Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am curious because, I experienced something bizarre recently. About a month ago, someone asked me to find out a price for a T-shirt printing machine, and probably for the first time, I pressed these keys and started searching, searching, for long and many found many results only using through the Google search engine. But now, even after two weeks has passed.. I see almost all the Google ads in the site I visit including YouTube have been changed, and only advertise T-shirt printing machine. Like the ones I was searching.

There is only one explanation for this, and Google has been controlling what I search and keeps log of these keywords. This might be normal for some people, and most of you might have known about this, but I find it unjust that a site can keep track of what you type and what you look for without asking permission. That's right! isn't it? We can agree to the terms and conditions when we signup to Google, but, they should be mentioned in the terms, or be specified in a very apparent manner.

edit: There have been responses from users, which according to them: Google has been snooping information from their private emails.

share|improve this question
82  
This isn't spying- this is explicitly what google say they will do, providing you with adverts tailored to you etc. Also, see this helpful and handy advice - it's comedy, but has a useful message: collegehumor.com/video/6851490/facebook-law-for-idiots –  Rory Alsop Nov 26 '12 at 8:14
40  
Maybe people should stop being so egotistical. Most of the answers I have seen on this subject are "oh, Google knows so much about my life, they know everything about me". TBH, so what? You're insignificant to them, you're merely one of millions. What they do is just an automated service to improve your online experience, and storing what you search for is just another tool in their kit. –  rickyduck Nov 26 '12 at 9:40
14  
Tracking you while logged in and use their services is NOT really a problem. But tracking you even while you are logged out, even on other services, IS. –  user117 Nov 26 '12 at 10:11
15  
Welcome to the real internet, Neo. Many sites keep track of every piece of information they can gather about users. Some (like google) declare that in their privacy policy, some do not. Governments spy on internet users too, Google and others will hand your search history to governments whenever asked, etc. etc. Your search history issue is rather innocent... –  Sandman4 Nov 26 '12 at 10:12
3  
I still suggest that you remove the last two questions; they seriously undercut the credibility of the question. Personally I still believe that two of the questions "Is Google spying on us?" and "Is it legal" are not questiosn that are relevant to IT security, and "Does it bother you?" is ill suited to a question and answer site. –  Mark C. Wallace Nov 26 '12 at 11:50
show 5 more comments

9 Answers

I don't have the legal information handy, but I will share my perspective on what may be happening & what I do in this instance. Overall, this sounds like an advertisement cookie that has altered your advertisements or you searched Google while logged into the search engine. Here are some things you can do in the future to prevent this type of tracking:

Search engine

For this reason I use DuckDuckGo.com (an unbiased search engine, see more here) that doesn't track or bubble your search results.

However using a different search engine isn't enough. Websites, advertisements and other things will track your browser using cookies and a few other techniques to identify you and your purchases. To this end you may want to use incognito mode or clear your cookies and browser history. Additionally since you can authenticate to Google and Bing with an email address you should know that your history may be recorded on a server.

Cookies

Some people delete cookies thinking they are gaining more privacy by doing so. You may consider doing this, but know it isn't 100% effective especially with things like the evercookie around.

Incognito mode

Several answers here mention incognito mode of your browser. If you use this, you may be interested in this answer that asks: Can web sites detect whether you are using private browsing mode?

Bottom Line

It's pretty tough to avoid being tracked by 3rd parties. However if you use Firefox the following addins should be a good start at protecting your anonyminity: (Thank you @DW)

share|improve this answer
1  
Some of these add-ons help, but AFAIK they are by no means sufficient. For instance, Privoxy's FAQ warns it is not enough to guarantee anonymity and recommends chaining with TOR or a similar solution (and I'd say even Tor isn't anonymous enough). –  Mister Smith Nov 26 '12 at 17:30
    
@MisterSmith Agreed, they are better than nothing, but I purposely omitted TOR because its weaknesses (see this link) mean someone else may be able to decrypt, alter, and hack a ToR user. I don't advise it except in very controlled environments. –  makerofthings7 Nov 26 '12 at 17:32
add comment

Advertisers use what information they have to try to best guess what sort of ads you will be most interested in. In Google's case, your search history is the best indicator they have, but ad clicks and ad impressions are also considered. In Amazon's case, for example, your purchase and product browsing history is their best indicator, and you'll probably notice that their suggestions closely mirror your recent history — even if that most recent history dates back to two years ago.

