## Facts

- Google operated Gmail and represented in posted privacy policies that it would use user information for specified purposes and would obtain consent before using the data for a new purpose.
- In February 2010, Google launched Google Buzz, a social-networking service integrated into Gmail.
- During Buzz’s rollout, Gmail users saw an introduction screen with options including “Sweet! Check out Buzz” and “Nah, go to my inbox.”
- The FTC alleged that some users who selected “Nah, go to my inbox” were still enrolled in certain Buzz features.
- For users who joined Buzz, the service automatically created “followers/following” connections based on the user’s most frequent Gmail contacts and publicly displayed those connections by default.
- The FTC alleged users were not adequately informed that frequent-email contacts would be publicly disclosed by default and that controls to decline, leave, or disable Buzz were ineffective.
- Google offered a “Turn Off Buzz” option, but the FTC alleged this did not fully remove users from Buzz and some enrollment persisted.
- The FTC cited thousands of consumer complaints about unwanted public exposure of relationships (including ex-spouses, patients, students, employers, and competitors).
- Google self-certified under the U.S.–EU Safe Harbor Framework and represented compliance with its privacy principles, including notice and choice for EU personal data.
- The FTC alleged Buzz’s implementation failed to provide the notice and choice Google had represented it would provide under Safe Harbor.

## Issues

1. Whether Google’s rollout of Buzz, in light of its Gmail privacy policy statements, materially misrepresented how user information would be used and disclosed, constituting deception under § 5 of the FTC Act.
2. Whether Google misrepresented the effectiveness of user choice mechanisms to decline, opt out of, or disable Buzz.
3. Whether Google’s Safe Harbor compliance representations were deceptive because Buzz practices allegedly conflicted with Safe Harbor notice and choice principles.

## Decision

- The FTC initiated an administrative action alleging deceptive acts or practices under § 5 of the FTC Act based on the Buzz rollout.
- Google entered into a consent order without admitting or denying the allegations.
- The FTC issued a final 20-year consent order on October 13, 2011.
- The order barred Google from misrepresenting the privacy or confidentiality of covered information and from misrepresenting compliance with the U.S.–EU Safe Harbor or similar privacy/security programs.
- The order required Google to implement and maintain a comprehensive, company-wide privacy program addressing privacy risks in product development and operations.
- The order required independent privacy audits every two years for 20 years.
- The order required affirmative express consent (opt-in) before sharing user information in ways that materially exceeded prior representations.

## Legal Principles

- Under § 5 of the FTC Act, privacy policies and public privacy commitments can constitute enforceable representations; materially misleading statements or omissions about data use or disclosure may be treated as deception.
- Claims of compliance with external privacy frameworks (including Safe Harbor) can be actionable when the firm represents compliance but its practices conflict with promised notice and choice standards.
- User-interface design, defaults, and opt-out functionality are relevant to deception analysis when they affect reasonable consumers’ understanding of enrollment, disclosure, and control.
- Structural injunctive relief in FTC privacy matters may include mandated privacy governance programs and long-term, independent assessments to prevent recurrence.
- Affirmative express consent may be required when a company intends to use or disclose information in a manner that materially differs from prior representations to users.

## Conclusion

The FTC resolved allegations that Google’s Buzz rollout contradicted its privacy and Safe Harbor representations through a 20-year consent order requiring no privacy misrepresentations, opt-in consent for materially different data sharing, a comprehensive privacy program, and biennial independent audits.


In re Google Inc., FTC File No. 102-3136 (F.T.C. 2011)