Following a public comment period that began in March of this year, the Federal Trade Commission has accepted as final a settlement with Google relating to the social network “Buzz” product that was launched in 2010.  (For more details about the Buzz product and its launch see Inside Privacy’s prior post, here).  As the Commission’s press release states, “The settlement resolves charges that Google used deceptive tactics and violated its own privacy promises to consumers when it launched its social network, Google Buzz . . . .”

The Commission voted 4-0  to approve the settlement, which imposes numerous requirements on Google, including:

  • Google is obligated to obtain independent assessments and reports on its privacy controls every two years for the next 20 years;
  • Google is barred from misrepresenting:  (1) the purposes for which it collects and uses consumer information and the extent to which consumers may exercise control over the collection, use, or disclosure of information; and (2) the extent to which Google adheres to any privacy, security, or compliance programs, including the U.S.-EU Safe Harbor Framework;
  • Prior to any new or additional sharing of certain user information with third parties that is: (1) a change from stated sharing practices at the time the information was collected; and (2) results from any change, addition, or enhancement to a product or service, Google must obtain “express affirmative consent” from the user; and
  • Google must develop a comprehensive privacy program that is reasonably designed to:  (1) address privacy risks related to the development and management of new and existing products and services for consumers; and (2) protect the privacy and confidentiality of certain consumer information. 

As the FTC noted in its March 2010 press release, “[t]his is the first time an FTC settlement order has required a company to implement a comprehensive privacy program to protect the privacy of consumers’ information.”  The settlement agreement also is notable for its requirement that Google obtain affirmative express consent under circumstances that are arguably broader than the Commission has required in the past.

Google recently announced that it would retire the Buzz product completely in the next few weeks.