My own search and browsing habits tend to favor highly technical content; servers, programming, malware, etc. The ads I see when browsing under that profile therefore tend to also favor technical content: colocation, hosting, software, etc. This is totally Fine By Me™. When I watch TV, I have to endure a depressing amount of ads about feminine incontinence, retirement homes, and herpes medication. But on the Internet, the ads are all software and servers. Do I think that's creepy? Hell no. The fewer herpes ads the better, IMO.

To be clear: I'm a strong proponent of online privacy. However, I manage my online privacy by controlling the information I make available online. I don't expect others to maintain my privacy for me; the concept doesn't even make sense. If you don't want them to know something, then don't tell them. Telling them and then demanding that they forget is a recipe for disaster on numerous fronts, and even comical from a security standpoint.

If I don't want a search associated with me, I use a private browsing session, possibly from a different IP if I were to be worried about something. Sure, I could use a service that promises to not remember what I tell them, but I would be an idiot if I were to depend on that promise. Remember Hushmail? Still, I prefer to use a service that allows me to craft my own online preference profile so that they can filter out all the crap I clearly don't want.

Is this legal? — So far yes. I would hope that it remains so, since the unintended consequences of making it illegal would be so far reaching and unexpected that it would have devastating consequences for completely innocent Internet users and site operators. Internet regulation reliably makes things worse.

Does this bother me? — Of course not. If I buy an apple from a market, is it creepy for the vendor to ask me the next day whether I liked my apple? Do I think he's spying on me? If I tell him I liked it, is it creepy for him to suggest that I buy more apples at a subsequent visit? No, of course not. It's just good customer service. If he tells the fruit vendor next door that I like apples, should that be illegal? Of course not: It's his information to give, just like any conclusions I make about him are my information to share as I see fit.

Vendors online remember what we tell them just like vendors at your local market. My fruit vendor may remember that I visited his store even though I didn't buy anything, and yet I don't assume that he's spying on me. I'm visiting him, not the other way around. Likewise, when I visit Google, I don't think it's spying for them to remember what I ask them.

The biggest problem with online privacy is the implicit belief that because I connect to the Internet from the privacy of my own home, anything I do on the Internet also happens in the privacy of my own home. This is lunacy. Everything you do on the Internet is absolutely public unless you can verifiably prove otherwise.

share|improve this answer
12  
Your sweeping generalizations and bold assertions are not a substitute for evidence. Using television (a totally passive media) as a metaphor for the active relationships between online search and commerce is laughable. The biggest threat to ordinary people, who have no idea how their information is being used, are supposed professionals like you. I suppose as long as you feel good, the rest of us shouldn't care. –  this.josh Nov 26 '12 at 6:51
45  
@this.Josh- in an ideal world, it would be lovely to have all companies behave ethically, and expect privacy. Tyler points out that a better/safer option is to assume the opposite and explicitly add whatever privacy controls are required yourself. Yes, this doesn't make life easy for ordinary non-tech folks, but the alternative is for them to trust companies that they maybe shouldn't. –  Rory Alsop Nov 26 '12 at 8:13
9  
@this.josh You'd be surprised as to how non-passive TV is... –  Polynomial Nov 26 '12 at 11:12
9  
@tekiegreg you can, here is the link to it. In fact there is a OptOut tab on that page that lets you disable it entirely. –  Scott Chamberlain Nov 26 '12 at 18:41
9  
Great answer, and I really like the bit "I'm a strong proponent of online privacy. However, I manage my online privacy by controlling the information I make available online." –  Rachel Nov 26 '12 at 20:05
show 1 more comment

You can change your Google Ads Preferences by visiting http://www.google.com/ads/preferences/. This includes changing your interests, demographics, or opting out of having personalized targeted advertising in general. You can check if opting out was successful by verifying that the web history list at the Google opt-out page is empty.

