I would make the advice more general: avoid dealing with Google.
Recently I had to install Hangouts app on the Android phone (it was easier than using it on desktop because I don't have the latest Chrome). One has to register a Google Account in order to use it, and I had to answer a lot of questions as if I was applying for a visa, including a phone number (of course I used a fake number) and date of birth. Then the app displayed a terms of service page with boring legal text. But I noticed that there was a small button to show more details, and when I clicked it, the page expanded and I saw checkboxes (lot of them), most checked by default, like "share my location with Google" or "record web & app activity". Of course, I turned all of them off and thought that I am smarter than a typical user that would not even see these checkboxes.
It turned out, I have been tricked too.
First, the Hangouts app somehow added this newly created account into all other Google Apps, so Google Play (which I have never used before) has started itself up and said that I need to update several apps (no, I don't) and then Mail App said that I got an email (this boring kind of email they put into your inbox upon registration). Also, Hangouts app added this new Google Account into the phone settings. And enabled sync for everything - including contacts.
Luckily, I mostly use phone as a dictionary and it didn't have any personal information - but if it had, it would be irreversibly copied into the Google Cloud.
These settings are not easy to find. For example, to learn about sync, you have to go to Settings -> Accounts -> click word "Google". Only then you will see that your data are being uploaded to Google. Google doesn't even give a warning, let alone asks you whether you really need it. To disable location tracking you need to notice a tiny button at terms of service page or find it at the settings. I am sure that most of users don't even realise that they've agreed to be under constant surveillance by Google.
I must admit, Google is good at sucking data out from people and deceiving them. After all, it employs smartest people on the planet.
This looks like a good reminder that Google isn't just a loose bunch of tools, they have developed a full integrated ecosystem.
If it's not what you want then it is overly intrusive and exceptionally hard to manage so you control just the functionality and personal security you want.
Most end users, I think, just want something to work and are happy for all the magic to just happen. When you embrace it a lot of what it does is very clever and very useful. Most people I know who have embraced it just find the integration fantastically useful and don't have most of the concerns the more technically aware people do.
But people that has embraced it but later finds themselves in a different situation in life, needing to hide from a previous spouse realises a bit late how much information is out there now. Just because you are paranoid doesn't mean someone isn't out to get you.
I find I can replace just about everything Google makes except for Google Docs & Google Sheets. I wish I could find self-hosted, open-source versions of those, which I would install on my own server. I can just use desktop apps and sync the files through my server with git or rsync when I'm the only user (but using multiple clients), but as you're saying about the general public, for sharing with friends and family, Google's solution works so much better....
Sorry I'm late getting back to this, but thanks for the suggestion. I hadn't heard of an online version of LibreOffice, so I'll definitely check it out. I really hope there will be a way to have the benefits of server-based word processors and spreadsheets without handing our private data to people whose business is profiling us.
I just went to create a google account to see for myself because this sounds egregiously bad. I think you are exaggerating quite a bit:
* Phone number is clearly marked as optional and it says they use it for security. (Of course, Facebook said the same thing, and look how that turned out...)
* The only information requests that I think are unnecessary are date of birth (they say because some services are age restricted), and gender (which "rather not say" is an option for).
* The page you are referring to is not really boring legal text, it's pretty plain English that is easy to understand, and there's not a lot of it. I think average people can read it easily in 1-2 minutes.
* The "location history" option is off by default.
* It is true that the options are in a "more options" folded thing at the bottom of ~2 pages of text. This sucks, but looking at the whole page in context, it's not nearly as bad as you made it sound.
> And enabled sync for everything - including contacts.
I think this only applies to new contacts created within your google account, and not local phone contacts. I learned this the hard way when my contacts did not sync from my old phone when I wanted them to.
> To disable location tracking you need to notice a tiny button at terms of service page or find it at the settings. I am sure that most of users don't even realise that they've agreed to be under constant surveillance by Google.
