention at the outset may be new, or maybe that's just an account without much action on it, because I
definitely did not do anything of the sort, and my account got populated with followers anyway.

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Julian Sanchez

I think you're right, Julian. As Jim's experience suggests, even users who decline to opt-in have Buzz set up for them (even if
they're not buzzing anything). So, as I discuss below, the question we need to ask is, what does it mean to be opted-in to Buzz.

Flag● LikeReply

Jim Harper 3 weeks ago in reply to Berin Szoka

My experience was similar to Ms. FU, Google. That I'm aware of, I didn't opt in. It just appeared and started connecting me to
correspondents. I use my Gmail account for a mix of personal and professional communications, and I don't think the fact of
emailing people is a reason for them to come into my social network and see who else is (rightly or wrongly) in my social
network.

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (4 of 10) [3/8/2010 9:02:42 AM]

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

I'm not ready to say "FU, Google." Instead, WTF, Google?! This is just stupid and ham-handed.

Flag● LikeReply

gcr 3 weeks ago in reply to Berin Szoka

It is hard to tell what is going on. I turned off buzz as soon as it noticed who my follow relationships were, and I realized they
had nothing to do with what I considered people that were important to have in a social network together. I don't use reader or
that many other google social products, so I hope I'm ok.

However, reading the rest of her blog, I'd be interested in hearing what she has to say about people who describe privacy
advocates as "paternalist."

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to gcr

Fair enough. Again, I certainly don't mean to dismiss all privacy advocates as paternalists. My title was a bit glib in that respect.
What I was really trying to suggest is that there are essentially four ways of looking at this (or a spectrum that includes these
points):
1) Google can do no wrong. Anyone who's confused is stupid and deserves whatever happens to them.
2) Google may not have gotten this exactly right and there's room for improvement here, but the answer lies in building in some
better notices to users to make sure they know what's happening here. Google's alrady done some of that but there room for
them to do more.
3) Google really screwed up. The only way to fix these problems is for Google to turn off auto-following and/or set Profiles not
to show followers/followees by default.
4) This is a "Privacy Nightmare!" The FTC should get involved immediately, sanction Google heavily to avoid such future
travesties, and impose restrictive defaults.

The first is certainly not my position. I'd put myself squarely in the second camp. I'm not quite suere where Molly would fall
between the third and fourth camps (and I'm sorry if I lumped 3 and four together under the "Privacy Nightmare"="Privacy
Paternalism") title), but there some of her commenters and other bloggers certainly fall into the fourth camp ("This should be
illegal!"). I think most of the debate here is taking place somewhere between the second and third positions. Apart from
suggesting that getting the government involved would be unwise and that we should be careful to get our facts right (which
Molly didn't quite do), my main point here is that the more trust we have in users (and also that reputational pressure generally
works to promote privacy by design or, in some cases, re-design if the initial product isn't quite right), the closer towards #2
we'll fall.

Flag● LikeReply

Adam 3 weeks ago in reply to Berin Szoka

Buzz is not an opt-in service. I think that misunderstanding has led you to a large misunderstanding of the problem.

Flag● LikeReply

Berin Szoka 3 weeks ago

One final thought before I turn in for the night: Have we all forgotten about the phone book? I mean, that book lists our name,
telephone number (if you still have a landline) and address, all in one place. Shocking! And yet no one ever really to care all
that much...

Flag● LikeReply

Jim Harper 3 weeks ago in reply to Berin Szoka

The phone book doesn't tell anyone who you've been calling. The analogy is inapt.

Flag● LikeReply

cordblomquist 3 weeks ago

What more could Google do? Make the product opt-in. Twitter gained a user base without the help of being owned by the
world's most popular search engine, so Buzz should be able to compete without being shoved into my Gmail account.

I'm a professional web developer and social media promoter and I still have no idea what Buzz is doing with all of my info
because it's not intuitive at all. I have a bunch of articles starred in my reader about Buzz which I need to read at some point
(you may already know that), but I shouldn't have to do research to understand a product that was added to my Gmail without
my asking.

