Earlier this year, Google announced a privacy policy change that was widely covered by tech blogs, the mainstream press and which generated much governmental concern. Last month, Microsoft announced the same type of change. That generated little reaction. Either Microsoft’s change deserved the same scrutiny from all the same parties that examined Google so closely or Google got unfairly attacked.
This is a long article, so let me say from the start that I don’t think consumers need to fear either the change Google did or the one that Microsoft will implement later this month. You can jump to the end for my summary, which is basically that if you trust either company already, then you’re trusting whatever is in their equally broad-natured privacy policies probably won’t be harmful to you.
My focus in this isn’t to raise alarms over Microsoft’s change, though certainly those hypersensitive should look closely at the new terms. Rather, it’s to call attention to the fact that Microsoft isn’t receiving near the scrutiny for its change that Google received, and that deserves some reflection.
As I said in my opening, either Google got singled out unfairly or all the press outlets and governmental agencies that studied the Google change have failed to do their jobs with Microsoft’s similar shift.
First Day Reaction To Google’s Change, Illustrated
Let me start with a picture. Below is an image of how the first day coverage of Google’s privacy policy announcement was summarized on Techmeme, a popular news site that pulls in headlines from technology and general news sources. Get ready to scroll:
That’s nearly 50 stories covering the news in all, including my own first day story:
First Day Reaction To Microsoft’s Change, Illustrated
Next is first day coverage as summarized on Techmeme of Microsoft’s privacy policy change, a change that — as far as I can tell — has pretty much the same open-ended sharing allowances that Google’s policy change had:
Less than 10 headlines. We didn’t even do a first day story ourselves here at Marketing Land, in the way we did with Google. Why? I’ll get back to that, as well as why the reaction overall seemed so muted. But to fully understand how little reaction Microsoft’s change generated compared to Google, you have to go beyond the first day stories.
For Google, Huge Fallout
To measure the fallout to Google’s change, I searched on Techmeme for “google privacy” and then looked for significant clusters of stories marking some new development. These stretched out for four months after the announcement was made. The highlights:
Jan. 24: Initial announcement
Jan. 26: Google has to make second clarity statement; US House of Representative members send letter asking for answers on privacy changes; one calls for FTC investigation
Jan. 31: Google issues public response to congressional questions
Feb. 1: Microsoft launches ad campaign attacking Google on privacy changes; Google does mythbusting post in response
Feb. 2: Google testifies about changes to congressional reps; one says Google wasn’t “forthcoming”
Feb. 3: The EU wants Google to halt plans to change its policy; Microsoft ups its anti-Google ad campaign
Feb. 8: Privacy group EPIC sues FTC over Google’s planned changes
Feb. 18: FTC rejects EPIC’s complaint
Feb. 22: Several US states attorneys general write Google in concern over the changes
Feb. 28: French regulatory body expresses concern over change; US FTC chair calls it a “brutal choice” for consumers
Feb. 29: How to protect yourself from the changes articles appear ahead of change
March 1: Japan warns Google over the changes; EU agencies say it breaks data protection laws
March 2: Spain asks EU’s top court to review privacy policy
March 30: US Senator Al Franken attacks privacy changes
April 5: Google responds to EU concerns
May 24: French authorities demand better answers from Google
From June onward, stories about Google’s privacy policy change appear to have dwindled, at least in appearing from enough different sources to form clusters on Techmeme. However, The Guardian recently reported that any day now, the EU might declare the changes are a violation of EU law and should be changed.
For Microsoft, Nothing
To measure the fallout to Microsoft’s change, I searched on Techmeme for “microsoft privacy” and then looked for significant clusters of stories marking some new development. Here’s the list of what I found:
Nothing
Since news of Microsoft’s change emerged, there appear to have been no major follow-ups by news outlets. No regulatory bodies or government officials seem concerned. No privacy groups have spoken out loud enough to attract attention.
How Google Announced Its Change
Why such a dramatic difference? For one, there’s the way the announcements were made.
Google made its
announcement on a Tuesday afternoon Pacific Time on its main company blog, followed by emails entitled “Changes to Google Privacy Policy and Terms of Service” to those with Google Accounts and notices that appeared in front of people who went to Google services, such as shown to the right (image from Tech Smart Life).
Here’s a key part of what Google’s announcement said about its changes:
What does this mean in practice? The main change is for users with Google Accounts. Our new Privacy Policy makes clear that, if you’re signed in, we may combine information you’ve provided from one service with information from other services. In short, we’ll treat you as a single user across all our products, which will mean a simpler, more intuitive Google experience.
I’ve bolded the most important part, the issue that caused Google the most grief, the issue Google went out of its way to highlight.
How Microsoft Announced Its Change
Microsoft made its announcement at noon (which time zone is unclear) on a Wednesday via its Microsoft Volume Licensing blog. That’s so little read that no news outlets seemed to have noticed the blog post.
Instead, the Microsoft change only got news coverage when emails began going out to consumers with Microsoft accounts, such as people with Hotmail or SkyDrive accounts, informing them that a new service agreement was coming. Messages appear to have been sent from Friday, August 31 through Sunday, September 2.