You need to allow your navigation browser to interact with cookies. Therefore, if you make the changes on your settings as well you might need to clear them from your storing folder and/or restart your browser if there is a caching triggered event happening for that application.

share|improve this answer
16  
+1 for a sane, useful answer. –  Jeremy French Nov 26 '12 at 10:15
2  
Does this actually stop them tracking information about you? I just think they'll stop using the information to target ads; the information is still there, and that's what's bothering the OP. –  jhocking Nov 26 '12 at 13:54
1  
@jhocking They will still store the information. This will just prevent some of it's use. From the linked page: "This opt out setting doesn't apply to ads on Search and Gmail, which can be managed via Ads on Search and Gmail." Google can of course change this if they please. –  AndSoYouCode Nov 26 '12 at 14:02
3  
The funny thing for me is, while a lot of people consider this spying, I actually went and edited those preferences so I could be "spied" more efficiently; because in the end of the day I get a tailored, suitable and smart service. I'm all for it! thank you Google, and thank you Jonathan for providing everyone with that link. –  Ken Nov 26 '12 at 19:40
add comment

If you want to call it spying, yes, of course they are.

Think about how much information Google has about you. Imagine how much more they can charge for advertisement if they combine all of their information about you from all of their sources: Search engine, gmail, youtube, google analytics, chrome, android (contacts etc), maps, calendar, google docs/drive, google+, gtalk... and I've probably missed a few big ones.

Just stop for a few seconds and think about how much they know about your life just from that data.

It would be stupid not to claim it's for the good of the users, so they do. Source

I think it's legal since you accepted their new agreement a few months back.

Ethical? Well, you decide.

In 2012 information is power. Who's got the power?

share|improve this answer
add comment

"Some Google services are supported by advertising revenue and may display advertisements and promotions on the service. Such advertisements may be targeted to the content of information stored on the Google services, queries made through Google services or other information. The manner, mode and extent of advertising by Google on its services are subject to change. As consideration for your use of Google services, you agree that Google may place such advertising and that Google shall not be responsible or liable for any loss or damage of any sort incurred by you as a result of the presence of such advertisers on Google services or your subsequent dealings with advertisers."

If you use Google, you implicitly accept the terms of service, portions of which are quoted above. The portions I've bolded explain the behavior you saw. This isn't "spying" in any sense that I can understand the word. This is an effort to add value to the services that they provide to you and to the advertisers. You have ample opportunities to control the information that google obtains about you, and can request that they remove/destroy the information.

share|improve this answer
    
What percentage of users read the Terms of Service? Even when users do read the ToS do they really understand what it means? Do average users know how to configure their browsers to "control the information that google obtains about you"? –  this.josh Nov 26 '12 at 19:37
3  
I'm not sure those questions are relevant to the OP's question. The OP asked a question that has an obvious source; he failed to consult the obvious source. I don't like the way TOS are currently managed, but I don't have a better suggestion. –  Mark C. Wallace Nov 26 '12 at 19:57
    
@mark-c-wallace They are however relevent to the substance of your answer, especially the last one. You need evidence to support your argument. Please see cyber.law.harvard.edu/stjohns/Specht_v_Netscape.pdf for a case where Terms of Service was judged to be non-binding. –  this.josh Nov 27 '12 at 5:47
    