When I say "shouldn't" I'm not implying that Google ought not be allowed to do what it wants with it products, I'm saying that
Google shouldn't do these things if it values the goodwill of its customers. Google is well within its rights to change products
whenever it wants, but that doesn't mean we have to like it.

Flag● LikeReply

Eric Reasons 3 weeks ago

Berin-
I just got this very interesting e-mail from Google. It looks like Google, as you stated above, are taking people's constructive
criticism to heart:

==
Hi,

To protect your privacy we would like you to know that Google Latitude is running on your Android-powered device and
reporting your location.

If you didn't enable this or want to stop reporting your location please open the Maps app on your device. Go to 'Menu' >
'Latitude' > 'Privacy' and change your privacy settings.

Thanks,

Google Latitude Team

===

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Eric Reasons

Thanks, Eric. This is exactly what I was referring to when I suggested in a comment above that Google could address these
concerns about the auto-following feature by sending the same sort of "unmissable notice" to new Buzz users as it sends to
new Latitude users, reminding them that Buzz will start them off by following some of their most common contacts. To the
extent that this is mainly what Molly was suggesting, it's certainly not unfair criticism, nor is it necessarily "paternalistic." But I
still think it's a stretch that not having this kind of additional, belts-and-suspenders notice makes Buzz a "Privacy Nightmare,"
especially given all the other privacy controls built into the system. Again, the ability to limit access to a post to just your friends
is a major improvement over Twitter. It's very much like Facebook's new publishing controls—a great feature for which they got
zero credit from critics who fixated on the potential exposure of a user's friend and pages lists.

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (5 of 10) [3/8/2010 9:02:42 AM]

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

Flag LikeReply

Tim Lee 3 weeks ago

Berin, I think you're underestimating the cognitive "transaction costs" of evaluating a product like Buzz. It's one thing to say that
users who sign up for a service like FaceBook or Twitter have an obligation to do their homework and make sure they're
comfortable with how their information will be shared. People who are too busy to do that homework can just decline to sign up
for the service.

It's quite another thing to bolt these kinds of "features" onto an existing application that's not traditionally considered a social
networking application. A lot of users will skim the "sign up for Buzz" dialog box, fail to understand its implications, and sign up
for sharing features that are more promiscuous than they realize. I think that's more Google's fault than the user's. A
reasonable user should be able to expect that if they choose the default options in their email client, that it won't result in
suddenly exposing a bunch of private information to the world.

None of which is to say that we should be getting the government involved. But public criticism is an important part of the
market process. The bad publicity Google is now getting for its boneheaded decisions is an important part of the market
process. There's nothing paternalistic about criticizing Google when it creates products that cause a significant number of its
users to inadvertently expose more personal information than they intended.

Flag● LikeReply

Jim Harper 3 weeks ago in reply to Tim Lee

Seconded: It's not paternalism to criticize products as a market actor.

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Jim Harper

Agreed!

Flag● LikeReply

Adam Thierer 3 weeks ago in reply to Tim Lee

Tim... Of course it is true that "public criticism is an important part of the market process," and that it can have a powerful
impact on corporate behavior. The same holds true for debates over acceptable media content. The problem, however, is that
far too many people (including now yourself above) put forward the "well, people are just too stupid or lazy to know what's good
for them" argument and claim that consumers just can't be expected to read the fine print, check a little box, or just stop using a
service.

Worse yet, they then use that anti-personal responsibility ethos as an excuse for government intervention. Whether it's media
content or privacy policies, I hear the same syllogism again and again:

1 - People "don't understand the implications" / are getting fooled / don't know what's best for them
2 - Companies can't be trusted to set the right defaults (namely, they can't be trusted to self-regulate to self-censors edgy
content, or they can't be trusted to cripple information sharing by default in the name of privacy)
3 - Therefore, SOMEONE (uh, that would be the feds) needs to set a better default (to establish a better "community standard")
to protect us
Of course, I know YOU would not counsel #3 as the solution, I'm just saying that's where the logic of #1 and #2 lead. And if, as
you suggest, public pressure and social norms change corporate content or innovation choices in a spontaneous fashion, then
fine. I have no problem with that.

