Of course they knew technical professionals would be upset. That's why they are prepared and they all can react with a single voice.

They should have just put the new behavior in an extension and heavily promoted that to g-suite users.

There is a process where external launches need to be approved by a separate privacy team. If you're certain you can do a better job, you can find some listings on https://careers.google.com/ (just search for privacy).

I don't think that using this incident as a recruitment pitch is a good idea.

"Somebody should do a better job!" "Why don't you try yourself?" Seems like a somewhat reasonable train of thought. A lot of good things can come out of outrage, as long as people are willing to take action (no, I don't claim going through Google recruitment to be the optimal strategy, but it is an option)(I actually got my first job as a result of my technical complaints, obviously not in Google).

> "Somebody should do a better job!" "Why don't you try yourself?"

This argument makes sense when you're talking about a problem that one or two people control rather than a large system with higher stakeholders who may not have interests aligned with your own.

But I'll assume you're right for a sec. Let's assume that Google cares a ton about making sure their privacy policy is consistent, but it's just an insanely hard job and nobody could do any better.

Why does that matter? In that scenario, I still don't trust your privacy policy. I don't care whether it's inconsistent because people are incompetent or because the problem is hard. In either case, the privacy policy is unreliable. If I can't trust it in Chrome's case, how can I trust it in Gmail's case, or in Adword's case, or in any other product?

In a way, saying it's a hard problem is even worse. I would have felt better if you had come back and said, "oh, the Chrome team is just uniquely incompetent, but everybody else has got their stuff together."

My thinking is more in line of: if privacy team was bigger, it would intuitively have a way easier job keeping tabs on all the developments. However, that's a job without talent attractors like glamorous launches. When you're sailing smooth, nobody knows you exist. But when I mention they're hiring in an incident, I learn this is the wrong time to mention them.

But then again, I'm neither in privacy team, nor Chrome team, know no specifics of this case and can't really argue any position (note how I'm neither defending nor condemning the issue of OP). Just pointing out generalities that I don't see mentioned.

If Google's privacy team is understaffed or doesn't have enough resources to do its job, we should have a conversation publicly about that. I get where you're coming from, but Google isn't a company without resources. In this specific scenario, where there is an actual power dynamic at play, it's not enough to just say, "well, people should get involved." The people who get involved are not the people who are making long-term decisions about process.

If Google itself isn't acknowledging the problem, or worse, if Google is actively thwarting or working against its own privacy team, then anyone who gets involved will also end up starved for resources or moved to other teams. Google is not a level playing field for people who want to change the system from inside.

So it's not wrong at all for you to bring this up during an incident. But if we take the premise that this incident is the result of one of the largest companies in the world starving its own privacy team, not paying enough to attract talent, or not giving them enough input into internal processes... well, that's honestly something that needs to be discussed company wide. That's a very serious situation.

And if that's the case, users should be distrusting Google's privacy commitments until it has that conversation. The first step to fixing a problem is acknowledging the problem -- you won't get anywhere trying to fix a system that doesn't want to be fixed.

From the responses that have come out of Google regarding this incident, it doesn't sound much like it wants to be fixed. Changing that is the first step. Hiring people is the second.

By all means, let's talk about Google's privacy team. I am all for that. Let's get productive. But let's get actually productive. Let's have an open, public talk about management and resource allocation, and why the team is understaffed. From Google's AI/self-driving divisions, we know what it looks like when the company gets serious about attracting talent. And we know it has the resources to do so.

"How about you do it then?" works in volunteer situations where anyone can step up. That's not the Chrome team at Google.

Unless you are actually offering a job at Google, it's not a reasonable train of thought, it's a (somewhat pissy) cop-out.

Even if any of us was lucky enough to be hired, we'd still have to follow what the leads say and not rip out every bit of intrusion and data gathering in chrome (harder than I can imagine) less we get reassigned or sacked. I bet there are plenty of devs there who already have their reservations but for obvious reasons not publicly vocal about it or had their views dismissed for again obvious reasons.

I would no more work for Google than I would work for Facebook exactly because of their disregard for privacy, no matter what their policies may be.

Or you know a better option would be to use a competitors product.