Privacy Group Sues to Stop Google’s New Privacy Plan

EPIC charges new policy violates FTC settlement

Google just can't catch a break with its new privacy policy. The Electronic Privacy Information Center, a relentless critic of Google, filed Wednesday with the U.S. District Court for the District of Columbia to compel the Federal Trade Commission to stop Google from implementing its new privacy policy, set to go into effect March 1.

EPIC is asking the court to issue a temporary restraining order and preliminary injunction requiring the Federal Trade Commission to enforce its October 2011 consent order with Google over Google Buzz social network.

"The FTC has a nondiscretionary obligation to enforce a final order. But the agency has thus far failed to take any action regarding this matter, placing the privacy interests of literally hundreds of millions Internet users at grave risk," EPIC said in its court filing. EPIC filed the original complaint with the FTC that led to the settlement. 

In the complaint, EPIC argues that the changes Google is making to its privacy policy, such as sharing data about its users across its platforms and services, violate the terms of its FTC settlement requiring the company to maintain a comprehensive privacy program, not misrepresent privacy practices and use opt-in consent if there is a change in how Google shares personal information with third parties.

"Google violated Part I(a) of the Consent Order by misrepresenting the extent to which it maintains and protects the privacy and confidentiality of covered information. Google also violated Part I(b) of the Consent Order by misrepresenting the extent to which it complies with the U.S.-E.U. Safe Harbor Framework. Google violated Part II of the Consent Order by failing to obtain affirmative consent from users prior to sharing their information with third parties. Google violated Part III of the Consent Order by failing to comply with the requirements of a comprehensive privacy program," EPIC said in its filing.

In an emailed statement, a Google spokesman said the company takes privacy very seriously. "We're happy to engage in constructive conversations about our update privacy policy, but EPIC is wrong on the facts and the law," he said. "We're keeping private information private; we're not changing how any personal information is shared outside Google. We've created a world class privacy compliance program, as we're confident our third-party assessments will demonstrate."

Although the case will likely stir more debate over Google's privacy policy, some privacy attorneys doubt EPIC's legal action against Google will amount to much. "Google's policies should be vetted, but this particular legal action isn't very likely to succeed," said Amy Mushahwar, a data and privacy attorney with Reed Smith. "There's isn't a clear compelling case that a specific individual or groups of individuals will suffer irreparable harm. Customers can walk with their feet."

Since Google announced the new privacy policy Jan. 25, it has been defending it, to privacy hawks in Congress and to the E.U., which has asked Google to delay the launch of the new policy until it understands it better. 


With little time before Google pulls the switch on its new privacy policy, a federal district court judge ordered an accelerated briefing schedule. The FTC must respond to EPIC's briefs by Feb. 17. EPIC's reply is due Feb. 21. 

"The FTC takes compliance with our consent orders very seriously and always looks carefully at any evidence that they are being violated," the agency said in a statement.