Finally, let's not forget we are talking about an email / social networking feature here that no one forces us to use, and there are
plenty of other options. As you said in your Tweet last night, you are glad you don't use Google as your default mail provider.
Same goes for me. (Dirty little secret: I hate Gmail. Absolutely despise it. Almost never use it). And others are always free to
use alternatives. If they do so because they don't like Gmail's new social sharing features via Buzz, then fine. That's a choice.
It's the same choice I would support with a conservative group rallies people to stop watching certain shows because they are
"smutty" -- just so long as those groups don't try to tell ME what to watch or take away my access to exciting new services and
innovations.

Flag● LikeReply

Ryan Radia 3 weeks ago in reply to Adam Thierer

I don't think pro-regulation privacy zealots deserve a monopoly on criticizing a market product's privacy features. Of course, if I
take issue with Gmail, I don't have to use it. But if concerned users can successfully convince Google to change its ways for
the better before jumping ship en masse, then it seems like the market is working. (Oh, and I suggest you try accessing Gmail
with Outlook; thanks to IMAP+SSL it rivals native Exchange in many respects.)

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Ryan Radia

Agreed completely, Ryan. I should have stressed more in my post that I didn't mean to discourage healthy criticism. As I
mentioned in my original post about Larry Magid's questions,

I'm glad that Larry is raising these concern as someone who has done yeoman's work in educating Internet users,
especially kids, about how to "Connect Safely" online (the name of his advocacy group). The fact that companies like
Google know they'll get questions like Larry's is hugely important in keeping them on their toes to continually
plan for "privacy by design."

But I do worry that those with a political axe to grind will take these same questions and twist them into arguments for
regulation based on the idea that if some people forget to use a tool or just don't get care as much about protecting
their privacy as some self-appointed "privacy advocates" think they should, the government—led by Platonic
philosopher kings who know what's best for us all—should step in to protect us all from our own forgetfulness,
carefulness or plain ol' apathy. After all, consumers are basically mindless sheep and if the government doesn't look
after them, the digital wolves will devour them whole!

Molly, much as I love her, was off on several key factual details so my main purpose was to set her straight on how Buzz
actually works and to note just how much granularity of privacy control it gives users. The key issue, I agree, is how Google has
implemented the auto-following feature.

Flag● LikeReply

Tim Lee 3 weeks ago in reply to Adam Thierer

The problem, however, is that far too many people (including now yourself above) put forward the "well, people are just too
stupid or lazy to know what's good for them" argument and claim that consumers just can't be expected to read the fine print,
check a little box, or just stop using the service.

Adam, I'm saying precisely that "consumers can't be expected to read the fine print" for all the websites they visit. This isn't
about stupidity or laziness, it's about cost-benefit analysis. Digesting fine print takes time, and it would take a ridiculous amount
of time to read all the fine print on every website I visit. Instead, I expect the web apps I use to behave in a reasonable fashion.
Among other things, I expect them not to disclose my personal information without my clear and explicit consent. A large
number of GMail users feel that Google has failed to live up to this obligation.

Flag● LikeReply

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (6 of 10) [3/8/2010 9:02:42 AM]

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

Adam Thierer 3 weeks ago in reply to Tim Lee

The argument that Google could have done more to make users clearly aware of the changes is probably the best one out
there. But it begs the question: How much notice is enough? And what constitutes "clear and explicit" consent? Think about all
the fine print in the many other contracts and documents we sign onto every day in this world. In each case, the question of
notice and "clear and explicit consent" comes into play but generally let people sign off on all sorts of things without reading
every word of what is in the contract. In Google's case, what would make you happy? I can imagine a scenario in which a lot of
bells and whistles go off and you are asked 3 times to consent to sharing information in the way Buzz does. Is that enough? Or
are you saying -- like most privacy regulatory advocates do -- that precisely because of that oh-so-tedious mental transaction
cost problem that the default setting should be required to be set at "Cripple Information Sharing"?

