While
the public has been focused on the ongoing Facebook
and Cambridge Analytica scandal, Google has largely avoided
public scrutiny about its data collection practices despite having
the ability to collect far more personal data about consumers
across a variety of touchpoints. There have been efforts to
document individual practices by Google such as their efforts to
circumvent controls on Safari. More recently, an
investigation by the Associated Press revealed
that Google continues to track location data even after a consumer
has turned off the setting. While these research efforts
have been important to the public policy dialogue, no research
exists which looks at the breadth and depth of data collected by
Google.
In
“Google
Data Collection,” Douglas C. Schmidt, Professor
of Computer Science at Vanderbilt University, catalogs how much
data Google is collecting about consumers and their most personal
habits across all of its products and how that data is being tied
together.
The
key findings include:
- A
dormant, stationary Android phone (with the Chrome browser
active in the background) communicated location information to
Google 340 times during a 24-hour period, or at an average of 14
data communications per hour. In fact, location information
constituted 35 percent of all the data samples sent to Google.
- For
comparison’s sake, a similar experiment found that on an iOS
device with Safari but not Chrome, Google could not collect any
appreciable data unless a user was interacting with the device.
Moreover, an idle Android phone running the Chrome browser sends
back to Google nearly fifty times as many data requests per hour
as an idle iOS phone running Safari.
- An
idle Android device communicates with Google nearly 10 times
more frequently as an Apple device communicates with Apple
servers. These results highlighted the fact that Android and
Chrome platforms are critical vehicles for Google’s data
collection. Again, these experiments were done on
stationary phones with no user interactions. If you actually use
your phone the information collection increases with Google.
- Google
has the ability to associate anonymous data collected through
passive means with the personal information of the user. Google
makes this association largely through advertising technologies,
many of which Google controls. Advertising identifiers—which are
purportedly “user anonymous” and collect activity data on apps
and third-party webpage visits—can get associated with a user’s
real Google identity through passing of device-level
identification information to Google servers by an Android
device.
- Likewise, the DoubleClick
cookie ID—which tracks a user’s activity on the third-party
webpages—is another purportedly “user anonymous” identifier that
Google can associate to a user’s Google account. It works when a
user accesses a Google application in the same browser in which
a third-party webpage was accessed previously.
- A
major part of Google’s data collection occurs while a user is
not directly engaged with any of its products. The magnitude of
such collection is significant, especially on Android mobile
devices, arguably the most popular personal accessory now
carried 24/7 by more than 2 billion people.
DCN
is grateful to support Professor Schmidt in distributing this
research. We offer it to the public with the permission of
Professor Schmidt.