@xavierm02 Here is my logic explicitly. Mark's answer says that Google offers free service as long as a user accepts a contract with Google (Terms of Service). There is a trade of the user's information for the service Google provides. In order for the transaction to be valid the user must agree to give their information to Google. The problem is that the vast majority of users do not understand this agreement and are not giving consent. They have the mistaken idea that they are receiving free service. Additionally those users are not able to "control the information that google obtains". –  this.josh Nov 27 '12 at 17:58
2  
I was going to try to stay out of this, but I can't. Whether or not users understand the terms of service has nothing to do with whether they are binding. Contract law is contract law for the illiterate as well as for the supereducated. I think there are drawbacks in the system, but I don't have anything better to suggest. –  Mark C. Wallace Nov 27 '12 at 19:56
show 1 more comment

Google web apps like Calendar, Analytics and Gmail, Chrome browser, Android OS, search engine are only a way of get people used to use Google stuff. It seem so familiar now.

However, I don't really think that Google cares about developing an incredible piece of software like Gmail. They only give you these tools cause it makes you used to be tracked, under hard spying.

Not evil? I don't think so. They ONLY want to display adds and make money.

The gold medal is certainly the Analytics tools that makes each website runs a kind of tracking back door: who is watching which website, when, who long, where, who, etc. It is installed on every website and it's really just like the worst spying nightmare.

Most of the people don't care about all this, so they don't even know they are tracked. How analytics can be legal? It send so many informations to Google (not really to the Webmaster who intalled it I mean), even if you don't ever sign for anything or even if you don't have a Google account (they can make stats about this kind of people too!).

Should it be legal? I don't think so.

share|improve this answer
2  
Except everything is clearly explained and consensual. The web site provider running Analytics gets valuable information about their site and increased ad revenue, Google gets valuable information they can use to make their ads more profitable and the consumer gets content for no direct financial cost. At no point was the behavior concealed or done behind the user's back. When you go to a site, you consent to their terms about the use of their service. As long as their terms clearly indicate what they will do with your connection and they don't go outside that, there isn't any evil. –  AJ Henderson Nov 26 '12 at 16:08
1  
How can we know what Google really do with all the data? In Europe, they got legal issues with collected data (Street View cars collecting it from hot-spots). IT law is at it's very beginnings, some organizations are daily fighting for our net-freedom. –  smonff Nov 26 '12 at 18:36
    
Seb- we do know what they try to do with it-make money from targeting ads. That is their top driver. If you don't want to give information to them, just don't give it to them! –  Rory Alsop Nov 26 '12 at 20:30
    
@Sebf - The StreetView wifi incident was a lazy development of a wifi SSID geolocation gathering. I haven't heard anything about the data being used by Google, and without evidence to the contrary, I see little reason to not buy the official story on that issue. If they had a pattern of behavior contrary to good stewardship of data (like say Facebook), I'd be more worried, but Google's whole business model is dependent on them controlling their data and not letting it out and I don't see how random wifi data would be useful. –  AJ Henderson Nov 26 '12 at 21:28
2  
@Sebf : you know that your information is persistent, yet you give it up - that's not theft - you gave entirely voluntarily. If you don't want them to have your information, don't use their service. Nobody forced you use Google - you LIKE to use their freebees. Why is this hard to grasp? –  Vector Nov 27 '12 at 19:36
show 2 more comments

To be a little more specific about Google directly, what you hit on here is exactly why Google is Google. That is the main thing their money comes from. As Tyrel mentioned, marketing is all about getting the most successful impressions for the money. Google hit on a powerful niche of marketing by realizing that they could tie people's searches to advertising, but do it in such a way as to not compromise the validity of the search. The idea was around prior to Google, but many places that did it simply put paid listings higher up the search results without indicating them as such and thus the quality of those search engines suffered. Google's Terms of Service clearly indicate that they can and will do this and use of Google's services constitutes acceptance of this.