> Phone number is clearly marked as optional
This is not always the case, Google may arbitrarily decide to make it obligatory for you (if they find some "suspicious" pattern).
US law has some requirements on accounts created by minors which essentially means you must check the age for people creating new accounts, and you must not allow accounts for people < X years (but are not allowed to tell them up front).
I don't entirely understand where exactly this applies, i.e. why you can create accounts on some sites without giving your age. It might only apply in some telecommunication accounts cases, or maybe (possibly more likely), Google is one of the few companies subject to scrutiny here, so everyone else just flies under the radar.
> I don't entirely understand where exactly this applies, i.e. why you can create accounts on some sites without giving your age.
That law is called COPPA ("Children Online Privacy Protection Act"). It applies to sites dedicated to children (as per https://www.ftc.gov/tips-advice/business-center/guidance/com...). As Google uses one and the same account for all its services including YouTube, all Google accounts are potentially "dedicated to children" (YouTube IIRC has even a special section for videos suitable even for toddlers).
Interesting. There are many children who watch youtube that are younger than this. At the pediatric dentist they even had it playing on overhead TVs while they worked.
Are they really making a product that caters to very young children while claiming for legal purposes no children can use it?
No,children can use YouTube. However, the TOS prohibits them from making an account. A parent can set up an account, or they can use it without logging in.
That is because your IP has a good reputation. For me registering a Gmail Account from Firefox looks like this [1]. Note that the text is misleading (this is not for my security, this is to prevent bulk registration).
> date of birth (they say because some services are age restricted)
If the user is over 18 you don't really need the day and month, year is enough.
> The "location history" option is off by default.
Ok, I deleted Google Account from phone (with two scary warnings that some of my data will be deleted from the phone), deleted Hangout's cache, forced stop it and tried to repeat the registration again. I made screenshots for every screen. If anyone needs, I can upload all of them.
It is weird, but this time Google didn't require me to confirm a phone number while it requires a number if I use a desktop browser and it required a number previous time. The phone is connected to Internet via desktop, so it has the same external IP. This is suspicious and might mean that Google has recognised my phone.
Here's what I observed:
- Google warns that it can exchange my device info (IMEI?) with a phone company [2] if I enter my phone number. Do phone companies sell data to Google?
- Terms of usage are written in a plain language, but they are three screens long and important options are hidden behind a spoiler [3]. Note that the button is named "More options" instead of "Choose what I share" or "No, I don't want to share" or something like this. Google doesn't really want you to click it.
- By default, "Save web & app activity" is enabled [4], and it includes "searches and associated information, such as location and activity from sites, apps and devices .... like Chrome history, for instance...". I don't understand whether this really means that they collect my browsing history and location or they meant something else (like stats calculated from those data).
- Saving Youtube search and watch history is enabled by default [5]
- You are right, location and voice history are off by default
- Backup to Google Drive is enabled by default [6][7][8]. I don't understand what it does, and what Google means by "data". Does it include all files in /sdcard? That would be scary and I definitely don't want it. Also, I don't remember if I saw this previous time. I had to retry registration several times late at night, I was tired and I could accidentally forget to disable it which would explain why contacts sync was enabled. Maybe it was my fault. But I am not sure.
- Note that the description of "Backup to Google Drive" is hidden behind a spoiler
- I checked whether sync is enabled and couldn't really understand anything. One screen says "Sync is OFF" [9], but another says "Last synced on xxx.xxx" [10]
- In detailed Google Account settings I found out that Google will save "contact info of people I interact with in Google Products" [11]
So you were right about location history - it is disabled by default. But there are so many settings and it is so easy to forget to disable anything. I wish I could update original comment for clarity.
If you have Google Play installed (doesn't matter if you ever use it) then you'll also have Play Framework or whatever they call it, and that probably has permission to just about everything.
If you have an Android phone and don't trust Google then what their apps ask for seems a bit irrelevant - you've almost certainly already given them whatever you don't want them to have.
