Report: Google bypassed iPhone privacy settings to track web users

Tools

Google (NASDAQ:GOOG) and other digital advertisers employed special code to bypass user privacy settings across millions of Apple (NASDAQ:AAPL) iPhones and desktop computers running the Safari web browser, The Wall Street Journal reports.

According to the Journal, Google and ad firms Vibrant Media, PointRoll and WPP's Media Innovation Group leveraged code that essentially tricks Safari (the most widely used mobile browser) into letting them monitor user behaviors despite Safari default settings designed to block such tracking. Stanford University researcher Jonathan Mayer first identified the code, which was subsequently confirmed by technical advisor Ashkan Soltani--in tests, Soltani determined that ads on 22 of the top 100 websites installed the Google tracking code on the desktop, and ads on 23 sites installed it on the iPhone.

Google has since disabled the code. "The Journal mischaracterizes what happened and why," Google said in a statement. "We used known Safari functionality to provide features that signed-in Google users had enabled. It's important to stress that these advertising cookies do not collect personal information." Google adds that all cookies were built to expire within 12 to 24 hours.

Apple told the Journal it is "working to put a stop" to code that circumvents Safari privacy settings.

Google is no stranger to controversy over user privacy. Last month, the digital services giant announced plans to connect user data across desktop and mobile services including Google+, Gmail and YouTube. Google presently maintains more than 70 privacy documents covering its different products--on March 1, it plans to consolidate more than 60 documents into its main Privacy Policy. Separate policies will continue to govern products including the Chrome web browser and the Google Wallet m-commerce platform.

The new policy follows Google's recent settlement with the U.S. Federal Trade Commission that subjects the company to 20 years of privacy audits. Google also has come under heavy regulatory scrutiny in Europe. Google hopes "that by creating a one-stop shop for privacy policy it will deflect regulatory action," Center for Digital Democracy executive director Jeff Chester told the Associated Press.

But consumers who log into Google services won't be able to opt out of the revamped guidelines, which has critics crying foul. "Google's new privacy announcement is frustrating and a little frightening," Common Sense Media chief executive James Steyer told The Washington Post. "Even if the company believes that tracking users across all platforms improves their services, consumers should still have the option to opt out--especially the kids and teens who are avid users of YouTube, Gmail and Google Search."

Google later sent a letter to Congress to assuage lawmaker concerns, maintaining that it is revamping its privacy policies but not changing corresponding controls. "We'll continue to focus on providing transparency, control and security to our users," writes Google director of public policy Pablo Chavez in a Jan. 30 letter addressed to eight members of the U.S. House of Representatives. "In fact, the announcement of changes to our privacy policy is a great example of our effort to lead the industry in transparency. It's been the most extensive user notification effort in Google's history--including promotions on our homepage, email to our users, just-in-time notifications and more--to ensure that our users have more opportunities to learn about these changes."

Chavez explains that Google is striving to make its privacy policies simpler and more accessible to users, changes lawmakers and regulators have requested. "We're still keeping your private information private--we're not changing the visibility of any information you have stored with Google," Chavez writes on the Google Public Policy Blog. "We're still allowing you to do searches, watch videos on YouTube, get driving directions on Google Maps and perform other tasks without signing into a Google Account. We're still offering you choice and control through privacy tools like Google Dashboard and Ads Preferences Manager that help you understand and manage your data. We still won't sell your personal information to advertisers. We're still offering data liberation if you'd prefer to close your Google Account and take your data elsewhere."

Chavez also responded to the opt-out controversy. "We understand the question at the heart of this concern. We believe that the relevant issue is whether users have choices about how their data is collected and used. Google's privacy policy--like that of other companies--is a document that applies to all consumers using our products and services. However, we have built meaningful privacy controls into our products, and we are committed to continue offering those choices in the future."

For more:
- read this Wall Street Journal article

Related articles:
Google to Congress: We're changing privacy policies, not privacy controls
Google merging user data across products with privacy overhaul
Oracle: Google's Android activations worth $3.65B a year
Forecast: Google mobile ad revenues could top $4B in 2012
Google buys another 222 IBM patents to bolster Android defense