I'm also a Googler these days (via Fitbit). The assumption being made in this entire discussion is that the purchases are mined from Gmail, but that doesn't appear to be correct.

From the screenshot, the items are part of the "Purchases and Reservations" activity category that the parent points to. According to to the help documentation of the category, it specifically refers to purchases made directly within Google Search, Maps, or Assistant. I personally have precious few (4) items in this category, particularly when compared to the large number of purchase confirmation emails sitting in my Gmail account. And there is a UI for deleting the purchase records from my history.

Meta-comment, I find discussions of this type tend to elide the distinction between data used for personalization with data used for advertising. Say what you will about the very fact that the same organization has both, but I do think the distinction is both important, and communicated well neither by Google nor by anyone else writing on the topic.

>>the distinction between data used for personalization with data used for advertising

Personalization of what, exactly, if not ads? What's the proper distinction, in your view?

If I send an email to someone appearing to expect a reply, and I don't get a reply within X days (I think X=5), Gmail surfaces the email with a chip saying "Sent 5 days ago. Follow up?"

If I receive a travel reservation confirmation email, I receive a calendar reminder on my phone a few days before the trip.

This is personalization. But years ago Google made a commitment not to use Gmail data to customize ads (after initially doing so). So there's a real difference between personalization data and ads data.

Closer to home for me, we are legally barred from using Fitbit data for ads or allowing any system (or person!) in the Ads organization to access it in any way. But nobody said we can't personalize your Fitbit experience based on data derived from, say, your Fitbit exercise history.

I was spooked enough yesterday by newsweek offering to take my money and showing my gmail user details! Why do third party sites have access to my full name? I'm running an adblocker, a DNS block list, disabled third party cookies etc. Anyway I think my gmail account's days are numbered. Maybe I am willing to trust Google or at least compromise but not newsweek.

My recollection is that they don't - the content that includes your gmail data is served to you by Google, not by Newsweek.

Stop using chrome if you don't like that feature (where the browser offers to sign up with your credentials).

Is it a Chrome feature? I'd always assumed it was just an iframe, and would work the same on any browser.

Yeah, it happens in Firefox for me too. If I'm signed in to Gmail in Firefox and visit, say, Kayak or Priceline, I get the same popup. Safari seems to block it though.

Anyone knows how to disable it?

You can go to

https://myaccount.google.com/permissions?continue=https://my...

And disable Google Account Sign In prompts

I use several extensions that allow you to explicitly approve certain features or give permission to run JavaScript.

Out of the top of my head: NoScript, Trace [0], uBlock origin, Decentraleyes, Privacy badger.

As well as using a pi-hole.

[0] https://addons.mozilla.org/en-US/firefox/addon/absolutedoubl...

There's a particular type of "login/signup to this site with your google account" popup that only happens in chrome. From the comment posted, that appeared to be what they meant.

I'm using Firefox.

>> This is personalization. But years ago Google made a commitment not to use Gmail data to customize ads (after initially doing so).

Oh! Well, I actually did not know this. You are saying they realized they shouldn't use my Gmail to customize what ads they show me; how can I verify you are right to say so?

>> So there's a real difference between personalization data and ads data.

I still don't see the distinction.

Googler here, who worked on Workspace (which gmail is a part of). Anyone who works in workspace could confirm that, it's something that is taken very seriously. On the personalization side - smart compose in gmail, where there's typing recommendations, that's personalization, where a machine learning model looks at your email and generated a specific model for you that suggests text. The data never leaves gmail, and it's not used for any other purpose, and no one has access to it. That's different than, "let's use your email to generally learn about you and recommend ads or content to you".

But, it's something we've also said legally:

https://support.google.com/googlecloud/answer/6056650#zippy=...

Is Google using my data? What for?

Google processes your data to fulfill our contractual obligation to deliver our services. Google’s customers own their data, not Google. The data that companies, schools, and students put into our systems is theirs. Google does not sell your data to third parties. Google offers our customers a detailed Data Processing Amendment that describes our commitment to protecting your data.EY, an independent auditor, has verified that our privacy practices and contractual commitments for Google Workspace and Google Workspace for Education comply with ISO/IEC 27018:2014. For example:

We do not use your data for advertising

The data that you entrust with us remains yours

We provide you with tools to delete and export your data

We are transparent about where your data is stored

You can get even more detailed in the DPA:

Customer instructs Google to process Customer Personal Data only in accordance with applicable law: (a) to provide the Services and TSS; (b) as further specified via Customer’s and End Users’ use of the Services (including the Admin Console and other functionality of the Services) and TSS; (c) as documented in the form of the applicable Agreement, including this Data Processing Amendment; and (d) as further documented in any other written instructions given by Customer and acknowledged by Google as constituting instructions for purposes of this Data Processing Amendment.

If I'm using a free personal account, where is the contractual relationship? My understanding is the terms are "take it or leave it, G can do anything permitted by law, and the user has no standing in court for any harm related to G's services". Is it possible for an individual to pay a token amount to get a real contract? Not intended personally, just trying to understand

There is no free account. You pay with your data. Recent right to repair legislation in Germany makes the concept of "paying with your data" explicit for the first time even in law text. So courts can no longer doubt that it is paying. But of course it has existed implicitly for years in many contexts. Not sure whether there have been high profile cases whether giving data is "paying" or not. A contract does not require payment by money.

