MoDaCo and several other gadget blogs have recently begun leaking details of the HTC One X or Endeavor, an ultra-skinny Android 4.0 device, which could be the world’s first smartphone to contain Nvidia’s Tegra 3 quad-core processor. The news vaulted HTC to the upper echelons of Twitter chatter, according to anly.tk, generating nearly 5000 tweets with MWC-related hash tags last week.

HTC recorded about 12 percent of the 38,427 MWC-tagged posts, so buzz surrounding the show is definitely becoming more dispersed since we last reported on anly.tk’s numbers. Samsung, LG and Nokia all made good showings.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Tablets wars: Apple is from Venus, Amazon is from Mars
• The future of mobile: a segment analysis by GigaOM Pro
• Sector RoadMap: Social customer service in 2013

Updated: Path and Pinterest are probably two of the hottest social services right now, racking up millions of users and generating an ocean of favorable coverage. But both have gotten tripped up by the same thing that has made the social web a minefield for both Facebook and Google: namely, decisions that put their interests ahead of their users and a lack of disclosure about what was going on behind the scenes or under the hood of their services. Will these missteps spell doom for either company? Probably not. But the backlash is a welcome reminder that for social apps, the trust of users is not something to be toyed with.

Path, a mobile photo-sharing app that expanded to become a full-fledged mobile social app when it relaunched a couple of months ago, was co-founded and is run by Dave Morin, an early Facebook staffer. You might think the privacy blowups that the giant social network has experienced over the past couple of years would make Path pretty sensitive to handling user data properly, but that doesn’t seem to be the case: Earlier this week, controversy erupted when it was revealed that Path was uploading all of its users’ contacts to the company’s servers, something many users have taken as a breach of their privacy.

It may not seem like a big deal, but you should still disclose it

In public comments on the blog post that first brought this to light, Morin apologized and said that Path will fix the problem in an upcoming version by requiring users to explicitly opt-in. He also tried to defend the company’s behavior by saying that it is the “industry best practice.” As a commenter on the Hacker News thread about the issue put it, however, a better phrase might be “industry lowest common denominator.”

Update: Path’s CEO later apologized in a blog post for the way the service handled users’ data, and has said that in an attempt to make up for its mistake it has deleted any address data that was stored on its servers.

It is true that other apps and services also do this, including WhatsApp, Beluga, Hipster and others, and the ability to do so has been a part of Apple’s iOS since 2008. Others have also noted in Path’s defense that Apple allows apps to upload contacts without explicitly asking users for permission – something that it doesn’t do for other data such as a user’s location. And it is also true that importing a user’s address book makes it a lot easier to scan for friends who are already on Path and that this can be a benefit for a user in the long run.

That said, however, the anger and shock that Path’s move seems to have triggered among many users — some of whom say they have deleted the app and will never return — makes it pretty clear that even if this behavior has benefits for users, the lack of disclosure about what Path was planning to do is a deal breaker for many.

Pinterest, meanwhile, did something completely different to upset some of its users, but the underlying lesson is the same: The company — which says it has built up a massive user base of more than 10 million in just two months — is a content-sharing service where fans of different products and websites can post (or “pin”) their favorites. Since popular posts can drive a lot of traffic to websites that sell these products, Pinterest has been adding affiliate links that generate revenue for the site when users click on them.

Lesson: Never take your users for granted

As many of the company’s defenders have pointed out, this behavior makes a huge amount of sense for Pinterest, since it is providing a free service and needs to generate revenue somehow. But as with Path’s move — which also makes a lot of sense from a purely utilitarian point of view — Pinterest failed to disclose what it was doing to users or at least failed to make it obvious. Perhaps the company thought (as Path likely did) that users wouldn’t mind. But it turns out that plenty of them do mind.

Path’s decision seems the more surprising of the two, if only because there are so many examples of similar undisclosed or opt-in-by-default moves that have triggered a huge amount of backlash, and not just for Facebook but for Google as well. The search giant’s engineers also clearly thought that merging people’s email contact lists with their new Buzz service was a great idea — after all, it was the most efficient way to populate a user’s follow list. But many users disagreed, and so did the federal government, and the resulting backlash arguably helped kill Google’s first attempt at a real social service.