I had Google Play, but I didn't have Google Account set up on the phone. And it is not like I have much choice - iPhones are overpriced (I don't think is is a good idea to spend over $600-900 for just a phone) and even less open and I trust Apple as much as Google.
I trust Apple more when it comes to privacy, because there is hard proof they are more trustworthy. Note that I'm not saying they can be trusted 100%, but they are far, far better at protecting their users' privacy than Google. Of course, that's a given considering Google's entire existence is based on selling your information to advertisers, whereas Apple makes their money when you buy their hardware.
Honestly, there is no practical way to not end up in some company's database somewhere unless you eschew all 20th and 21st century tech, live in a cave, and forage for food. Even then you're bound to end up in a news story on the Internet if you're ever spotted, even if it's just Weekly World News talking about another Bigfoot sighting.
- I have rechecked and "Location sharing" is off by default, although "Share web & app activity" is on by default and it can include "searches and associated information, such as location and activity from sites, apps and devices .... like Chrome history, for instance..."
- I might accidentally forget to turn off "Backup to Google Cloud" when registering because I had to retry the registration several times and was tired. This would explain why sync was enabled. But I don't remember it clearly.
I recently talked with a peer about it and I was quite surprised. Googles move to log into chrome by default was just the tip of the iceberg what was already there. I never really noticed that google already is trying hard to merge/force all apps to run via a android login. While times have been fun and painless migrating to a new phone it is not what I asked for. It is even more worrying that google cripples their apps with this. I wonder if google one day turns unproductive when they have to untangle all that mess.
Because the location provider from Play Services is an alternative to having the GPS turned on and gives an approximate location. There are some replacements like this by Mapzen https://github.com/lostzen/LOST
Depending on where you live (like the US) your telco is happily selling of data. So unless you have your phone in airplane mode your location is out there.
Jesus that is such a god-awful dark pattern. It kinda breaks my heart to read this. I guess I'm locked into the iphone ecosystem for a while, despite their exorbitant prices. Sigh.
Also I have experimented a little and found something more. If I delete Google Account from the phone, force stop Hangouts, clear its cache and try to log in with that account again, Hangouts shows this screen [1] with "Back up to Google Drive" option enabled again.
I tried twice - and every time Google sets this option on by default even if I had disabled it previous time.
Of course, this might be not intentional - maybe the enable sync flag is not stored at Google server.
Recently I had to install Hangouts app on the Android phone (it was easier than using it on desktop because I don't have the latest Chrome). One has to register a Google Account in order to use it, and I had to answer a lot of questions as if I was applying for a visa, including a phone number (of course I used a fake number) and date of birth. Then the app displayed a terms of service page with boring legal text. But I noticed that there was a small button to show more details, and when I clicked it, the page expanded and I saw checkboxes (lot of them), most checked by default, like "share my location with Google" or "record web & app activity". Of course, I turned all of them off and thought that I am smarter than a typical user that would not even see these checkboxes.
It turned out, I have been tricked too.
First, the Hangouts app somehow added this newly created account into all other Google Apps, so Google Play (which I have never used before) has started itself up and said that I need to update several apps (no, I don't) and then Mail App said that I got an email (this boring kind of email they put into your inbox upon registration). Also, Hangouts app added this new Google Account into the phone settings. And enabled sync for everything - including contacts.
Luckily, I mostly use phone as a dictionary and it didn't have any personal information - but if it had, it would be irreversibly copied into the Google Cloud.
These settings are not easy to find. For example, to learn about sync, you have to go to Settings -> Accounts -> click word "Google". Only then you will see that your data are being uploaded to Google. Google doesn't even give a warning, let alone asks you whether you really need it. To disable location tracking you need to notice a tiny button at terms of service page or find it at the settings. I am sure that most of users don't even realise that they've agreed to be under constant surveillance by Google.
I must admit, Google is good at sucking data out from people and deceiving them. After all, it employs smartest people on the planet.