The Net -- and the engine that powers it (advertising) -- is built on information sharing. A lot of people don't like that fact. But if
you cripple information sharing by default because people don't like the "cost-benefit analysis" associated with reading fine
print, it will have serious ramifications. Namely, we are going to start getting charged for services that are currently free of
charge. Perhaps that is the path most people prefer; I just hope they understand the consequences.

Flag● LikeReply

Jim Harper 3 weeks ago in reply to Adam Thierer

Adam, these transaction costs are typically taken care of by implying terms into contracts based on custom in the relevant
industry or market. (If you think that's socialist denial of individual responsibility, try living your life without implied contract
terms. Ya can't do it.)

I'd find it very hard to believe that any industry or market has a convention that one party to a contract is allowed to change its
terms.

This is about *changing the terms of a service* after consumers chose to use Gmail based on one set of promises. It's not
about whether the Internet "is built on information sharing" blah blah blah.

Flag● LikeReply

Adam Thierer 3 weeks ago in reply to Jim Harper

Well, we're dangerously close to devolving into a spat about EULA's again, which I don't want to get into. But let me just say
this... Every time we download a new program or even a new patch for a piece software (something I do almost every day in
the Android market), or sign up for a new service, or whatever else we do online, there's always this question of contact and
consent haunting each transaction. While I agree more notice is, generally speaking, always a good thing, I do wonder how far
we have to take these notions. There is implied consent all over the place on the Net; especially because almost everything
online is free of charge. So I think we need to be careful about an overly formalist approach to contracts and consent in this
regard. It could have profound implications for the way the online world works and -- regardless of your dismissive tone, Jim --
that is important.

Flag● LikeReply

Jim Harper 3 weeks ago in reply to Adam Thierer

Well, there are evidently several moving parts to this question. Evidently, I'm in the category of Gmail users who declined to opt-
in to Buzz, but was signed in to it anyway. At their promotional splash page yesterday, I hit "No, just take me to Gmail" or
whatever, where I found Buzz inserted into my navigation tree. After a while, I did click on that link, after which I found it
populated with followers and people I was following.

I did not consent to that, I don't think there's a good argument that my use of Gmail was implied consent to making me a Buzz
user, and I don't think there's an implied term in Gmail's policies that Google can change its terms to make me a Buzz user.

The way the Internet functions would not be upended by holding service providers to the terms of their promises. There is
plenty of (explicit and implied) contractual information sharing on the web that's not going to stop because contract terms are
fixed and enforceable.

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Jim Harper

Again, Jim, as I noted above, if Buzz is actually opting-in users who initially decline to opt-in, that's genuine cause for concern. I
don't have a problem with them adding Buzz to the navigation tree under "Inbox" but I'd agree that, when the user clicks on
Buzz, they get some kind of reminder about what Buzz is, how it works and why they might want to use it.

The next question I'd ask is: What does it actually mean to be opted-in if you're not using buzz? (I think this is where our
stalking-victim blogger ran into problems.) If a user declined to opt-in and isn't posting any Buzzes, why does it matter whether
Buzz has auto-added some followers for them?

I think the answer lies here, from the screen users find the first time they visit Buzz: "Your Google Reader shared items, Picasa
Web public albums, and Google Chat status messages will automatically appear as posts in Buzz." Our blogger friend seemed
to be concerned about the first issue. But in all three cases, these items are already public, so the concern seems to be simply
a matter of increasing the accessibility of those already-public items.