The lesson here is that for social apps, the trust of users is paramount, and the best way to maintain that trust is to be as open as possible about everything that is occurring, particularly if it involves a user’s personal data. Whatever you are doing with it may not seem like a big deal to you, but better to be open about it than have it revealed by someone else, at which point you look sneaky. As Craigslist founder Craig Newmark has put it, “Trust is the new black,” and it never goes out of style.

Post and thumbnail photos courtesy of Flickr users Lars Plougmann and Christian Ditatompel

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Sector RoadMap: Content personalization in 2013
• Takeaways from mobile’s second quarter
• Social media in Q1: commerce and discovery dominated

The iPhone 4S’s lead in terms of buzz is measured by the number of times it gets mentioned on blogs, message boards and groups, Twitter, Facebook and posts at online news sites. Nielsen used a list of the top 20 recently acquired smartphones from the third quarter of 2011, and a few popular ones released late, including the Google Android-powered Samsung Galaxy Nexus and iPhone 4S. The iPhone 4S grabbed 40 percent of all mentions in terms of devices on the list.

The 4S wasn’t the only iPhone mentioned in the list, however. The iPhone 4 and the iPhone 3GS also nabbed a lot of attention in online published items, resulting in Apple’s phones making up almost two-thirds of all mentions of smartphones in the six-month period covered by the NM Incite study. Combined Android phones, including the Galaxy Nexus and Droid Bionic were responsible for a quarter of the buzz, while BlackBerry devices came in third with a combined 10 percent.

This study shows that Apple’s iOS smartphones still command an impressive percentage of media and consumer mindshare when it comes to connected mobile devices, despite Android-based handsets pulling far ahead in terms of worldwide market share according to recent counts.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected world: the consumer technology revolution
• CES 2012: a recap and analysis
• 12 tech leaders’ resolutions for 2012

In the 1986 cult sci-fi movie Highlander, the immortals had to kill each other off in order to absorb their opponent’s energy and become the leader of the clan. On Friday, Google took the same approach to its social efforts, nuking a number of different projects — including the ill-fated Buzz network, a service called Jaiku, and the social elements of the iGoogle platform. In a post on Google+, Brad Horowitz said that the company had learned a lot from its efforts but needed to focus its energy more, and it seems obvious that Google+ is to be the only one remaining on the Google battlefield. But has the web giant really learned that much from Buzz and Jaiku?

Like more than a few others who wrote about the news, I confess that I thought Jaiku (which Google bought in 2007) had already gotten the axe a long time ago. The idea of the service was very similar to Twitter and other services that sprang up around the same time, such as Plurk and Pownce: Users could create a stream of personal information that could be shared with others, which was called a Lifestream. There are obvious similarities between that and what Google+ does — and Google+ also appears to be making use of open APIs to connect with other services, which was one of the things that Jaiku did well.

Buzz, meanwhile, was Google’s first big attempt at a social network that would integrate with other services, a kind of follow-up to Wave — which seemed more like a science project than a real service, and never seemed to get much traction with users. While it may have had some interesting elements to it, Buzz was effectively kneecapped by a number of early stumbles such as poorly communicated settings, which many users took as an invasion of privacy — including a woman who had her abusive ex-husband added to her Buzz network automatically, something that seems like a pretty obvious flaw.

Easy lessons: people want to share, but privacy matters

It’s easy to see some of the lessons that Google might have learned from these two experiences: namely, people like to share information with others, the “activity stream” approach is becoming more and more popular, and you should be careful when you are merging two different aspects of people’s lives — their social network and their email network, which aren’t always the same thing. In terms of insights about the social web, however, these conclusions aren’t exactly rocket science.

But other things seem to have escaped the company when it comes to how people use social networks — and more importantly, *why* they use social networks. Google+ may have 40 million users, but as I’ve argued before it still doesn’t seem to have anything compelling that makes it different from Twitter and Facebook and the other social networks that people are already using. Why would they switch and make Google+ their only network? In some ways it is actually worse than these other networks: for example, Twitter doesn’t care what your “real” name is, but Google has spent a lot of time and effort forcing people to use their legal names, and irritated a lot of users in the process.

