US law has some requirements on accounts created by minors which essentially means you must check the age for people creating new accounts, and you must not allow accounts for people < X years (but are not allowed to tell them up front).
I don't entirely understand where exactly this applies, i.e. why you can create accounts on some sites without giving your age. It might only apply in some telecommunication accounts cases, or maybe (possibly more likely), Google is one of the few companies subject to scrutiny here, so everyone else just flies under the radar.
That law is called COPPA ("Children Online Privacy Protection Act"). It applies to sites dedicated to children (as per https://www.ftc.gov/tips-advice/business-center/guidance/com...). As Google uses one and the same account for all its services including YouTube, all Google accounts are potentially "dedicated to children" (YouTube IIRC has even a special section for videos suitable even for toddlers).
Are they really making a product that caters to very young children while claiming for legal purposes no children can use it?
> Phone number is clearly marked as optional
That is because your IP has a good reputation. For me registering a Gmail Account from Firefox looks like this [1]. Note that the text is misleading (this is not for my security, this is to prevent bulk registration).
> date of birth (they say because some services are age restricted)
If the user is over 18 you don't really need the day and month, year is enough.
> The "location history" option is off by default.
Ok, I deleted Google Account from phone (with two scary warnings that some of my data will be deleted from the phone), deleted Hangout's cache, forced stop it and tried to repeat the registration again. I made screenshots for every screen. If anyone needs, I can upload all of them.
It is weird, but this time Google didn't require me to confirm a phone number while it requires a number if I use a desktop browser and it required a number previous time. The phone is connected to Internet via desktop, so it has the same external IP. This is suspicious and might mean that Google has recognised my phone.
Here's what I observed:
- Google warns that it can exchange my device info (IMEI?) with a phone company [2] if I enter my phone number. Do phone companies sell data to Google?
- Terms of usage are written in a plain language, but they are three screens long and important options are hidden behind a spoiler [3]. Note that the button is named "More options" instead of "Choose what I share" or "No, I don't want to share" or something like this. Google doesn't really want you to click it.
- By default, "Save web & app activity" is enabled [4], and it includes "searches and associated information, such as location and activity from sites, apps and devices .... like Chrome history, for instance...". I don't understand whether this really means that they collect my browsing history and location or they meant something else (like stats calculated from those data).
- Saving Youtube search and watch history is enabled by default [5]
- You are right, location and voice history are off by default
- Backup to Google Drive is enabled by default [6][7][8]. I don't understand what it does, and what Google means by "data". Does it include all files in /sdcard? That would be scary and I definitely don't want it. Also, I don't remember if I saw this previous time. I had to retry registration several times late at night, I was tired and I could accidentally forget to disable it which would explain why contacts sync was enabled. Maybe it was my fault. But I am not sure.
- Note that the description of "Backup to Google Drive" is hidden behind a spoiler
- I checked whether sync is enabled and couldn't really understand anything. One screen says "Sync is OFF" [9], but another says "Last synced on xxx.xxx" [10]
- In detailed Google Account settings I found out that Google will save "contact info of people I interact with in Google Products" [11]
So you were right about location history - it is disabled by default. But there are so many settings and it is so easy to forget to disable anything. I wish I could update original comment for clarity.
[1] https://i.imgur.com/5lqfvWc.png
[2] https://i.imgur.com/4KOYlFW.png
[3] https://i.imgur.com/Wy9ZCp8.png
[4] https://i.imgur.com/xsaKJ3e.png
[5] https://i.imgur.com/5InPwMQ.png
[6] https://i.imgur.com/jpq0GBj.png
[7] https://i.imgur.com/7XjfCst.png
[8] https://i.imgur.com/LEynSlX.png
[9] https://i.imgur.com/LepQPnZ.png
But if the user is 18, you need them. It would be a really weird UI if it changed this dynamically... I wouldn't expect anyone to implement that.
That's what it means. You can look at the data google is storing at https://myactivity.google.com/myactivity
* Phone number is clearly marked as optional and it says they use it for security. (Of course, Facebook said the same thing, and look how that turned out...) * The only information requests that I think are unnecessary are date of birth (they say because some services are age restricted), and gender (which "rather not say" is an option for). * The page you are referring to is not really boring legal text, it's pretty plain English that is easy to understand, and there's not a lot of it. I think average people can read it easily in 1-2 minutes. * The "location history" option is off by default. * It is true that the options are in a "more options" folded thing at the bottom of ~2 pages of text. This sucks, but looking at the whole page in context, it's not nearly as bad as you made it sound.
> And enabled sync for everything - including contacts.
I think this only applies to new contacts created within your google account, and not local phone contacts. I learned this the hard way when my contacts did not sync from my old phone when I wanted them to.
> To disable location tracking you need to notice a tiny button at terms of service page or find it at the settings. I am sure that most of users don't even realise that they've agreed to be under constant surveillance by Google.
This was off by default for me.