I'm not saying Google shouldn't do more to make it clear to users that this is happening, especially if they've declined to opt-in
to Buzz but, again, why can't that be handled through better notice?

Flag● LikeReply

Julian Sanchez 3 weeks ago in reply to Berin Szoka

So, in the case of the angry blogger, I can see where even revealing the identities of her other contacts could be a serious
problem. "Oh, so THAT'S the new guy..." But if I understand what she's saying correctly, she had made a point of setting her
shared Google Reader items to "private"—and was then horrified to discover that her frequent contacts had become "followers"
entitled to see those shared items, along with her own comments containing references to where she lived and worked. If that's
what happened, it really is inexcusable, even if they fix it after the fact.

The meta-point here, though, is that *we do this for a living* and we're not entirely clear on how this thing is sharing our
information one way or the other. Doesn't that suggest a problem to you? Especially given the sheer quantity of information
Google has, provided for wholly different purposes?

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Julian Sanchez

As a general matter, I take your point to heart, Julian: this is confusing and Google certainly should have done a better job of
explaining it. That does suggest a problem to me, but what, exactly, do you think that problem is?

But as to the specific issue of Google Reader, I'm pretty sure "shared" posts were previously shared with everyone—that is, not
private. If that's right, I draw two points from that. First, in Google's defense, if all Buzz does is make shared items even more
accessible, I'm not sure what the big deal is.

Second, if all my shared items are now going to be piped into Buzz automatically, why can't I exercise the same Public/Private
sharing option from inside Google Reader that I can from Buzz? I really love the granularity of privacy controls that I have in
Buzz, being able to share a Buzz with a specific list. It would be great to have that same control throughout the tools being
integrated into Buzz, like Reader.

Flag● LikeReply

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (7 of 10) [3/8/2010 9:02:42 AM]

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

Jim Harper 3 weeks ago in reply to Berin Szoka

"Meta" is one layer removed, Berin. Julian is pointing out that information policy experts don't understand the issues here. How
on earth can average consumers intelligently assess Buzz if we can't.

Google has sit-downs with people like us to talk through details of services we all have long experience with. But they dump
Buzz on us and the public without a tinker's dam of information about how it works, how it will integrate with existing services,
etc. This is a big #googlefail

(BTW, now that I've used the phrase "tinker's dam" in a sentence, I am officially a curmudgeon. By cracky!)

Flag● LikeReply

Julian Sanchez 3 weeks ago in reply to Berin Szoka

If you go to your Google Reader sharing settings, you'll see that you can set shared items to be "public" or "protected"—in the
latter case shared only with contacts. Her claim, as I understand it, is that she had quite deliberately set her shared items to
"protected," but that Buzz then made all her frequent contacts eligible to view her "protected" notes.

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Julian Sanchez

Right you are, Julian—about the public/private shared settings for Reader. If your suspicion is right, that she had set up shared
items to "protected" and Buzz shared them with her auto-followed contacts, I'd certainly agree that that's a significant potential
privacy problem and Google should fix it.

But to be clear, the other problem here is that Google Reader doesn't give users the same granularity of control that Buzz
does. Reader lets you restrict your shared items to only certain lists, but it's a one-size-fits-all setting: You decide which lists
you want to share all your shared items with. By contrast, Buzz (like Facebook's new publishing controls) lets you decide, for
each new Buzz, which lists you want to share your Buzz with. So, if anything, Reader lacks a privacy by design feature that's
been added with Buzz, and we should be giving Google just a little bit of credit and asking why they didn't go further with that.

I really don't see what Google gains by not adding this privacy control functionality to Reader, so I can only assume this just
slipped through the cracks. If so, that mistake has certainly cost Google dearly in terms of reputational capital. I'd like to think
they'll fix it quickly and be more careful in the future, but I suppose only time will tell.