Is that because Google wants to be social, or is it because the company wants to be able to including being able to sell you things? The existence of Google+ seems to have more to do with the company’s need to harvest the “social signals” that emerge from such networks in order to improve its search and advertising business — and fend off Facebook — than Google’s desire to create a welcoming environment for social sharing. An engineer for the company described not that long ago how Google has no real interest in social networking for its own sake, but saw it as an information-harvesting strategy.

Does Google have an “if we build it, they will come” problem?

Another Google engineer wrote a post earlier this week (one that appears to have been made public accidentally), and took dead aim at the company’s failure to appreciate how platforms — and particularly social platforms — work, and what is required to make them a success. Steve Yegge said that Google suffers from an “if we build it, they will come” approach to designing such services, and tries to give users what it thinks they want, instead of watching what users do and then making it easier for third-party developers to give them what they want. As he put it:

Google+ is a knee-jerk reaction, a study in short-term thinking, predicated on the incorrect notion that Facebook is successful because they built a great product. But that’s not why they are successful. Facebook is successful because they built an entire constellation of products by allowing other people to do the work.

The amount of resources that Google is putting into Google+ is admirable, and it is good to focus on one thing, even if it means beheading other services like Buzz and Jaiku — and CEO Larry Page has made it clear that he wants the network to succeed. But wanting something and having it come true are very different things, and Google could well learn another lesson from Google+: that even if you build it, and it is well-designed from an engineering perspective, people may still not come.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Social media in Q1: commerce and discovery dominated
• Google doesn’t like walled gardens — except its own
• Controversy, courtrooms and the cloud in Q1

Publishers will love +1, but what about people? When Google makes available the “+1″ buttons for publishers, there will be significant incentive for publishers to add the buttons since it will add critical SEO value to the URL. Google may use this data to rank results, but even if it doesn’t, users will be influenced by the number of +1′s displayed in search results when they decide what to click. I believe that unlike the failed “buzz” button, which never got traction with publishers, the +1 button could be very attractive.

Thus, the hurdle for +1 lies not with publishers but with consumers. To be successful, Google needs people to click +1, but that’s a harder task than it may expect. Consider the Facebook “Like” button. People click “Like” not because they want to contribute to an object or company’s ranking, but because they want to show off their association. “Liking” something broadcasts an association with content or products to your feed and therefore your friends. So with no opportunity to show off, Google may get no clicks. But there is a way for Google to help achieve a critical mass of +1 data that doesn’t require a user actually clicking +1.

Here’s how: Social Sign On – an identity play. When a user authenticates with a site by using their Google credentials, giving permission to that site to access their profile information and social graph, that act is a “+1 equivalent action”, and should be treated as such by Google. And Google can build this into the social sign-on process explicitly; I’ve illustrated one option in the graphic to the right.

Identity as the Foothold for Google’s Social Play

Increasingly, sites are enabling users to sign-in with their existing identity on social networks or other providers. Look at the Huffington Post and other publishers like Fox News, CBS and ABC. It’s clear that users prefer to sign-in using an established online identity rather than create a new one on each site they visit. Passwords are dead.
Currently, no identity provider is as popular as Facebook among B2C websites. More than 1M sites enable Facebook for sign-in. The reason Facebook is so popular among websites (as compared with OpenID or other solutions), is that there is real value for the website associated with that Facebook sign-in.

Whenever users sign-in to a site with their Facebook identity, Facebook provides the site with rich user profile data. This type of connection also enables frictionless sharing, which results in more traffic to the site. Yes, Google provides APIs for sign-in, but currently they do not provide enough value — data or otherwise — for websites. As a result, there is insufficient adoption across websites of Google Social Sign-on. With the wide Facebook Connect adoption by websites, people began to use their Facebook identity across the Internet far more often than their Google identity.

So Google needs a killer value proposition for sites to drive adoption of sign-in with Google. To provide one, it needs to continue to leverage its most sacred asset – search. When a user signs-in to a website with Google, over some number of days, Google should give higher weight to results coming from that site for that specific user. It makes sense that if I read articles at cbsnews.com, that site’s results will appear in my news searches above other news sources. Because Search is such a critical source of traffic channel for most websites, sites would implement Google sign-in tomorrow if it meant that their page rank would increase for users who use Google to sign-in into their site.

