3 ms·

That's really just begging the question again, though. It's also not correct, as their privacy policy doesn't state that they always collect a cookie per log e

That's really just begging the question again, though. It's also not correct, as their privacy policy doesn't state that they always collect a cookie per log entry, for instance, but that they may. This is an important distinction, because in practice, at least things like doubleclick and analytics requests do not transmit your google account cookie. In a quick test, google fonts and google hosted libraries don't appear to send any cookies at all, though I don't know if that's true under all circumstances. There's much you could reconstruct from IP addresses and connection patterns if you were sufficiently motivated, but that's a long way from extrapolating from their privacy policy. Regardless, assuming "they can, therefore they will" isn't nearly sufficient here.

jacquesm 12y ago
At absolutely zero cost to themselves and good PR as a benefit google could re-write their privacy policy if that were the case. Note that they still have not amended their privacy policy to the effect that they indeed anonymize the log files after 9 months, even though they announced that they would do that years ago. So no, short of going to work for google or an insider coming up with hard proof there is not much to be done there. But with a privacy policy that details what they do log and a strong financial motive I have little doubt that this is an accurate representation of what's happening. If it isn't then google is free to contradict it.
- magicalist 12y ago
  > At absolutely zero cost to themselves and good PR as a benefit google could re-write their privacy policy if that were the case I just gave you clear examples where that wasn't the case, examples you can verify yourself by inspecting the requests. > Note that they still have not amended their privacy policy to the effect that they indeed anonymize the log files after 9 months, even though they announced that they would do that years ago. here: https://support.google.com/accounts/answer/162743 https://support.google.com/accounts/answer/162743 "We anonymize this log data by removing part of the IP address (after 9 months) and cookie information (after 18 months). If you have Web History enabled, this data may also be stored in your Google Account until you delete the record of your search." > But with a privacy policy that details what they do log... I don't understand why you're ignoring the very important distinction between of "do log" and logs "may include".
  - jacquesm 12y ago
    "may include" in a privacy police is newspeak for "we will". That 'may' is there so that if you read it you get a warm fuzzy feeling because no way would google ever do such a thing, and it allows them to point at it when they're caught doing it saying 'we told you we were doing this all along, see, we gave ourselves just enough leeway there to squeeze through'. Call me jaded, cynical, old for all I care but I have yet to see a big company that did not act in the way I just described when it came to covering their asses while pulling the wool over the eyes of their end users. > We anonymize this log data by removing part of the IP address (after 9 months) That's not exactly anonymization is it? You're making it worse. Anonymization is removing all user identifiable information. This is merely stripping some unspecified number of bits of the IP, which more than likely has changed by then so has lost most of its value, and retains the cookie which has more resolution than an IP to begin with. > and cookie information (after 18 months). What's the normal lifespan of a google cookie? More or less than on average 18 months.
  - chestnut-tree 12y ago
    "We anonymize this log data..." There's an interesting article from CNET (from 2008) on this topic: "Debunking Google's log anonymization propaganda" "Company says it will be reduce the amount of time that it will keep sensitive, identifying log data on its search engine customers. This is little more than snake oil." http://www.cnet.com/uk/news/debunking-googles-log-anonymization-propaganda/ http://www.cnet.com/uk/news/debunking-googles-log-anonymizat...

jacquesm 12y ago

At absolutely zero cost to themselves and good PR as a benefit google could re-write their privacy policy if that were the case. Note that they still have not amended their privacy policy to the effect that they indeed anonymize the log files after 9 months, even though they announced that they would do that years ago. So no, short of going to work for google or an insider coming up with hard proof there is not much to be done there. But with a privacy policy that details what they do log and a strong financial motive I have little doubt that this is an accurate representation of what's happening. If it isn't then google is free to contradict it.

magicalist 12y ago
> At absolutely zero cost to themselves and good PR as a benefit google could re-write their privacy policy if that were the case I just gave you clear examples where that wasn't the case, examples you can verify yourself by inspecting the requests. > Note that they still have not amended their privacy policy to the effect that they indeed anonymize the log files after 9 months, even though they announced that they would do that years ago. here: https://support.google.com/accounts/answer/162743 https://support.google.com/accounts/answer/162743 "We anonymize this log data by removing part of the IP address (after 9 months) and cookie information (after 18 months). If you have Web History enabled, this data may also be stored in your Google Account until you delete the record of your search." > But with a privacy policy that details what they do log... I don't understand why you're ignoring the very important distinction between of "do log" and logs "may include".
- jacquesm 12y ago
  "may include" in a privacy police is newspeak for "we will". That 'may' is there so that if you read it you get a warm fuzzy feeling because no way would google ever do such a thing, and it allows them to point at it when they're caught doing it saying 'we told you we were doing this all along, see, we gave ourselves just enough leeway there to squeeze through'. Call me jaded, cynical, old for all I care but I have yet to see a big company that did not act in the way I just described when it came to covering their asses while pulling the wool over the eyes of their end users. > We anonymize this log data by removing part of the IP address (after 9 months) That's not exactly anonymization is it? You're making it worse. Anonymization is removing all user identifiable information. This is merely stripping some unspecified number of bits of the IP, which more than likely has changed by then so has lost most of its value, and retains the cookie which has more resolution than an IP to begin with. > and cookie information (after 18 months). What's the normal lifespan of a google cookie? More or less than on average 18 months.
- chestnut-tree 12y ago
  "We anonymize this log data..." There's an interesting article from CNET (from 2008) on this topic: "Debunking Google's log anonymization propaganda" "Company says it will be reduce the amount of time that it will keep sensitive, identifying log data on its search engine customers. This is little more than snake oil." http://www.cnet.com/uk/news/debunking-googles-log-anonymization-propaganda/ http://www.cnet.com/uk/news/debunking-googles-log-anonymizat...