Flag● LikeReply

Julian Sanchez 3 weeks ago in reply to Berin Szoka

I think that's basically right, I'd just add that this only really works properly if they do bear pretty serious and immediate
reputational costs when they screw it up. Even if nothing else happens, the angry blogger we've been discussing is probably
going to spend the next week fearing for her physical safety—and you can multiply that by who knows how many others. But
that harm is unlikely to ever get litigated, and information once released can't be stuffed back in the bottle. So I think you're
unlikely to get the incentives right if privacy-destructive errors aren't generally punished by a public reaction that might seem
disproportionate. (For the same reason that the penalty for theft is typically much higher than the value of what was stolen in
the particular instance.)

Flag● LikeReply

Tim Lee 3 weeks ago in reply to Adam Thierer

But it begs the question: How much notice is enough?

That's an excellent question. I don't have a precise answer. Which is precisely why this kind of criticism and debate is
necessary to figure out the answer. Calling people who think Google crossed the line "paternalistic" doesn't help us understand
where the line is.

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Tim Lee

Fair enough, Tim. If I had taken your approach to titles, I might have called this thread something like "More on Buzz" instead of
trying to make a fairly nuanced point without the characters necessary to do so. My point being: my title may be a bit unfair by
implying an equation of criticism with paternalism. I hope you'll see from my four-part breakdown that I didn't intend that.

That said, I do think "nightmare" is too strong to apply to PEBCAK situations ("Problem Exists Between Chair and Keyboard")
like this one. That is, perhaps Google could have done more here to avoid the possibility for user error, but does that really
make this a nightmare? How much more does Google have to do to protect users from their own carelessness? Somewhere
along the spectrum of responses to that answer, we enter the land of paternalism—even if the government isn't yet involved.
And of course, the thing that makes these debates so difficult is that the government almost inevitably will become involved.

Flag● LikeReply

Tim Lee 3 weeks ago in reply to Berin Szoka

Berin, shooting yourself in the foot hurts, and this fact is unaffected by the fact that you can opt out of shooting yourself in the
foot. Likewise, the fact that people don't have to sign up for Buzz doens't prove that Buzz isn't a privacy nightmare.

Flag● LikeReply

Jim Harper 3 weeks ago in reply to Adam Thierer

Adam, you're putting strategy ahead of sensibility: "Don't say anything that could support an argument for regulation."

Like Ryan, I don't think people who favor market regulation should hold their tongues about products and practices they don't
like. In fact, doing so makes it appear to audiences we're trying to convince that we're just blind supporters of businesses,
however rapacious they may be.
I don't think Tim should even have to couch it as carefully as he does. I'll say it since he won't: Some people are too stupid to
know what's good for them. It doesn't follow that regulators should look after them. Rather, market criticism of goods and
services guides the design of products to the better for the ignorant as much as for the intellectual and the activist.

And the question here is not whether anyone is forced to use anything. It's whether a company can change the information
terms of a product people have chosen to use based on the preexisting terms. I don't think so. I think this is an F-up, and I'm all
for calling it out.

Flag● LikeReply

Berin Szoka 3 weeks ago in reply to Jim Harper

I agree with you, Jim, that our defense of "market regulation" will be made stronger for not holding our tongues when criticism is
factually accurate well-deserved. It's a very difficult thing, though, to do that without lending support to the feeding frenzy that
so often explodes upon the release of a new product. And as I emphasized when Facebook launched its new privacy system,

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (8 of 10) [3/8/2010 9:02:42 AM]

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

"If you jump on companies every time they announce a new privacy-by-design feature, you leave them like deer in the
headlights, they'll be terrified to move forward with anything."

Again, my point is not that we should take option #1 of the four options I laid out above (apologizing for everything Google
might do) but that we should be careful about heading too far down the path of #3 (suggesting restrictive defaults) because
even if the government doesn't get involved in mandating those (which often happens very subtly and rarely overtly), much of
the argument for such defaults rests on the idea that users just can't be trusted.