This could also be the first olive branch from Google Search to websites. For too long SEO has been a black hole for sites that never know when changes in algorithms could adversely affect them. It would be good for Google’s relationship with sites to collaborate with them, giving them a white-hat way to improve search result relevance.

What’s in it for Google? Being one of the leading identity providers gives Google permission-based access to user data that will enrich any service it offers – from search to commerce to social. Google is the leading search engine, but how loyal are its users? Identity can equate to commitment. Having a strong play in identity is Google’s key to building a long-term relationship with its users while increasing the value of Google services to websites Pleasing both parties will put Google well on its way to creating a defensible position in social.

Rooly Eliezerov is co-founder and product strategist at Gigya, a SaaS company providing technologies that make websites social.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Google doesn’t like walled gardens — except its own
• Will Games Help Google Figure Out How to Be Social?
• How social discovery is transforming entertainment

Instagram has gotten a lot of attention for growing to 300,000 users in a matter of weeks, but a new cross-platform chat application called Kik makes Instagram’s torrid growth pale by comparison. Within just two weeks of its release on October 21, the app had signed up over one million users, and co-founder and CEO Ted Livingston says that based on its current rate of growth, the company will likely cross the 2 million mark by tomorrow. But even as he is celebrating — and trying to cope with — all of that growth, Livingston is having to apologize for the way Kik got there, which involves a somewhat sneaky method some would call “email harvesting.”

When you sign up for the service on your iPhone or BlackBerry, it automatically ingests your contacts from the device and then cross-references that against the Kik user database. It doesn’t ask you first, which is a privacy faux pas. Kik users are then pinged by the service with messages saying “You may know…,” with the user name of someone who matches a name in their contact list. Livingston stressed in an interview with me that the service doesn’t auto-add anyone, and doesn’t store any of the information, but only uses it once and then discards it. But the feature has still made some people nervous — and is probably against Apple’s terms of service.

“We really just wanted to make it as easy as possible for users to get started, and to find people they might know,” the Kik co-founder says. While understandable, this is the same rationale that Google used when it launched Buzz, and auto-populated people’s Buzz contacts with everyone from their email address book — something that caused a huge outcry from privacy advocates as well as a lawsuit that Google recently settled. Livingston says that Kik doesn’t make public any user information other than a user name, and doesn’t send other users anything but your Kik contact info, but he admits that not asking for permission before ingesting people’s contacts was a mistake. If anything, it sounds like the young startup was so eager to launch that it simply forgot that some people might not like this approach.

“We feel really, really bad about that, and we have apologized across the Internet for doing that,” the Kik co-founder said. “And we have a fix ready for upload, just as soon as Apple approves it, that will allow people to opt out of that feature. It will be crystal clear.” Livingston also added that the company has gotten a lot of feedback from users who love the fact that Kik connected them with people they knew who were already using the service. “It’s a very small subset of people who don’t like it,” he said. And the auto-suggestion feature has likely played a huge role in helping Kik go viral so quickly, unlike some social services (Apple’s Ping, for example) that require you to add people manually.

In an interesting twist, Kik didn’t start out trying to create a chat application. Livingston says the startup was originally focused on a music-sharing service that allows any cellphone user to take control of any web browser and play music or videos through it. The Kik co-founder says that service should be ready to roll out soon, once negotiations with record companies are complete, but while the company was waiting, the founders decided to use the platform they had built to experiment with a dead-simple chat application, and Kik was the result.

“There are three parts of texting that most people hate,” he said. “It is unreliable, it is slow and it’s expensive.” There are other companies that have focused on making it free, says Livingston — including Pingchat, which shares office space with Kik at a startup accelerator in Waterloo, Ontario — but “we wanted to make it blazingly fast and reliable.” So Kik shows you when someone has received your message, when it has been read, and even when someone is typing a response. And the response has been incredible, Livingston says: the service has been adding more than 200,000 users a day for the past week or more, and had to fly new servers in to beef up the data center it uses because of the demand.

