Inside Google

Memo from Washington to Web companies: Take note of the Google Buzz settlement

Sure, the consent decree proposed Wednesday by the Federal Trade Commission drops the hammer squarely on Google — subjecting the search giant’s entire online empire to periodic privacy checkups for two decades.

But that doesn’t mean the echoes of the FTC’s actions aren’t already reverberating far and wide across the vast Web industry, where industry leaders and consumer groups see the settlement as an important, telling political marker.

“This order technically applies only to Google. However, we think many of the provisions in this order are good business practices we’d expect to see widely followed across the industry,” said Jessica Rich, deputy director of the FTC’s Bureau of Consumer Protection, on a call with reporters Wednesday.

Rich declined to add whether other investigations are in the agency’s sights.

On the surface, the FTC’s proposed settlement with Google addresses a privacy flap stemming back to February 2010, when Google automatically opted users into its Buzz system and adapted their email address books into friend lists.

But top privacy-thought leaders say the resulting consent decree has far greater resonance — beyond the Mountain View, Calif.-based giant’s mistake — at a time when the entire Web industry’s practices are the subject of numerous federal reviews and congressional inquiries.

“The level of obligations arising from this consent agreement is not insignificant,” said J. Trevor Hughes, president and CEO of the International Association of Privacy Professionals. “There are enormous auditing and reporting requirements that come out of this. It is worthy of any business’s time to be looking at this agreement and assessing their own practices against it.”

For Google, the settlement means it must submit to periodic privacy reviews by an independent auditor, impose a robust, comprehensive privacy framework and begin obtaining users’ permission before it incorporates their personal information into new features. That plan is slated for final FTC approval in May.

Some stakeholders told POLITICO the settlement shows the hard line the FTC intends to take to protect consumer privacy online — even if Congress does not pass a new privacy law in short order.

“My assessment of this is that the FTC is struggling mightily to do as much as it can, given the legal structure it’s got,” said John Simpson of Consumer Watchdog, which has urged the federal government to investigate Google in a number of areas.

Simpson added the entire flap ultimately reflects the urgency with which Congress should pass a new law, preferably one that would allow consumers to opt-out of advertisements targeted to their browsing behavior, called “Do Not Track.”

Leading privacy proponents, meanwhile, told POLITICO the settlement also offers a hint of policy guidance — an early topography of how the FTC might approach many of the principles included as part of its 2010 draft privacy framework.

“What is remarkable and perhaps quite useful about the [settlement] is the focus it placed on the design and usability of the Buzz setup process,” said Jules Polonetsky, director and co-chairman of the Future of Privacy Forum.

He added that the emphasis plays directly into the FTC’s calls for “privacy by design,” offering insight as to one way the agency might seek to enforce its strongly held policy principle.

However, it’s far less clear whether this week’s political shockwaves can further budge action on Capitol Hill, where a flurry of activity on legislative fixes continues this week but no consensus has become clear.

Much of that work is taking place in the office of Sen. John Kerry (D-Mass.), who issued a statement Wednesday praising the Buzz settlement, yet adding, “Everyone will be better off with clear rules of the road rooted in a specific law.”

Kerry is prepping his proposal with the help of Sen. John McCain (R-Ariz.), though it is unclear when the duo intends to unveil their legislation formally.

Efforts in the House continue piecemeal — led, so far, by Rep. Cliff Stearns (R-Fla.), the chairman of the Energy and Commerce Committee’s top oversight panel. But online privacy is mostly the domain of Texas Republican Rep. Mary Bono Mack’s consumer protection subcommittee, and the chairwoman has previously said she needed to explore the issue further in hearings before staking territory on specific privacy proposals.

Still, Stearns told POLITICO in a statement Wednesday that the FTC action “highlights the fact that consumers are not often given enough control over their own privacy.”

The congressman stressed that transparency, notice and disclosure are needed on the Web, adding: “We must find a balance between privacy protection and innovation and my draft attempts to do just that.”

On one hand, the Google Buzz settlement could jump-start these activities, Hughes said, demonstrating privacy violations are “common even among the largest, most visible” companies.

Yet, by that same logic, the settlement could slow down legislation, he added. That is especially true if opponents make the case to Congress that the FTC already has the power to punish Web companies that wrong their customers.

“Both arguments will likely be made by this [settlement],” he said.