To the consumer, it is important to be aware of what information is being collected about you and how it is being used, but it is also worth pointing out that this monitization of your information is what allows internet marketing (the good kind, not spam) to be so effective and therefore so much more profitable. In an ideal world, this monitization is passed on to the consumer as free or cheap services that are useful to their life, such as, say powerful search capabilities, open source mobile OSes and free/cheap VOIP service. Even the cost (giving up a little privacy about your searches) has benefits to the consumer, such as more valid advertising than they would otherwise be inundated with.

That isn't to say that you shouldn't be careful what information you put out there and be sure you are comfortable with it being out there before you put information out in the public. It is however important to remember that it is a two way street and you get valuable goods and services in exchange for agreeing to share some information so that they can serve both you and the advertisers better. It's a win/win for everyone as long as the middleman does their job well (which thus far Google has really been the model of doing it right for the most part) and all parties are aware of what is going on and agree with it.

share|improve this answer
add comment

So here are my two cents:

Advertsing is Google's main business. If this Wikipedia article is correct, in 2011 96% of their revenue derived from ads. So in order to show you the most effective ads, they need to know where do you live, what your interest are, etc. From this point of view they are not interested in your info as an individual, and following good browsing practices you can achieve a decent level of anonymity.

At this point we've to talk about profiling. Even if you change IPs, delete cookies, use proxies, etc, if your browsing patterns are the same they can identify you. Not that they can know where exactly do you live or how old are you, but they can know , for instance, user 36576235426 is online, he is in his late 20s and likes blue T-shirts. That said, IMHO Google's profiling is light compared to what Facebook does.

However, your data could still be used by third-parties if, for instance, Google makes a deal with corporation X so that they can exploit a part of their data. Or by governments, which have both regular and irregular channels to ask Google for data. In an extreme case, if a terrorist escapes jail while wearing a pink and green rubberduck shirt, and a week ago you were searching for "pink and green rubberduck T-shirt" in Google, I'll bet my hat the feds will be ringing at your doorbell in no time :)

share|improve this answer
2  
Your personal hat isn't much use to me or most anyone whose concern is their online privacy. I'd rather see some hard references for what information could be subpoenaed, what can't, etc. –  Caleb Nov 26 '12 at 18:32
    
@Caleb My last paragraph was just an example. If your concern is (online) privacy then you might consider moving to a cave away from "civilization". There's no hard data on this, since what could and couldn't be done should be hidden from public eyes. Guessing is all we can do. But if you want Google stats, read here: google.com/transparencyreport/userdatarequests –  Mister Smith Nov 27 '12 at 8:39
    
Put a bot on AWS that warns you when it sees long unique URLs to it. Store these URLs in your various cloud apps. When one gets in the wild and pings your bot you know the cloud service has been compromised. Be extra tricky and use English phrases so they look like real links to a snoop xkcd.com/936 –  Chad Brewbaker Aug 19 '13 at 21:29
add comment

Yes, Google "spies" on us. But that's explicit; it is written in the usage conditions. If you go to www.google.com and click on the "Privacy & Terms" link, you can get to a page linking to their Privacy Policy and their Terms of Service (these documents are the ones for Canada, different versions may be applicable depending on your country). Google made quite some effort to write these documents in clear human language rather than arcane legalese, but they still are quite long, so allow me to summarize them:

By using Google's services, you allow them to collect information on you, and use it for several purposes, main of which being targeted advertising. The information they collect includes your search queries, the contents of your Gmail emails, your OS and browser versions, your behavioural patterns...

I suggest that people interested in the subject make the effort of reading both documents extensively; they are instructive.

Is it legal ? Given that there are 193 sovereign countries in the World, and that some (actually many) of them are federal states whose individual provinces or regions often exercise some considerable legislative autonomy, then there are hundreds of jurisdictions to take into account, and any precise answer to that question would be much longer that even I would care to write.

Google is rich enough to buy extensive legal consulting, so chances are that what they do is legal, or at least was made legal. There can still be local variations. For instance, in France, handling of personal information is regulated by the CNIL which is currently battling with Google on these matters. So while what Google does is, on average, built on sturdy legal foundations, the jury is still out in many jurisdictions.

