As someone who works with Google partners and partnering with Google's data, we see a lot of personal data in it.
You simply might be someone that doesn't work with such data. I do and we use a lot of it and it gets very personal.
I didn't say that we don't store any personal data. That's ridiculous. Of course we store SOME personal data.
I said that we hardly store any data that we receive. Of what we store, we hardly store anything longer than 30 days. It's important to note that we receive an UNIMAGINABLE amount of data. Even a small fraction of a small fraction of that is still unimaginable amounts of data.
I don't know anything about our partnerships. I didn't say anything about that.
What does this mean? Are you reading people's depressed love poems and looking at pictures of their exes?
After you learn that I'm into fitness (or vice versa) and manage to serve me an article in a news feed and direct me to a health blog (served by Google ad sense), then job of the data is done.
Anything derived from PII is also PII unless it is anonymized by aggregation. Everything that is PII is aggressively TTL'd from the time of its collection from the user. The privacy review team knows what they're doing and won't let you get away with clever lifetime extension tricks. If there is a model specifically for you, it isn't going to be causally connected to anything that's aged out.
You can delete individual items and categories from your history. It would be an unimaginable pain in the ass, both mathematically and engineering-wise, to propagate the updates for individual deletions through an incremental pipeline. Even worse, I can't imagine how you'd possibly argue that such an operation would satisfy a legal deletion request (HIPPA, GDPR).
If you need to change your learner - say you found a bug in your training code - but all you have is a trained network and no data, you're screwed. You lose all your history and your user's search, spam-filtering, or voice recognition quality tanks, and people really care about those things. Pure incremental pipelines are incredibly brittle.
All of these problems are trivially solved by retraining from the raw data. Disk is cheap. Compute is cheap. Engineer time is expensive. Fancy infrastructure is expensive. Mathematicians are super expensive. Legal compliance is fantastically expensive and grows in cost incredibly quickly with increased engineering complexity.
I work at Google. My views are not the views of my employer and so on and so forth. I build data quality infra for the knowledge graph. I haven't worked on a ton of projects that dealt with PII for public users, but even so the privacy reviews for the tools and pipelines I build get reviewed and occasionally changes are demanded to protect tool-use information about employees that use the infrastructure that I build.
Google isn't making money from selling actual raw user data, its selling data about that data.
I do work in analytics / logging, so I do have pretty decent insights into our different storage systems and logging policies.
The people that I interact with view data as a liability, not an asset. I think this is because of lawsuits mostly. We've been bitten by a few big ones. But also, storage is expensive, and even storing a Boolean on one type of log, we could get billions of those logs per day. It starts to add up and cost money.
I think we're pretty confident in our security and take it very, very, very seriously. So I don't think we're worried about necessarily a specific piece of data being stolen. If anything is stolen at all, that would be viewed as an existential catastrophe. So I don't think there's too many pieces of data that we'd care about specifically.
But again, I'm not anyone important here. And I'm new. And I don't know that much.
Take care!
As far as I know, I'm allowed to say that: people I work with tend to be liberal. As far I know, I'm also allowed to say that: people I work with tend to view data as a liability not an asset. It's also public information that Google receives billions of requests per day. For me to extrapolate on that and say that even storing a single bit of data on those logs starts to add up and cost a lot of money isn't a trade secret either. It's common sense.
A couple of actionable statements
- you don't store anything for more than 30 days (that doesn't mesh with analytics data which might be de-anonymisable IMO).
- you don't do any facial tracking. Which doesn't surprise me too much but I can imagine a future trial where a barrister is saying "your engineers claimed in public you didn't do this sort of tracking" and that providing extras jeopardy for damages.
It's not my area, however, I appreciate the openness. Thanks for sharing.
You disappoint me ;)
> You need to jump through a million hoops to get permission to store anything at all!
I guess you don't work with Android.
Today I wanted to set up my smartwatch. My phone told me to enable Bluetooth _and_ gps. I turned on GPS, it asked if it was okay to send positioning data to Google for some vauge reason. I said no. So it turned off GPS altogether. So now I won't be able to use my watch. (This is a clear GDPR violation btw)
Why am I telling you this story? Because someone at Google is trying really really hard to get his hand on all possible data. Maybe you two should have a chat.
So, no, we do not store a constant audio stream from everything in your house for all of eternity. We don't store every website you visit in chrome for all of eternity. We don't analyze your face as you browse Hacker News from Chrome in your cellphone using your front facing camera, and store how the different parts of every page influence your emotions.
I'm sure SOME company is doing all of these things. But Google is not.
You need to jump through a million hoops to get permission to store anything at all! And unless there's a very clear reason why our service won't function without the data we're collecting (note this is completely different than the data potentially being valuable for something in the future, or possibly being able to add revenue) there's basically a ~0% it gets stored for longer than 30 days.
Maybe some of the older products like Doubleclick and Google Web Search are grandfathered in and storing lots of questionable data. I don't know. But I doubt it. Anything built in the last few years -- again I don't really know -- but I'm pretty sure shouldn't be considered a monster data vacuum.