How much do the Internet giants really know about you?
To briefly state the obvious, the internet giants are seriously big: Google is not only the world’s largest search engine, it’s one of the top three email providers, a social network, and owner of the Blogger platform and the world’s largest video site, YouTube. Facebook has the social contacts, messages, wallposts and photos of more than 750 million people.
Given that such information could be used to sell us stuff, accessed by government or law enforcement bodies (perhaps without warrants, under legal changes), or – theoretically, at least – picked up by hackers or others, it’s not unreasonable to wonder exactly how much the internet giants know about us.
US users of the sites are out of luck: there’s no legal right under US law to ask a company to hand over all the information it holds on you. Users do have some say in how much companies are allowed to take, usually contained in the terms of service. But EU citizens are in a better position – under Europe-wide data protection rules, anyone can send a written request for their full data and, for a small fee, the company has to ship it out, usually within 40 days.
It’s a great chance to see exactly how much Google and Facebook really know about us, and all we need is a test subject. Perhaps an EU citizen who’s been on Facebook since it came to the UK in 2005; who’s had a YouTube account almost as long; and was on Gmail back when invitations to the service were something to beg, borrow and steal, rather than a nuisance. They’d also have to be enough of an idiot to write about what they dig up in public. This left one obvious, unlucky test case in the Guardian offices: me.
While we can find Google Inc’s address, that doesn’t necessarily help: a spokeswoman for the UK regulator, the ICO, confirmed that EU laws on subject access requests do not extend to the US parent company. This means there’s no real chance of getting hold of user data from Google through this route.
Thankfully, Google isn’t totally unhelpful. It has two tools that help show the information it holds on you, which a helpful staffer walked me through. The first, Google Dashboard, has run for about three years and gathers information from almost all of Google’s services in one place. Another feature, the “account activity report”, has launched recently, and shows Google’s information on my logins in the past month, including countries, browsers, platforms and how much I’ve used the services.
Running these tools on my work email account (the Guardian’s emails are managed by Google) is disconcerting, but not too much so. The dashboard can see I’m a member of a few internal Google groups, and have a blogger account used to collaborate with some researchers on Twitter riot data.
Data showing my work gmail account has 877 contacts – and listing them – gives me some pause for thought, as does a list of the 398 Google docs I’ve opened. The site also lists my most recent sent and received emails (in both cases a “no subject” conversation thread with a colleague).
A little more disconcerting is a chat history logging 500 conversations with 177 colleagues. Google chat is a handy way to collaborate in a large building, especially one full of journalists who seem to prefer to talk online (as Twitter activity testifies) rather than in the flesh. But there’s more than a little gossip going on too. I make a mental note to check how to delete those logs.
The big relief comes when I note Google isn’t tracking the internet searches I’ve made on my work account, which for journalists the world over tends towards the incredibly odd.
Repeating this exercise for my personal Google account is less relaxing. There are several bits of extra info here. The most innocuous is a heavily neglected Google+ profile with a few hundred connections but almost no posts.
Slightly more embarrassing is a seemingly connected YouTube account, apparently set up at a time when I thought using character names from role-playing games was a good account-naming policy. It has only one surviving video – a student interview with Heather Brooke – but does link to my viewing history, which includes the Tottenham riots, Dire Straits, Pomplamoose and, bafflingly, a Q&A from the Ryan commission into child abuse in Ireland.
Worst of all is a lengthy list of my search results. Looking through anyone’s list of searches gives a distressing degree of insight into odder parts of their personality. Google helpfully lists my most recent searches across its different services on one page. For web search: “paul daniels wiki”. For images: “harry styles” (explainer: I was trying to see who he was, after my 15-year-old niece mentioned him).
News was “youtube user figures”, showing I am meticulous in my research, while even my maps search history is present – last result “Portland House, SW1”. Mortifyingly, my last blogs search was a vanity one: “james ball”. Google also holds information on my login IPs, and other anonymised non-logged-in data, but doesn’t (yet) make this available.
There was some relief from the gloom though. Google insists the tracking for its display adverts – it is the market leader in online advertising – doesn’t draw from user data, but comes instead from cookies, files that anonymously monitor the sites you visit. Google’s ad preference page believes I am interested in online video, TV reality shows, printers, Egypt, politics and England. From this, it has concluded I am likely to be over 65 and male. I find myself more reassured than offended that Google has got this more or less wrong.
Facebook is a much trickier prospect. Unlike Google, Facebook actually processes some data in the EU, through its Irish branch, making it subject to access laws. These are currently taking a long time – apparently up to three months – due to a large volume of requests from campaigners, so I once again resorted to the site’s own tools.
Facebook’s main download tool was familiar, if slightly embarrassing. A downloaded archive that opens into something looking oddly like a stripped-down, uncluttered Facebook, this lists all my friends, every post ever made on my wall, by myself or others (some dating back almost seven years are not comfortable viewing), my private messages and the small number (fewer than 10) of photos I’ve uploaded to the site myself.
The Facebook extended archive is a little creepier, including “poke info”, each instance of tracking cookies they possess, previous names, and full login and logout info. Every event to which I’ve ever been invited is neatly listed, alongside its location, time, and whether I said I would attend .
One piece of information – a supposed engagement to a schoolfriend, Amy Holmes – stands out. A Facebook “joke” that seemed faintly funny for about a week several years ago was undone by hiding it from any and all Facebook users, friends or otherwise (to avoid an “… is now single!” status update). The forgotten relationship helpfully explains why Facebook has served me up with badly targeted bridalwear adverts for several years, and reassures me that Facebook doesn’t know quite everything.
Or does it? There are gaping holes in what Facebook has made available to me. No posts from other users in which I’m mentioned are included, not even from my friends. None of the 300+ photographs in which I feature, uploaded by friends and family, are there. On the upside, this means I escape yet another viewing of the naked baby photos my ruthless older sister decided to share with the world. On the downside, it reminds me that huge swaths of my information on these networks are outside my control.
Campaigners estimate that only around 29% of the information Facebook possesses on any given user is accessible through the site’s tools.
The tour through a decent swath of my personal data is at once disturbing and comforting. Disturbing because it reminds me mine is a life lived online. Among the huge tranche of information available to Google and Facebook alone is virtually everyone I know, a huge amount of what I’ve said to (and about) them, and a vast amount of data on where I’ve been. Such detailed tracking would have been an impossibility even 10 years ago, and we’re largely clueless as to its effects.
This is the core of the main comfort: despite their mountain of data, Google and Facebook seem largely clueless, too – they’ve had no more luck making any sense out of it than I have. And that, for now, is a relief.