What is the big picture ? An important point to be made is that there are consequences. A rather common but simplistic reflex is to declare that one party is Evil and the other is Good, and be done with it; this is how most Hollywood action movies work, and this manichaeism now permeates the way the "general public" envisions political issues which exceed in scope and scale what can be dealt with within the boundaries of a small village. It would be easy to simply state that "Google is evil, they are villains, let's kick their ass." The reality is somewhat more complex.

Indeed, Google offers services which many people have come to consider as essential. I have known the Internet before the search engines, and it was rather hard to navigate. However, servers and code don't grow on trees; to have a service which works as well as Google's, be it a search engine, a video hosting platform or a reliable Webmail, some resources must be used at some point. To speak crudely, this costs money. Quite a lot of the stuff, actually.

Google is a private venture which aims at making more money than what it began with, and it is apparently quite successful at it. From the Wikipedia page, we can learn that Google makes more than 50 billions of dollars per year, and 96% of it comes from ads. This "spying" is their life force. Google can provide their nifty services to us, for free (apparently), because they can gather some personal information from users and use it as fuel for their advertisement business.

We are paying for the Internet with our privacy. That's the naked truth of it. That which we pay to Internet Service Providers, and indirectly through our taxes and subsequent state investments into infrastructures (direct or through subventions), would not be sufficient to pay for the Internet as we experience it today. It would allow for the copper cables and optic fibres, but not for all the data organizing that Google and its ilk provide (all that I say would also apply to Yahoo!, Bing, and all others, but Google is the pack leader so we can concentrate on them for now).

Google's services are paid for by advertisers, who in turn feed themselves, through Google, on our privacy. That's the deal which is in place. Right now.

Does it bother me ? Not the concept. My privacy is mine, so it is mine to give or sell. As @tylerl explains, this has side benefits, in that targeted ads are just that: targeted. What bothers me is that:

  • The whole deal is global in nature; either everybody sells their privacy to pay for the Internet, or not. There is little room for individual choices. I cannot really decide whether I, personally, will yield to Google's prying eyes or not. This is as if my privacy had become part of a general "shared privacy" (however weird this sounds) which has to be managed as a shared resource, like air, water or oil. History shows that my fellow humans are not very good at making adequate management of shared resources.

  • Most people don't realize that they get a cheap Internet because of such deals. They believe that once they have given their monthly 30 EUR to their ISP, they are done with it and can download and surf and be entertained without any limit. They don't understand how implausible such a deal would be.

  • If we are paying for the Internet with our privacy, then I have the nagging feeling that we are selling very cheap. Google makes a lot of profits; this may indicate that the services we get from Google are actually worth much less than what our collective privacy was.

My current plan is to raise awareness and understanding of these issues, as in the present text. The more people think about them, the more probable it becomes that someday, someone will come up with something intelligent to say on that subject.

share|improve this answer
    
The bounty was tagged, under the supposition of Google sizing information from emails, that is what I would like to know more of. –  Simon_eQ Aug 15 '13 at 20:41
2  
Well, I talked about it. Google scans the emails of people that are hosted on Gmail (incoming ant outgoing). This is part of what they do, and they always said they would do it, from the first day Gmail was opened. –  Thomas Pornin Aug 15 '13 at 22:45
    
An email system that scans content, presents ads relevant to that content and then stores an array tag that references what ads were determined to be relevant from your past searches may be an information leak to anyone who uses your computer as to what you search for from that computer. When that is all that is being done, it isn't spying. Spying would be recording what you search and passing it onto other parties. There is a decoupling that occurs here between what the actual content was and the ad content that was determined to be relevant. –  Fiasco Labs Aug 16 '13 at 5:36
add comment

protected by AviD Nov 26 '12 at 12:21

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.