That said, I do take the point raised above about mental accounting costs to heart. There is a roll for user interface designers to
play in being, yes, a bit "paternalistic" in a purely non-coercive sense. But there's a fine line in practice between simply trying to
ensure users don't accidentally make choices they didn't mean to make and assuming that users will screw up and make
choices that are truly harmful, and therefore designing everything around the worst case scenario, unlikely as that might be.

Flag● LikeReply

Julian Sanchez 3 weeks ago in reply to Adam Thierer

You appear to be starting from the self-evident repugnance of (3) and then trying to make this a reason to reject supporting
premises (1) — so obviously true at this point that I think it's really beyond serious debate — and (2), which is at least damn
plausible. My friends are pretty tech savvy, and I'm seeing a lot of confusion about what Buzz is sharing with whom by default.
The woman who's afraid her abusive ex-husband may have learned the identity of her current boyfriend or her place of
employment does not strike me as stupid or irresponsible: In the comments to her post, she talks about measures she took to
protect her online privacy, and indeed, says she deliberately refrained from setting up Buzz because of privacy concerns, only
to realize sharing of at least some information to frequent contacts had somehow been enabled anyway. If that's right, it looks
like Google that's being irresponsible.

Flag● LikeReply

Ryan Calo 3 weeks ago

Berin,

The fixes Google rolled out in response to consumer "feedback" on Buzz mitigated many of the initial problems. Now users are
prompted to create a Google Profile, told that followers will be public by default, and afforded the opportunity to opt out before
any of their contacts are revealed. I wish this were the case from the start but I respect the immediate action.

I still haven't gotten any clarity, however, on what happens if you already had a Google Profile (as I did). In that case, it would
seem that suddenly anyone who searches for you and finds your Profile will see the people with whom you chat and email the
most. Meanwhile, you have not done anything---not logged in to Gmail, not visited Buzz, or anything else. That's not just asking
for intelligence; it's asking for hyper-vigilance.

Ryan

Flag● LikeReply

Allen 3 weeks ago

Google's New Buzz is a privacy nightmare...

Basically any one you connect with via Buzz gets a full list and access to everyone you ever email or connect with using any of
Google services, Facebook or Twitter if you have a public Google profile!!!

Did you know any picture you upload creates and automatic Picasa account in your name and also a web album???? Your real
name is made available even in your account uses an alias or a business identity
Did you know that if you use buzz on your mobile device any other users nearby will be able to see your location... (oh great!!!
perfect for women users having issues with stalkers!!!! Everyone in the area can be informed in real time exactly where you
are... and get a google map and directions included!!!)
Google Buzz also makes available all your Facebook interactions and friends and all your tweets and followers on Twitter! All of
this is set up as soon as you click on the Buzz icon... without giving you the option of configuring initially...

You can be putting yourself and your family and your job at risk... Don't just open a Buzz account without knowing that it opens
access to and makes visible everything you email, post or Tweet along with that of everyone you connect with online!

Seriously..... Don't use Buzz until Google gets a clue about online safety and privacy!

Please Read this article before you use it...

http://news.cnet.com/8301-31322_3-10451428-256....

and this one:

http://www.businessinsider.com/warning-google-b...
and also read the fine print of Google's admitted Buzz privacy policy or rather "lack of privacy" policy.
http://www.google.com/buzz/help/privacy.html
Google Privacy Policy.
In addition, if you upload a photo via the Buzz interface or choose to email images to

Flag● LikeReply

Jamie Clark 3 weeks ago

This is a great thread .. about fundamental issues of contract law. Should a luser who voluntarily gives private stuff to a free
service provider (doh!) have any right to expectations? Should any contract-y text from a service provider, visible to a user
somewhere in itty-bitty text under six clicks, form a contract with them? Are there privacy rights you can't agree to give up, even
if you manage to scrawl an ape-like X signature on the ToS that waives them?
About half the issues here are about user trust, not law; the market will work those out.
The other half of the issues already are sorted out by existing law -- all demagoguery aside -- and eventually, we will see THAT
spelled out, in lawsuits, this time or next time.
However: not everything that makes people mad is illegal.

