Re: Google Buys reCAPTCHA, Creating a Potential Privacy Issue

[David Farber <dave () farber net>]

Begin forwarded message:

From: Lauren Weinstein <lauren () vortex com>
Date: September 17, 2009 2:01:28 AM EDT
To: Declan McCullagh <declan () well com>
Cc: dave () farber net
Subject: Re: [IP] Google Buys reCAPTCHA, Creating a Potential Privacy  
Issue


Declan,

Hi.  My general view is that when products have the potential for
"data correlation" that isn't obvious to the user, it's especially
important that it's clear how the data is being used.

In the reCAPTCHA case, for example, it might not even be obvious
to users that Google potentially was getting the data, unless some
sort of link to a clear expression of policy is present -- something
which, as I noted, CMU failed to do earlier this year.

At this stage, I have no clue if Google is planning to leave reCAPTCHA
branded as is, leave it as is but include a link explaining how Google
will use the data, rebrand it as Google or ...?

For that matter, I don't even know if and how Google intends to
combine and correlate any IP (e.g. location-centric) data -- that would
be collected through reCAPTCHA displays -- with other Google data.

So all I'm really saying in that piece is that (in my opinion) CMU
handled this aspect of reCAPTCHA suboptimally in the past, and I think
it's important that Google do a better job than CMU in making it clear
what their plans for reCAPTCHA data will be -- even if that only means
some clear indication on the reCAPTCHA forms that Google is involved,
so people will know that Google privacy policies will apply.

--Lauren--
Lauren Weinstein
lauren () vortex com
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
  - People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
  - Network Neutrality Squad - http://www.nnsquad.org
Founder, GCTIP - Global Coalition
  for Transparent Internet Performance - http://www.gctip.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Twitter: https://twitter.com/laurenweinstein

- - -

On 09/16 22:28, Declan McCullagh wrote:
> Lauren Weinstein wrote:
> > > With reCAPTCHA moving under the Google umbrella, it will be crucial
> > > that Google clearly explain, in a visible and specific privacy  
> > > policy,
> > > how they will collect, correlate, and otherwise use IP address and
> > > other data associated with reCAPTCHA display and use.
>
> Lauren,
>
> You raise an interesting point in a thoughtful manner.
>
> But spending a few seconds at google.com/privacy might have assuaged
> your concerns. :) The privacy policy there applies to "all of Google's
> products and services" and "explains how we treat personal  
> information."
>
> It includes this statement: "We require opt-in consent for the sharing
> of any sensitive personal information."
>
> So while Google may come up with something more specific for  
> reCAPTCHA,
> I think it's fair to say that the overarching privacy policy covering
> "all of Google's products and services" would apply, and that it may
> even be sufficient.
>
> -Declan
>
> (Disclaimer: My wife works for Google in Mountain View. But she was  
> not
> involved in the reCAPTCHA acquisition, as far as I know, and I have  
> not
> discussed this with her.)




-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com