Related content from GigaOM Pro (sub req’d):

• How to Make Google Matter in Social Media
• Will Games Help Google Figure Out How to Be Social?
• Why Google Should Fear the Social Web

Remember Google Wave? Before Buzz came along, Google Wave was the hot new social networking feature from the world’s largest search company. It launched with much fanfare at Google’s I/O conference last May, but has since failed to get much traction, in part because no one could figure out what, exactly, to do with it. Then in February, along came Buzz, which grabbed the spotlight from its Google cousin, in part because of the furor that arose over the service’s approach to privacy. Now Google Wave is rolling out a feature that it clearly hopes will catch the imagination of some web users and maybe jump-start Wave’s popularity.

The new feature allows users to add a bookmarklet to their browser that will create a new Wave from any web page, embedding a link inside the Wave so that other users can discuss it. If the page contains a video or image, that will be embedded as well — in a playable format, in the case of videos — so that users can check it out before discussing it. And Google has also provided web designers with an easy way to add “Wave This” buttons to their pages, and/or to produce clickable URLs that will generate a new Wave discussion.

Whether this new feature will bring in any new users for Google Wave is difficult to say. So far, the service’s biggest problem seems to be a lack of awareness that it even exists — since the initial attention around the launch died down, there has been little or no public discussion of the service (although it does have its fans), and Buzz has drawn much of the attention given to social networks at Google. Wave has been invite-only until recently, however, and if the Wave This button starts showing up all around the web, it’s possible that it might get more popular interest. But then Buzz is fighting that battle too, and the king of the hill at the moment is Facebook and its global “like” button. There may not be much room left for Wave to capture a lot of social mindshare.

Related content from GigaOM Pro (sub req’d): Google’s Social Scheme Hinges on Fears, Not Fortunes

Google Buzz may have stumbled out of the gate with some features that users really didn’t like (such as auto-following all your email contacts whether you wanted it to or not), but to its credit it fixed those issues quickly and has been on a roll ever since, adding an average of a feature every week since it launched in February. The latest, which was made available today, is a “reshare” button similar to the one that blogging tools like Tumblr have. It’s also a little like the “retweet” function in Twitter, although Buzz has taken its sharing feature in a somewhat different direction, based on feedback from beta testers.

Google Buzz product manager Todd Jackson said in an interview that the ability to reshare someone else’s post has been one of the top user requests since launch, but has also been “probably the most debated feature on the Buzz team of any feature I can recall us doing,” because of all the various usability questions. Resharing may not seem like that complicated an idea, but it is. For example, there was the question of whether to “fork” the conversation when someone reshared something or not — in other words, whether to create a separate, new conversation starting with the item that was being reshared, or whether to connect it to the existing conversation that started with the original posting.

Twitter caused a minor storm of criticism among users when it made a similar decision about retweeting, an informally developed practice that involves the use of the letters RT before a tweet and then, in many cases, adding an additional comment to the original item. When it came up with its own retweet function, Twitter chose to not allow any comments to be added, and also showed the original tweet, along with the original poster’s avatar, to the followers of the person retweeting it, even if they didn’t also follow that person.

That led to complaints from users about tweets from random strangers suddenly appearing in their stream, something Jackson said he wanted to avoid. As a result, Buzz makes the reshared item a new item on its own, and only shows it to those who follow the re-sharer (although Jackson said that some users have asked for the alternate option, and Buzz may allow that in the future). The Buzz reshare function also allows users to add their own comments, and makes it clear that they are resharing it, with a link to the original Buzz user’s post. The original author sees a list of who reshared his or her item, something Jackson says he hopes will also act as a “discovery mechanism” for new users of the service to find other people worth following.

Jackson also said that the feature most users complained about the most when Buzz launched — the auto-following of email contacts — was an attempt to make it easier for new users to find people worth following, which he said is an issue that any new social network has. It turned out to be a bad idea, however, particularly for people who had contacts in their email address book they didn’t want to follow, or make public. The Google Buzz product manager admitted that this was a mistake, but says the intention was to make the service easier. “I wish we had gotten it right from the initial launch,” he said. “It was clearly the wrong idea. But we worked really hard to fix it.”

The number of active users of the site is growing rapidly, Jackson said, although he wouldn’t provide any figures (Google defines an active user as anyone who checks in more than once a week). He also said the number of users who check their Buzz more than 10 times a day is growing, a group he referred to as “hyper-active.” It’s this group that the Buzz team looks at most closely, he said, because they’re power users and the ones most likely to evangelize the service. Google also assumes that their behavior is going to become more mainstream over time.