Flag● LikeReply

Lucy C 3 weeks ago

Dear Little Tech Boys: Many of you are not getting it. It seems that women are having a much easier time understanding the
privacy issue. So let's try it this way: You are conducting relationships with three different girls. (in your dreams, but let's
pretend). You email all of them on a regular basis. They are --by Google's standards-- at the top of your contact list. Each of the
three thinks you are seeing her exclusively. Now one day --without your ASKING for this, or knowing that it was going to
happen, Google decides that you want the names of your top "contacts" to be public --and known to each other. So HOW is
this an invasion of your privacy? All three already know your email address...but you certainly didn't plan to be in a "social
network" that included all three at the same time...or for them to know about or be able to communicate with each other. As for
the other results....I leave them to your imagination....

Flag● LikeReply

Jim Harper 2 weeks ago in reply to Lucy C

Thanks, Lucy, for demonstrating so well how not to persuade others. Insulting your audience is the thing that most opens minds
and ears! (I'm being facetious in case you didn't notice.)

Some got it, and we spoke up loudly and clearly to others who may not have.

Flag● LikeReply

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (9 of 10) [3/8/2010 9:02:42 AM]

Google Buzz is No “Privacy Nightmare” (Unless You’re a Privacy Paternalist)

Adult Dress Up 3 weeks ago

The main beef in the blogosphere seems to be that the implications of having a public Google profile with a public follow list
aren't clear when initially setting up Buzz.

Flag● LikeReply

GaryM 2 weeks ago

Gee, I always thought I was a libertarian, and now I find I'm a "privacy paternalist." If I had a Google profile, Google would be
making the list of the people I most often email public, even if I don't do anything. This strikes me as a clear and grievous
violation of their privacy policy, i.e., a breach of contract. But you're saying that because Google provides a "don't remind me
this is happening" button mislabelled as "turn off Buzz," and because there are hidden instructions on how to remove the
information they've made public after the fact, I'm an Obamaoid statist.

I was unaware that libertarianism implies the right to deceive and to ignore previous agreements.

Flag● LikeReply

Jim Harper 2 weeks ago in reply to GaryM

Gary, please note the extensive pushback Berin got in the comments from his co-bloggers - including specific discussion of the
contractual violation in making usere of Gmail users of Buzz. Your indignation is a little overdone.

Flag● LikeReply

Adult Dating 2 weeks ago

Google may not have gotten this exactly right and there's room for improvement here, but the answer lies in building in some
better notices to users to make sure they know what's happening here. Google's alrady done some of that but there room for
them to do more.

Flag● LikeReply

Adult Dating 2 weeks ago

Google may not have gotten this exactly right and there's room for improvement here, but the answer lies in building in some
better notices to users to make sure they know what's happening here. Google's alrady done some of that but there room for
them to do more.

Flag● LikeReply

UK Swingers 2 weeks ago

The problem, however, is that the well, people are just too stupid or lazy to know what's good for them

Flag● LikeReply

Sexy British Babes 1 week ago

One thing I am worried about is people that use Gmail for Business. Or for example checking Gmail from School or Work
Network. Will IT personnel start blocking Gmail due to Buzz, because it became social networking tool overnight?

Flag LikeReply

Add New Comment

You are commenting as a Guest. Optional: Login below.

Name Website (optional)

Email ✔ Subscribe to all comments by email

Post as Guest

Previous post: Net Neutrality Means No More iPhones

Next post: Act Now! Support a Bold National Elevator Plan

Some icons licensed under Creative Commons licenses from Henk ter Heide, derrickkwa, and Peter Marquardt.

Podcast Powered by podPress (v8.8)

http://techliberation.com/2010/02/11/google-buzz-is-no-privacy-nightmare-unless-youre-a-privacy-paternalist/ (10 of 10) [3/8/2010 9:02:42 AM]