Today the U.S. District Court issued a significant ruling that Google can be held liable for damages under the Wiretap Act because of its Wi-Spy program that collected usernames, passwords, whole emails, and other private data.

The Wi-Spy program was a part of a Street View initiative in which Google vehicles drove down nearly every street in America with sophisticated eavesdropping devices that captured any data being transmitted from an unencrypted wireless router. Almost every family in America with a home wireless network was vulnerable to Google’s listening devices. The court describes it best:

In 2006, prior to the launch of the Google Street View vehicles, Defendant’s employee engineers intentionally created a data collection system that included code that sampled, collected, decoded and analyzed all types of data broadcast through Wi-Fi connections. (CCAC ¶¶ 60-61.) This data collection system is commonly known as a packet analyzer, wireless sniffer, network analyzer, packet sniffer or protocol analyzer. (Id. ¶ 61.) Defendant authorized inclusion of this wireless sniffer technology into its Google Street View vehicles and even sought to patent the process. (Id. ¶ 65.) The wireless sniffer secretly captures data packets as they stream across Wi-Fi connections and then decodes or decrypts the data packet and analyzes the contents.

Google has been a bad actor in our industry when it comes to privacy. In addition to Wi-Spy, the company also conducted its Doodle for Google campaign to collect social security numbers and other sensitive data about schoolchildren and recently received the biggest penalty ever issued by the FTC for its Buzz product which revealed private communications between users and deceptively failed to unsubscribe them when asked. Google’s bad acts have reflected poorly on the entire internet and mobile apps community.

The District Court decision is significant because it demonstrates that sufficient privacy safeguards currently exist in our judicial system. Too often a regulatory response to a few bad actors results in unintended downstream consequences that negatively affect the industry. Most often, those that suffer the greatest in this environment are small businesses and startups. We have long been aware of the negative impact Google has had on consumers’ faith in the security of their online privacy. It is our hope that the courts continue to treat the Wi-Spy matter seriously so consumer confidence may be restored.

A copy of the court decision may be found, here. (.pdf)

Representing thousands of app developers, ACT applauds Apple’s proposed steps to address concerns raised by the use of location data on mobile phones.  The public outcry we are witnessing demonstrates that the technology industry must do more to make consumers confident in the security of their personal information. Apple has agreed to encrypt location data, explaining how and why it is being used while allowing users to opt out of location-based services.  It is important that customers are aware of what data is being used and affirmatively agree to its collection.

Google now needs to follow Apple’s lead and explain what they are doing with the data they collect on mobile phones.  Unfortunately, its track record instills little confidence in consumers after a series of high profile privacy violations.  Eavesdropping on family wifi networks, revealing users’ email contacts to social networks without providing an opt out, and profiling schoolchildren by collecting their social security numbers and place of birth as requirements for entry in a drawing contest has left many consumers understandably suspicious of Google’s concern for privacy.  Unfortunately, these incidents have led to a general distrust of smartphone privacy provisions.  App developers are now being negatively impacted by Google’s continued mistakes

Location-based services are among the most popular features on smartphones. Traffic apps and other location specific services are part of the explosive growth of the apps marketplace. With sales at $2 billion, expected to reach $38 within four years, the apps marketplace is one of the brightest areas of our economy.  Public confidence in the safety of personal information on smartphones is essential for the continued success of our country’s app developers. It is crucial that Google explains clearly to customers if and how their information is used so they can earn the trust of consumers and allow our apps economy to thrive.

The Federal Trade Commission today announced a proposed settlement in its case against Google for the privacy violations behind its Buzz social networking product.  You may recall, Google launched Buzz by integrating it directly into its email program, immediately disclosing the identities of people a user regularly contacted.  Google failed to inform consumers that this was a function of Buzz and did not fully remove those who sought to opt-out of the service.

I appreciate that the Federal Trade Commission identified the privacy violations of Google’s Buzz program to be of great concern to consumers.  The FTC was right to take up the case against Google for its transgressions.  While it’s a good start, today’s proposed settlement doesn’t go far enough to punish or deter.  The suggested penalties include a biennial audit, implementation of a privacy policy, and $16,000 fines for future violations.

Google would be required to submit to a third-party audit of its privacy programs every two years, the results of which will not be made public.  A lot can happen in two years.  After all, in far less time, Google has:

• revealed who you communicate with (Buzz);
• eavesdropped on your home wireless network collecting your passwords, emails, instant messages, and account information (Wi-Spy); and
• begun profiling your children collecting their social security numbers and other personally identifiable information (Doodle for Google drawing contest).

Google’s dominance in online search, advertising and analytics allow it to acquire an extraordinary amount of information if it chooses to violate consumer privacy protections.  But while fines of $16,000 for privacy violations aren’t much of a deterrent to a company worth $180 billion, it is a start. The FTC and other agencies will need to take further actions against Google if they hope to discourage it from repeatedly violating consumer privacy.

This matter is a great concern for those in the technology industry because continued bad behavior by a dominant market player, that proceeds unchecked, will inevitably result in an over-sized regulatory response.  Broad, industry-wide regulation will be the eventual outcome affecting everyone if Google is never sufficiently punished for thumbing its nose at consumers, privacy regulations, and government authorities.