Before Google’s disastrous social network Google+ came the less remembered Google Buzz. Launched in 2010, Buzz survived less than two years. But its mishandling of people’s personal data motivated the first in a series of legal settlements that, though imperfect, are to this day the closest the US has come to establishing extensive rules for protecting privacy online.
When users set up a Buzz account, Google automatically created a friend network made up of people they email, horrifying some people by exposing private email addresses and secret relationships. Washington regulators felt compelled to act, but Google had not broken any national privacy law—the US didn’t have one.
The Federal Trade Commission improvised. In 2011 Google reached a 20-year legal settlement dubbed a consent decree with the agency for allegedly misleading users with its policies and settings. The decree created a sweeping privacy standard for just one tech company, requiring Google through 2031 to maintain a “comprehensive privacy program” and allow external assessments of its practices. The next year, the FTC signed Facebook onto a near-identical consent decree, settling allegations that the company now known as Meta had broken its own privacy promises to users.
WIRED interviews with 20 current and former employees of Meta and Google who worked on privacy initiatives show that internal reviews forced by consent decrees have sometimes blocked unnecessary harvesting and access of users’ data. But current and former privacy workers, from low-level staff to top executives, increasingly view the agreements as outdated and inadequate. Their hope is that US lawmakers engineer a solution that helps authorities keep pace with advances in technology and constrain the behavior of far more companies.
Congress does not look likely to act soon, leaving the privacy of hundreds of millions of people who entrust personal data to Google and Meta backstopped by the two consent decrees, static barriers of last resort serving into an ever-dynamic era of big tech dominance they were never designed to contain. The FTC is undertaking an ambitious effort to modernize its deal with Meta, but appeals by the company could drag the process out for years and kill the prospect of future decrees.
While Meta, Google, and a handful of other companies subject to consent decrees are bound by at least some rules, the majority of tech companies remain unfettered by any substantial federal rules to protect the data of all their users, including some serving more than a billion people globally, such as TikTok and Apple. Amazon entered its first agreement this year, and it covers just its Alexa virtual assistant after allegations that the service infringed on children’s privacy.
Read the full article here
