Thursday morning, millions of Google users received an email about a change in the company’s privacy policy. Google does not seem to be collecting more information as a company. Instead the new policy makes it clear that Google, Google+, Gmail, and YouTube are owned by the same company, and providing data to one Google property means providing data to all of them. At first glance, it might seem surprising that this seemingly minor tweak in a privacy policy is news: Google as a company does not appear to be collecting any new data.
But this is news. It is news because data provided in one setting might now be used in a different setting. It is not the data collection per se, but the data sharing across contexts that raises privacy concerns.
This is part of a more general phenomenon. In a recent working paper, Catherine Tucker and I show that over the past decade the number of people taking privacy-protecting actions online has increased dramatically. While there are a variety of potential reasons behind this trend, we show that a large fraction of it is driven by a broadening perception of the situations in which privacy is needed. We show that people have always been privacy-protective in financial and health contexts. As information is shared across websites, people are increasingly wary of giving information in other, seemingly innocuous, contexts. (This latter point was argued by Curtis Taylor in a paper published in 2004). Therefore, the clarification in the new privacy policy that Google uses data from the search engine for YouTube ads suggests that, from a privacy point of view, there is little difference between searching for health information and watching YouTube videos of cute animals.
Overall, it is important to remember that privacy concerns aren’t entirely driven by who has control of the data, and what data they have. Privacy concerns are also driven by whether the data is used in a context that is distinct from what might have been expected when the user first provided the information.
Digitopoly 