VentureBeat appears to have been the first major outlet to report on the change and had one of the best pieces, I think, noting the change to allow sharing between services. A few other outlets followed with this.
We certainly missed the news here at Marketing Land. I didn’t catch the story when it hit Techmeme on Sunday, Sept. 2. I also didn’t pay much attention to the email of the changes I received that day as a Microsoft account holder.
What finally brought the change to my attention was a press release I was sent by the tiny StartPage search engine on September 10, informing me that:
Microsoft is claiming unprecedented new powers over user data…. Microsoft can pry into Hotmail messages and its other cloud services, such as Skydrive, to profile users and deliver them targeted advertising — even change the search results they receive. Startpage spokesperson Dr. Katherine Albrecht denounced Microsoft’s new policies. “Hotmail users will be stunned to learn that their emails are now fair game,” she says. “People don’t like being spied on and served censored search results. If I send an email to somebody, I don’t expect my comments to be reflected in my search results the next day. Email messages should be private and so should search results, and the twain should never meet.”
Suffice to say, StartPage goes over the top trying to suggest that personalized results are the same as censored results. But the release did bring the data sharing change to my attention. Presumably, it was sent to other news outlets but didn’t gain any traction.
Microsoft Attacks Google’s “Connect The Dots” Privacy Change
Could the difference be because Google’s privacy policy changes were broad and overreaching whereas Microsoft’s are somehow better. If that’s the case, I sure can’t see it.
Google took criticism, including from me, for making a change that seemed to open up the ability for it to do whatever it wanted with the data it collects. To me, it was like Google changed its constitution without a Bill Of Rights list of things it would not do. To do one without the other seemed a terrible mistake.
For many critics, the biggest concern was that Google gave itself the right to share data across various services that might have been limited before. This particular change is what prompted so much attention. It’s specifically what Microsoft attacked in its campaign, with an ad that said in part:
Google is in the process of making some unpopular changes to some of their most popular products. Those changes, cloaked in language like “transparency,” “simplicity” and “consistency,” are really about one thing: making it easier for Google to connect the dots between everything you search, send, say or stream while using one of their services. But, the way they’re doing it is making it harder for you to maintain control of your personal information. Why are they so interested in doing this that they would risk this kind of backlash? One logical reason: Every data point they collect and connect to you increases how valuable you are to an advertiser.
With Microsoft running an attack ad campaign like this, there’s no way Microsoft itself would consider doing something similar to Google, right?
Way.
Microsoft’s “Connect The Dots” Privacy Change Overlooked
Actually, Microsoft already had some of these rights. I wrote about this before in February, how anyone who simply read…
The Bing Privacy Policy, would be told to read…
The Microsoft Online Privacy Statement, in particular the “Display of Advertising” section which says to read…
The Microsoft Advertising Privacy Supplement, which says that…
… Microsoft seems to have the right share data across two separate services (Bing and Microsoft Advertising) if it wants to, perhaps to use my search history to show me display ads on the sites of advertising partners. I’m still not sure if Microsoft actually does this, but it does seem to have the right.
As I also previously explained, the Microsoft Online Privacy Statement already seems to have given Microsoft the right to have widespread cross-service data sharing:
In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services.
So what’s new? Not changes to any of the three privacy policies I’ve numbered above. Heck, the first two (Bing & Microsoft Online) have changed since I first wrote about what they allowed in February — not that I recall Microsoft alerting anyone to the changes or what exactly was altered.
What’s new is a change to the Microsoft Services Agreement, which while it’s not called a privacy policy does contain privacy policies within it.
Discovering Microsoft’s Change
Consumers were informed of the coming change via email, as mentioned earlier. They received an “Important Changes to Microsoft Services Agreement” message that said in part:
We’ve updated the Microsoft Services Agreement, which governs many of our online services – including your Microsoft account and many of our online products and services for consumers, such as Hotmail, SkyDrive, Bing, MSN, Office.com, Windows Live Messenger, Windows Photo Gallery, Windows Movie Maker, Windows Mail Desktop, and Windows Writer. Please read over the new Microsoft Services Agreement here to familiarize yourself with the changes we’ve made. The updated agreement will take effect on October 19, 2012. If you continue to use our services after October 19th, you agree to the terms of the new agreement or, of course you can cancel your service at any time. We have modified the agreement to make it easier to read and understand, including using a question and answer format that we believe makes the terms much clearer. We also clarified how Microsoft uses your content to better protect consumers and improve our products, including aligning our usage to the way we’re designing our cloud services to be highly integrated across many Microsoft products. We realize you may have personal conversations and store personal files using our products, and we want you to know that we prioritize your privacy.
The bold part is my emphasis. I’m not sure “highly integrated” speaks as clearly as Google did with “combine information” to explain that information may be shared between two services, such as Hotmail and Bing. But that’s what’s allowed.
Those who go into the actual agreement find this in Section 3.3:
When you upload your content to the services, you agree that it may be used, modified, adapted, saved, reproduced, distributed, and displayed to the extent necessary to protect you and to provide, protect and improve Microsoft products and services. For example, we may occasionally use automated means to isolate information from email, chats, or photos in order to help detect and protect against spam and malware, or to improve the services with new features that makes them easier to use. When processing your content, Microsoft takes steps to help preserve your privacy.