Buzz also now has a group of several thousand volunteer beta testers who get access to new features before they’re rolled out across the service. Among the features that have been added since launch are a Buzz API (launched last week), Buzz sharing buttons, improved comment collapsing, a Buzz layer in Google Maps and the ability to get Buzz items in your inbox. And Jackson says he plans to stick to the schedule of at least one new feature a week.

Related content from GigaOM Pro (sub req’d): Why New Net Companies Must Shoulder More Responsibility

Updated: Privacy authorities from 10 countries this morning released a joint letter at a conference in Washington, D.C., that takes Google to task over the way it released its social tool, Google Buzz, saying the launch “betrayed a disappointing disregard for fundamental privacy norms and laws.” The group also said that the privacy problems associated with the new service, which went live in February, should have been “readily apparent” and that it isn’t the first time the company has “failed to take adequate account of privacy considerations when launching new services.” The letter noted that Google’s Street View service has also been the subject of privacy-related complaints from multiple countries.

In an emailed response, a Google spokesperson said: “We try very hard to be upfront about the data we collect, and how we use it, as well as to build meaningful controls into our products. Of course we do not get everything 100% right — that is why we acted so quickly on Buzz following the user feedback we received. We have discussed all these issues publicly many times before and have nothing to add to today’s letter.”

The letter — the full text of which is below — was signed by the heads of data protection authorities in Canada, France, Germany, Ireland, Israel, Italy, the Netherlands, New Zealand, Spain and the United Kingdom. The group is scheduled to hold a press conference later today in Washington about the statement, which called on Google “like all organizations entrusted with people’s personal information, to incorporate fundamental privacy principles directly into the design of new online services.” The fundamental problem with Buzz is described this way:

Google Mail, or Gmail, had been a private, one-to-one web-based e-mail service, but was abruptly melded with a new social networking service. Google automatically assigned users a network of “followers” from among people with whom they corresponded most often on Gmail, without adequately informing those users about how this new service would work or providing sufficient information to permit informed consent. These actions violated the fundamental, globally accepted privacy principle that people should be able to control the use of their personal information.

This joint effort by multiple countries is only the latest in a series of attacks Google has faced over Buzz. Not long after the new service was launched in February, the Electronic Privacy Information Center asked the FTC to open an investigation into privacy concerns surrounding Buzz, and that was followed in March by a similar request from a bipartisan group of lawmakers from the House of Representatives. Although Google CEO Eric Schmidt has said that “no one was harmed” by Buzz, project manager Todd Jackson later apologized for the way the product was launched, and the company has made a number of alterations to the way it functions, including a new confirmation screen for users so they can confirm what they wish to share and with whom.

Privacy concerns have also dogged Google in Europe, where Street View has come under fire from European Union regulators as well as privacy authorities in a number of countries such as Germany. Some authorities want the company to provide better notice to citizens of when the Street View car will be filming them, as well as a way for individuals to have themselves removed from the snapshots after they’re taken. Google has also faced serious repercussions in Italy, where three senior Google executives were found guilty in February of breaching Italian privacy regulations as a result of a video that was uploaded to YouTube.

The privacy regulators who released the letter today were meeting in Washington for the annual global summit of the International Association of Privacy Professionals.

Update: On a related note, Google today launched what it is calling a “government requests” tool, which shows where and when the company has been asked by the governments or authorities in various countries around the world to remove data or (in some cases) to provide information about users. Google says the tool is designed to provide “greater transparency” around these kinds of requests, which it notes in some cases are perfectly legitimate.

The full text of the letter to Google follows:

April 19, 2010

Mr. Eric Schmidt
 Chairman of the Board and
 Chief Executive Officer
 Google Inc. 
Mountain View, CA 
USA 94043

Dear Mr. Schmidt:

Google is an innovative company that has changed how people around the world use the Internet. We recognize your company’s many accomplishments and its dramatic impact on our information economy. As data protection regulators mandated to protect privacy rights, we also applaud your participation in discussions in many jurisdictions about new approaches to data protection.

