Google illegally divulges user searches, suit claims
HTTP referrer headers: SEO's best friend
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Attorneys on Monday accused Google of intentionally divulging millions of users' search queries to third parties in violation of federal law and its own terms of service.
The complaint, filed in federal court in San Jose, California, challenges Google's longstanding practice of including search terms in HTTP referrer headers, which are easily readable by websites that users click on. It claims Google has repeatedly experimented with systems that keep search terms private but has has never rolled them out because it has a vested interest in sharing the information with third parties, including search engine optimization services.
“Over protests from privacy advocates, however, Google has consistently and intentionally designed its services to ensure that user search queries, which often contain highly-sensitive and personally-identifiable information ('PII'), are routinely transferred to marketers, data brokers, and sold and resold to countless other third parties,” the complaint alleges.
The lawsuit goes on to say that Google can cross reference search terms with data held by DoubleClick, which in 2007, the search behemoth agreed to buy for $3.1bln in cash. Combined with a user's IP address and additional information from services including Google Analytics, third parties can connect “the dots of 'anonymous' data” to link queries to a specific individual, a phenomenon known as “reidentification,” the complaint states.
That's precisely what happened in 2006 when AOL released more than 20 million search queries that supposedly had been anonymized. The company soon discovered that many of the 658,000 AOL users in the dataset could be identified making highly personal searches. User data Netflix publicly released to help improve its movie rating system has faced similar problems.
Monday's lawsuit claims that on numerous occasions, Google has experimented with systems that don't share search queries with third-party websites. In November 2008, for instance, the company started testing a method for delivering results that used advanced AJAX technologies. The new system prevented browsers from passing along the search terms to websites, a change that outraged many web masters, who are always eager to know precisely how visitors find their sites.
Google quickly issued a public statement that said: “At this time only a small percentage of users will see this experiment. It is not our intention to disrupt referrer tracking, and we are continuing to iterate on this project and are actively working towards a solution.”
Google soon ended the test, and though similar experiments have since been launched on a limited basis, the complaint alleges.
The lawsuit alleges that the practice violates its own terms of service, which promise that personal information will be shared only with a user's consent. The complaint also claims it runs afoul of the federal Electronic Communications Privacy Act, and a variety of California state laws. The complaint (PDF), which was filed on behalf of a Google user named Paloma Gaos of San Francisco County, seeks class-action status so others can be represented as well.
A Google spokesman declined to comment because, he said, the company has not yet received a copy of the complaint. ®
COMMENTS
Freaking morons
If you don't like it, ask Microsoft, Apple or Mozilla for an easier way to turn it off. It's not Google's fault. There are only two ways they could avoid it. Use POST instead of GET, which would make it impossible to bookmark a search result page, or do some kind of funky redirect.
The latter might be workable, but it would add unnecessary complexity and compatibility problems to what should be the simplest thing on the web, a link. In my experience, this technique is only used by particularly secretive web sites (pirates, hackers, perverts, etc). It's not a something I would expect to find on mainstream search engine.
Perhaps if Google added it as an optional feature some people would be interested, but to suggest they are negligent for not providing this is just plain silly.
it is everyone's fault
the browser does indeed pass on the referrer URL in HTTP_REFERRER
this stops people doing things like leeching comics from the sunday paper pages
google/yahoo/bing/whoever does _not_need_to_ set their search result pages to include the search query ... but it does, which is the point, really - and if you can, do check what it really does pass as the referrer, and it's not the URL at the top of the page, it's a modified HTTP_REFERRER containing a suspiciously unchanging string of letters and numbers at the end per machine query sent from.
web developer toolbar on FF has the option to disable referrer, works too
people are generally surprised if not infuriated to learn what they enter into one place ends up in another without due warning - sharing with one entity does not automatically bring to mind sharing with the world - and suggesting that's just how it is/always was is pretty naive.
Oh really?
Last time I checked, the referrer was generated by the browser, not by the site that presented the link that I clicked on.
But never let the facts get in the way of a lawsuit.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
