Roger Clarke's Web-Site

© Xamax Consultancy Pty Ltd,  1995-2024
Photo of Roger Clarke

Roger Clarke's 'Evaluation Against Template'

Evaluation of Google's Privacy Statement against the Privacy Statement Template of 19 December 2005

Roger Clarke **

20 December 2005

© Xamax Consultancy Pty Ltd, 2005

Available under an AEShareNet Free
for Education licence or a Creative Commons 'Some
Rights Reserved' licence.

This document is at


This document compares Google's Privacy Statement of 14 October 2005 (which is current as at 20 December 2005), and is mirrored here, against the Privacy Statement Template that I published on 19 December 2005.

No attempt was made to examine or compare the other privacy statements that Google indicates exist in relation to some others of its services. No audit was undertaken, and no discussion was attempted with Google staff. The comments focus on the primary areas of shortfall, and avoid quibbles over differences in wording.


Data Collection

Google declares that it sets one ore more cookies, and that this "uniquely identifies your browser". For many users, that it very close to uniquely identifying the individual. They are long-term (2038) cookies, not session-cookies. If cookies are blocked, "some Google features and services may not function properly". They appear not to be compliant with RFC2964. The content of cookies sent back to the Google server appears to be logged.

A range of Google services require registration, including the provision of "personal information (such as your name, email address and an account password)", and in some cases also "credit card or other payment information". Hence a great many people are enabling Google to consolidate a very substantial amount of identified personal data, including disclosure of their behaviour when using the search-engine, and hence their interests.

No information is provided about any collection of personal data from other sources.

The purposes declared by Google for the personal data that are collected are sufficiently vague and extensive that it appears unlikely that any use is excluded.

Data Security

Google processes personal information ... in the U.S.A. and "in other countries", including "outside your own country". The U.S.A. has inadequate data protection, and some of the unspecified other countries very probably do as well.

Data Use

Google uses the data that it consolidates about an individual to enable "display of customized content and advertising".

It does not appear that Google will even attempt to communicate to individuals when uses required or authorised by law occur.

No assurance whatsoever is provided regarding relevance of data to the particular use to which it is being put.

No assurance whatsoever is provided regarding the quality of data for the particular use to which it is being put.

Data Disclosure

Google appears to have its own meaning of the word 'consent'. It states that "Google only shares personal information with other companies or individuals outside of Google [omitting government agencies and associations] [if] we have your consent". But it then continues "We require opt-in consent for the sharing of any sensitive personal information" (my emphasis). But 'consent' and 'opt-in' are the same thing. It therefore appears that Google is using the word 'consent' to refer to non-consent, i.e. failure to opt-out. That is a gross corruption of both language and the elements of privacy protection.

Personal data may be passed between Google and its Affiliates, and none take any responsibility for use of that data by the others.

It does not appear that Google will even attempt to communicate to individuals when disclosures required or authorised by law occur.

No assurance is provided that only such data is disclosed as is necessary in the particular circumstances.

Data Retention and Destruction

No assurance is provided that data will ever be destroyed, even when its purpose has expired.

No assurance is provided that logs, backups and audit trails are deleted in accordance with short-term retention cycles.

Access by You to Your Personal Data

Compliance with a request for deletion is subject to heavy qualification: "[we will] delete [inaccurate personal] data at your request if it is not otherwise required to be retained by law or for legitimate business purposes".

Information about Data-Handling Practices

Information about the manner in which personal data is handled is provided in very general terms. But no assurance is given that more specific information will be provided on request, and I understand that Google has declined to answer specific requests.

No assurance is provided that information will be made available about the manner in which Google's contractors handle personal data.

Handling of Enquiries, General Concerns and Complaints

A complaints web-form is provided, and a snail-mail address. No assurance is provided about the provision of prompt acknowledgements, a copy of the complaint, and a reference-code; but the description of the complaints-handling procedure is otherwise positively expressed and generally conformant with good practice.


It is not clear whether and how Google's undertakings could be enforced.

The only reference provided to the law or a regulator is to the U.S. Department of Commerce's 'safe harbor' program. But this is an extremely watered-down version of genuine privacy protections. Moreover, U.S. federal agencies have been highly unhelpful to consumers.

It is unlikely that a consumer, or even a group of consumers, especially consumers outside the U.S.A., could enforce Google's undertakings, or cause them to be enforced.

Changes to These Privacy Undertakings

No assurance is provided that the company will consult with appropriate representative and advocacy organisations, and it appears that its practice is not to do so.

In the event of merger, acquisition or sale of assets, the only undertaking given is to "provide notice before personal information is transferred and becomes subject to a different privacy policy". Such undertakings as are provided can therefore be laundered even through merger. This is an especially serious problem in view of the inadequacies of Google's policies re collection, retention and destruction, and enforcement.


The notion of consent appears to be completely understood, or misrepresented.

Author Affiliations

Roger Clarke is Principal of Xamax Consultancy Pty Ltd, Canberra. He is also a Visiting Professor in the Cyberspace Law & Policy Centre at the University of N.S.W., a Visiting Professor in the E-Commerce Programme at the University of Hong Kong, and a Visiting Professor in the Department of Computer Science at the Australian National University.

xamaxsmall.gif missing
The content and infrastructure for these community service pages are provided by Roger Clarke through his consultancy company, Xamax.

From the site's beginnings in August 1994 until February 2009, the infrastructure was provided by the Australian National University. During that time, the site accumulated close to 30 million hits. It passed 65 million in early 2021.

Sponsored by the Gallery, Bunhybee Grasslands, the extended Clarke Family, Knights of the Spatchcock and their drummer
Xamax Consultancy Pty Ltd
ACN: 002 360 456
78 Sidaway St, Chapman ACT 2611 AUSTRALIA
Tel: +61 2 6288 6916

Created: 20 December 2005 - Last Amended: 20 December 2005 by Roger Clarke - Site Last Verified: 15 February 2009
This document is at
Mail to Webmaster   -    © Xamax Consultancy Pty Ltd, 1995-2022   -    Privacy Policy