However, we are increasingly concerned that, too often, the privacy rights of the world’s citizens are being forgotten as Google rolls out new technological applications. We were disturbed by your recent rollout of the Google Buzz social networking application, which betrayed a disappointing disregard for fundamental privacy norms and laws. Moreover, this was not the first time you have failed to take adequate account of privacy considerations when launching new services.

The privacy problems associated with your initial global rollout of Google Buzz on February 9, 2010 were serious and ought to have been readily apparent to you.

In essence, you took Google Mail (Gmail), a private, one-to-one web-based e-mail service, and converted it into a social networking service, raising concern among users that their personal information was being disclosed. Google automatically assigned users a network of “followers” from among people with whom they corresponded most often on Gmail, without adequately informing Gmail users about how this new service would work or providing sufficient information to permit informed consent decisions. This violated the fundamental principle that individuals should be able to control the use of their personal information.

Users instantly recognized the threat to their privacy and the security of their personal information, and were understandably outraged. To your credit, Google apologized and moved quickly to stem the damage.

While your company addressed the most privacy-intrusive aspects of Google Buzz in the wake of this public protest and most recently (April 5, 2010) you asked all users to reconfirm their privacy settings, we remain extremely concerned about how a product with such significant privacy issues was launched in the first place. We would have expected a company of your stature to set a better example. Launching a product in “beta” form is not a substitute for ensuring that new services comply with fair information principles before they are introduced.

It is unacceptable to roll out a product that unilaterally renders personal information public, with the intention of repairing problems later as they arise. Privacy cannot be sidelined in the rush to introduce new technologies to online audiences around the world.

Unfortunately, Google Buzz is not an isolated case. Google Street View was launched in some countries without due consideration of privacy and data protection laws and cultural norms. In that instance, you addressed privacy concerns related to such matters as the retention of unblurred facial images only after the fact, and there is continued concern about the adequacy of the information you provide before the images are captured.

We recognize that Google is not the only online company with a history of introducing services without due regard for the privacy of its users. As a leader in the online world, we hope that your company will set an example for others to follow.

We therefore call on you, like all organisations entrusted with people’s personal information, to incorporate fundamental privacy principles directly into the design of new online services. That means, at a minimum:

• collecting and processing only the minimum amount of personal information necessary to achieve the identified purpose of the product or service;

• providing clear and unambiguous information about how personal information will be used to allow users to provide informed consent;

• creating privacy-protective default settings;

• ensuring that privacy control settings are prominent and easy to use;

• ensuring that all personal data is adequately protected, and

• giving people simple procedures for deleting their accounts and honouring their requests in a timely way.

In addition to respecting these broad principles, we also expect all organisations to comply with relevant data protection and privacy laws. These laws apply online, just as they do in the physical world. As well, we encourage organisations to engage with data protection authorities when developing services with significant implications for privacy.

As your users made clear to you in the hours and days after the launch of Google Buzz, privacy is a fundamental right that people value deeply.

As regulators responsible for promoting and overseeing compliance with data protection and privacy laws, we hope that you will learn from this experience as you design and develop new products and services.

We would like to receive a response indicating how Google will ensure that privacy and data protection requirements are met before the launch of future products.

Sincerely,

Original signed by
Jennifer Stoddart Privacy Commissioner of Canada

Original signed by
Alex Türk
 Chairman, Commission Nationale de l’Informatique et des Libertés (France)

Original signed by
Peter Schaar
 Commissioner, Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (Germany)

Original signed by
Billy Hawkes 
Data Protection Commissioner of Ireland

Original signed by
Yoram Hacohen 
Head of the Israeli Law, Information and Technology Authority

Original signed by
Francesco Pizzetti
 Garante per la protezione dei dati personali (Italy)

Original signed by
Jacob Kohnstamm
 Chairman, College Bescherming Persoonsgegevens (Netherlands)
Chairman, Article 29 Working Party

Original signed by
Marie Shroff 
Privacy Commissioner, New Zealand

Original signed by
Artemi Rallo Lombarte
 Director, Agencia Española de Protección de Datos (Spain)

Original signed by
Christopher Graham
 Information Commissioner and Chief Executive (United Kingdom)

Related content from GigaOM Pro (sub req’d):

Why New Net Companies Must Shoulder More Responsibility

Post and thumbnail photos courtesy of Flickr user Blyzz