Again, the bold emphasis is mine. This is a pretty broad allowance. Potentially, this change means “content” (such as email) can be used to improve Microsoft products (such advertising products) if Microsoft decides that’s useful.
This type of sharing is exactly what Google’s announcement was all about, just explained in far plainer language. It’s exactly what Microsoft attacked Google over. It’s exactly what multiple publications examined or criticized, that multiple government officials and organizations got all concerned about after Google took efforts to ensure this change was understood. Microsoft made the change in a far quieter manner. That seems to have paid off.
The Ads Issue
Of course, another key difference beween what Google and Microsoft did in their announcements is that Google discussed how the change would be used to improve ads. In contrast, Microsoft stressed (in its post on a little known Microsoft blog) that content from email or SkyDrive wouldn’t be used for advertising purposes.
But if data sharing for ad purposes was the primary driver of Google’s scrutiny, then Microsoft still deserves the same attention. After all, it’s not like Microsoft promised to never share information between any of its services for ad purposes nor better clarified what it does now or what might change.
Ruling out ad targeting based on email or SkyDrive via a Microsoft blog that few consumers will ever see isn’t the same as ruling it out in the services agreement itself. What if Microsoft changes its mind in the future about using email or SkyDrive data?
That’s key. Just like Google, the new policy gives Microsoft new rights to use information between services as it likes. It seems as open-ended as Google’s policy seems.
Microsoft’s Reassurances
Looking for answers, I put this to Microsoft via email:
Your blog post says you don’t use the contents of email or SkyDrive for advertising purposes, but you could, couldn’t you? It’s not in the actual agreement? Is there anything in the actual agreement that prevents this? If you think it’ll improve ads, those are a Microsoft service, so the data could be used, couldn’t it? My read is that you totally have this ability now, if you want it in the future.
I got back these Q&A-style responses, even though the questions aren’t actually what I asked:
Q. Does Microsoft intend to use the contents of Hotmail/Outlook.com emails (or SkyDrive files) as part of Bing search results? A. No, and we don’t have any plans to. To the extent these services were determined to be of value to our customers in the future, we would let our customers know in advance of any change. Q. Does Microsoft intend to use the contents of Hotmail/Outlook.com emails (or SkyDrive files) for advertising? A. Of course Hotmail and Outlook.com have advertising, and our goal is to make it useful. But we’ve already said that we don’t use the contents of your mails with other people for advertising and don’t even serve ads with those. Similarly, we don’t use the content of your personal emails for advertising on other properties. Again, if that were to change, we would let our customers know in advance of any change. But we don’t foresee that today.
Just Trust Us?
I guess we’re left to trust that if Microsoft is combining information now, or in the future, in any way to deliver ads to consumers, it’ll ensure we know about those ways or alert us to any important changes.
Of course, Microsoft spent a lot of money on an anti-Google ad campaign teaching consumers that they shouldn’t just trust Google’s promises of transparency. But if those consumers shouldn’t trust Google at its word, why exactly should Microsoft be taken at its?
I think the answer is exactly what I wrote before, in my You Don’t Need To Fear The Google Privacy Changes: A Reality Check article:
In the end, it’s more about whether you trust Google and Microsoft to begin with, rather than what their broadly-worded privacy policies seem to allow. So if you already trust Google to begin with, you’re probably fine.
The same is true for Microsoft. If you already trust it, you trust it won’t do something harmful to you, not that overly broad privacy policies and service agreements will protect you.
Bad Lesson: It Doesn’t Pay To Be Vocal?
One bad lesson for companies out of this compare-and-contrast exercise is that stepping forward about changes actually may put you more on trial for than keeping fairly quiet.
Google seemed to make a real effort to inform its users in a variety of ways that a significant privacy change was coming. Its reward for this effort was widespread scrutiny.
Microsoft’s public “announcement” on a little-read blog hardly deserves to be called that. Instead, Microsoft really just spread the word to customers, who may not have understood what the change meant or passed over the messages entirely. Fair to say, Microsoft did little to help ensure news outlets caught the change. Microsoft’s reward was escaping the attention that Google got.
Privacy Bill Of Rights
I’ll end with how I ended my aforementioned You Don’t Need To Fear The Google Privacy Changes: A Reality Check article, my wishlist of what I wanted to see from Google, Microsoft and any major company that collects information:
A data privacy Bill of Rights from individual companies that clearly spells out in plain language what won’t be done with our data
A centralized, easy-to-understand set of controls to limit how data can be collected and used
Maybe the Obama Administration’s proposed Consumer Bill Of Rights will help in this, though I don’t think companies need to wait for that. Just as Google’s privacy policy was lacking the list of things it would not do, so is Microsoft’s policy. It would be nice to see both list what they don’t and won’t do.
As for Microsoft’s changes, they go into effect on Oct. 19. I’d point you to all those articles on what to do if you still want to use Microsoft services but don’t like the new agreement, but no one’s seemed to have written them. Maybe you could use Google instead?
Comments