See no evil

Google is 10 years old this month. In a decade, it has gone from a university dormitory room project by two PhD students in California to a $150 billion company, and entered the language as a verb – to google. That a googol is the mathematical term for a 1 followed by 100 zeros is an indication of the company's ambition,

Many of us find it hard to imagine being without Google. It introduced us to the real power of web searches, provides a sophisticated mapping facility, a search engine for the desktop, programs to organise photos, word processing, spreadsheets, calendar utilities and all sorts of little add-ons. This article was researched using Google.

Because such incredibly useful, entertaining or quirky facilities are ostensibly free, and advertising is strictly controlled, Google appears to be working in the original spirit of the internet and has a reputation that Microsoft must envy. In July 2008, Jeff Chester wrote on Interbrand's online magazine brandchannel: ‘For many brandchannel readers, the Google brand is cherished as an avant-garde brand of the people, for the people.’

Users, he said, believed Google was continually revolutionising new media and offering consumers something for free. ‘Furthermore,’ he continued, ‘despite the worldwide success of Google, the brand continues to be seen as the humble underdog that champions noble causes.’

What Google is doing with all the information it has amassed thanks to all those useful services is only gradually becoming a concern. As one woman responded in the 2008 brandchannel brandjunkie survey on 31 March 2008, ‘Without Google, my right arm would feel as if it had been amputated. I know some people harbour conspiracy theories about Google taking over the planet, but I would happily entrust Google with almost anything!’

Google is, nevertheless, a business, for which it makes no apologies. It makes 99% of its money by selling advertising and it does so by using its technological expertise and wealth of data to enable those ads to be targeted very precisely.

There are dissenters from the faith. A European Union data protection working party of national officials is one. Twice in 2007, Google has changed its privacy policy in response to pressure from the European Union, once over the length of time it keeps personal data on users, and the second time over the storage period for cookies, little pieces of information that web sites place on our computers so that they remember us when we return to that site. In May 2008, it got a warning from the EU data protection supervisor, Peter Hustinx who said Google should not display photos of individuals on its Street View application.

Another dissenter is the pressure group, Privacy International. In June 2007, its report ranking net companies on their handling of personal data put Google in bottom place among 20 popular firms, including Microsoft and AOL. Describing the company's approach as ‘an endemic threat to privacy’, Privacy International explained: ‘This is in part due to the diversity and specificity of Google's product range and the ability of the company to share extracted data between these tools, and in part it is due to Google's market dominance and the sheer size of its user base. Google's status in the ranking is also due to its aggressive use of invasive or potentially invasive technologies and techniques.’

Google's response was: ‘We are disappointed with Privacy International's report, which is based on numerous inaccuracies and misunderstandings about our services.’ Bloggers also leapt to its defence, citing among other things the company's resistance, despite a subpoena, to demands from the US Justice Department in 2006 to hand over data on the subjects of internet searches. The Justice Department wanted the information as part of efforts to revive an online pornography law.

On its website the company tells application developers, ‘Our business is built on our users' trust: trust in our ability to properly secure their data and our commitment to respect the privacy of the information they place in our systems by not giving that information to others or using it inappropriately.”

“If customers lose faith in a business, it weakens its defences to competition.

Google states its guiding principle as ‘Don't be evil’. The company has, from the beginning, emphasised the importance of keeping search results clear of commercial pressures. It is not possible to get a higher position in searches other than through Google's own technical criteria. As a result, an industry has grown up helping site owners to boost their site rankings.

In the letter that begins the company's 2007 annual report, founders Larry Page and Sergey Brin, state: ‘The trust of our users is paramount. We simply will not bias our search results for financial reasons. Our ads are separated from the search results and clearly labelled. We believe strongly in maintaining the integrity of search.’

Risks acknowledged

Having listed on Nasdaq in 2004, Google makes extensive disclosure of the risk factors that could affect its success as a business. The company acknowledges that privacy issues are among them. ‘From time to time, concerns have been expressed about whether our products and services compromise the privacy of users and others. Concerns about our practices with regard to the collection, use, disclosure or security of personal information or other privacy-related matters, even if unfounded, could damage our reputation and operating results.’

Essentially privacy risks fall under three headings:

Malicious threats to the integrity of the data the company holds or negligent loss of data.

Regulatory or strong consumer objection to company policy and practice on data collection and use.

Enforced disclosure of user or partner information, for example, in copyright disputes or by government.

In its annual report, the company does not explain what procedures it has for managing these risks. US law and regulations concentrate on companies' controls and management of financial risks that could have an immediate impact on results, while some European corporate governance codes require more discussion of enterprise risks and overall systems of control. The company's response to StrategicRisk's questions was to point to its stated policy, which starts on www.google.com/intl /en/privacy.html. It is detailed, clear, and aimed at users.

This is not currently an issue that seems to excite shareholders. The company's share price had a slight hiccough at the time the report was published, but soon resumed its upward direction and hit its all time high in November 2007 at 747 cents, significantly outperforming the rest of the index. From January to March, the price fell sharply to 412, rose again in May, as Microsoft dropped its bid for Google rival Yahoo, and now hovers around 480.

“Without Google, my right arm would feel as if it had been amputated.

A serious issue

Web companies are, however, taking the privacy issue seriously. They are commissioning research or using the consultancy company set up by Privacy International, called 80/20 Thinking, to audit their privacy policies and practices.

Simon Davies, CEO of 80/20 Thinking, argues that consumer issues can erode even a very strong market position. He says that if customers lose faith in a business, it weakens its defences to competition. He outlines the stages in the process by which an issue starts

First, the company comes under scrutiny from pressure groups and concerned individuals.

Next, journalists take up the story.

Third, legislators and the mainstream press take up the issue and call for regulation. An environment of public mistrust takes hold.

Fourth, government or regulators take enforcement action.

There can be a further stage, when the government passes prohibitive legislation.

‘Every company in the world has to be aware that once phase 1 begins, it needs to take remedial action. Once there is a crack in the customers' trust, then alternative visions of business have time to materialise,’ Davies states. He believes this can happen as early as phase 2 if the pressure groups and journalists have created a solid enough case.

However users perceive Google, it is a business, albeit one whose philosophy is that you can make money without doing evil. It makes 99% of its revenue from advertising, and it does so by persuading advertisers that its business proposition of targeted advertising will deliver results, Its figures indicate it is doing this successfully. In 2007, Google had revenues of $16.6 bn, compared to $10.6 bn in 2006, and net income rose from $3.1 bn to $4.2 bn.

Two months after the critical Privacy International report, the chairman and CEO of Google Eric Schmidt called for a global approach to privacy standards in an article in the Financial Times. Writing on 19 September 2007, he said that at present, most countries had no data protection rules. Where they existed, there was a mix of different regimes, and while the EU did have common standards, they were ‘often complex and inflexible.’ He concluded: ‘The task we now face is twofold: to build consumer trust by preventing abuse, and to create consistent, predictable rules that encourage future innovation.’