To briefly state the obvious, the Internet giants are seriously big: Google is not only the world’s largest search engine, it is one of the top three e-mail providers, a social network, and owner of the Blogger platform and the world’s largest video site, YouTube. Facebook has the social contacts, messages, wallposts and photographs of more than 750 million people.
Given that such information could be used to sell us stuff, accessed by government or law enforcement bodies (perhaps without warrants, under legal changes), or — theoretically, at least — picked up by hackers or others, it is not unreasonable to wonder exactly how much the Internet giants know about us.
US users of the sites are out of luck: There is no legal right under US law to ask a company to hand over all the information it holds on you. Users do have some say in how much companies are allowed to take, usually contained in the terms of service. However, EU citizens are in a better position — under Europe-wide data protection rules, anyone can send a written request for their full data and, for a small fee, the company has to ship it out, usually within 40 days.
It is a great chance to see exactly how much Google and Facebook really know about us, and all we need is a test subject. Perhaps an EU citizen who’s been on Facebook since it came to the UK in 2005; who’s had a YouTube account almost as long; and was on Gmail back when invitations to the service were something to beg, borrow and steal, rather than a nuisance. They would also have to be enough of an idiot to write about what they dig up in public. This left one obvious, unlucky test case in the Guardian offices: me.
Things didn’t get off to a great start with Google. The company has a main US branch, Google, and subsidiaries within other countries. In the UK, that’s Google UK. Here’s the catch: Google UK, which is subject to the EU rules that let you access your data, doesn’t hold it. A spokeswoman for the UK regulator, the Information Commissioner’s Office, confirmed that EU laws on subject access requests do not extend to the US parent company.
Thankfully, Google isn’t totally unhelpful. It has two tools that help show the information it holds on you. The first, Google Dashboard, has run for about three years and gathers information from almost all of Google’s services in one place. Another feature, the account activity report, was launched recently, and shows Google’s information on my logins in the past month, including countries, browsers, platforms and how much I’ve used the services. Running these tools on my work e-mail account (the Guardian’s e-mails are managed by Google) is disconcerting. The dashboard can see I’m a member of a few internal Google groups and have a blogger account used to collaborate with some researchers on Twitter riot data.
Data showing my work Gmail account has 877 contacts — and listing them — gives me some pause for thought, as does a list of the 398 Google docs I’ve opened. The site also lists my most recent sent and received e-mails.
A little more disconcerting is a chat history logging 500 conversations with 177 colleagues. Google chat is a handy way to collaborate in a large building, especially one full of journalists who seem to prefer to talk online (as Twitter activity testifies) rather than in the flesh.