"The Electronic Communications Privacy Act (ECPA) is 25 years old next week. It's outdated and doesn't protect people's information," says Rebecca Jeschke, EFF digital rights analyst, pointing to the need for updated law on digital surveillance. She's glad to see Google as a key part of the group Digital Due Process Coalition, which includes technology companies, civil rights organizations and academics seeking to update ECPA to provide privacy protections to newer technologies.
Some ideas for that include requiring the government to first get a search warrant before it can track the location of a cell phone or other mobile communications device, or require the government to demonstrate to a court that data they seek in monitoring of any communications medium is relevant and material to a criminal investigation.
But Jeschke notes this doesn't explain what Google itself might be doing for its own benefit with personal data it can collect.
"Google has a huge reach. We all use Google every day," she says. "Google has a ton of information about you. All that information is collected and can be linked to each other." She adds: "The fact that it's there is worrying. It's a honeypot for all sorts of people — marketers, civil litigants, law enforcement."
Google tries to be transparent about its collection practices through its online "Privacy Center" and "Privacy FAQ." And Cerf says Google does hold onto what Web searches are made based on IP address but "the IP address doesn't bind to a person." He says Google does not keep files on individuals for data collection purposes. And when it comes to business practices with third parties, any data that Google does share is done so on an anonymous basis.