Whether a contract is formed when you register and agree to their terms would depend on locally applicable law. I don't recall stories that courts would have deemed registrations on the internet invalid in general. Certain terms in the aggreement definitely.

The terms of service and privacy policy (https://policies.google.com/privacy) are the contract. And my rough understanding (not based on reading the contract, something said internally at Google a while ago about what is in them) is:

- Your "content" (data in Gmail, Docs, Photos, etc) won't be used for advertising. (Only for personalization, like the Gmail smart compose, asking Assistant about the status of your order, etc.) - Your "activity" (your searches, etc -- what you can see at https://myactivity.google.com/item roughly) can be used for advertising, though you can turn it off (see https://adssettings.google.com) or delete it. (IIUC, you have more granular privacy controls as a logged-in user as you can delete individual items….)

This is how it should work. But there is no way to verify if that is also how it actually works. So it amounts to a pinky promise and from any large company that to me is not enough, so while I appreciate your candor and your belief in that your employer is abiding by this I hope you will forgive me from having a lot of lingering skepticism.

Fundamentally it’s impossible to prove a negative, so agreed that it’s a pinky promise. I would say that I am a little closer to the problem space than just ”believing” from my time working in this area and dealing with these issues.

I routinely dealt with situations where connecting workspace data with other teams, even with explicit opt-in from users, at best required building incredibly detailed data scrubbing and log redaction to ensure no user data persisted outside of the workspace systems, in case it might accidentally end up used for some non-workspace purpose. At worst it was simply not possible, or not worth the other teams time to build things to a standard that would satisfy legal and privacy.

For sure, it’s possible there is some secret system or accidental data exposure, as I said, can’t prove a negative. But I will freely confess that I was someone who was generally skeptical of Google’s approach to data handling and always believed Gmail data and everything else was mined for every purpose until I joined Workspace. Once I was inside and saw how carefully it was treated and how many rules there were around anything you do with user data even within the Workspace teams, I was honestly nonplussed. It made product development harder.

> Fundamentally it’s impossible to prove a negative

15 is not a prime number.

There is no elephant in your room right now.

Yeah, that statement is an oversimplification of an oversimplification. The idea behind it philosophically is that it is far easier to prove that something exists/is happening than to prove that it is not. Essentially that if someone is going to make the claim that google is doing X, the proof is easy: a single instance of it happening. To prove google is not doing X requires you to create a collection of all of googles actions, prove that it is a full collection of their actions, and then prove that within that collection exists what the topic of debate is. Therefore, while it is not technically impossible to prove that google is not doing X, for the purposes of debate we should treat it as if it is and the burden or proof should rely on the person claiming that google is doing X.

Of course, as people living in the world we don’t necessarily need full proof to try and protect ourselves from the actions of an entity we don’t have full knowledge of. But saying “I don’t want to give google X data because of what they theoretically could do with it” is different rhetorically from saying “I believe that google is doing X with the data, and if you don’t prove otherwise it’s probably true.”

> There is no elephant in your room right now.

Prove it.

Hi Googler and thank you, sincerely, for engaging in this discussion.

First line in your legal statement:

>> We do everything in our power to protect businesses, schools, and government organizations from attempts to compromise their data.

Where is the "me" in this equation?

I just grabbed that from the support article because it was first in my search history - that's the support article related to @domain.com workspace users, so it's framed in that context. For the purely consumer use case (it's the same):

https://policies.google.com/privacy#infocollect

"We don’t show you personalized ads based on your content from Drive, Gmail, or Photos."

and

https://support.google.com/mail/answer/6603

> When you open Gmail, you'll see ads that were selected to show you the most useful and relevant ads. The process of selecting and showing personalized ads in Gmail is fully automated. These ads are shown to you based on your online activity while you're signed into Google. We will not scan or read your Gmail messages to show you ads.

The way you state this is as if Google is absolutely transparant about the data they're gathering and processing. Yet in practice it's nearly undoable for even experienced readers.i get emailed on a regular basis that Data processing agreement X of Google Service Y has been changed. Than there's is also the plethora of dark patterns within Google, for example the location functionality on Android. I get prompted that my location functionality is not working and that I must enable wifi tracking as well. Location is just working fine, be it on a worse resolution. Now if you'd be honest in the prompt, you wouldn't suggest the service is broken, but gave it less attention. If Google were really honest and transparant on all the data they're using, and making it easy for users to make a choice in how and what, than my take is that most users would opt-out.

But luckily google provides us with a completely gdpr compliant opt-out for Google Analytics.

To be 100% clear, I'm only talking about gmail, and by extension, Workspace, because I until recently worked there and saw firsthand how data was treated.

Ironically that was not clear from your text.

Reading the thread, the original post was:

"Oh! Well, I actually did not know this. You are saying they realized they shouldn't use my Gmail to customize what ads they show me; how can I verify you are right to say so?"

and then my response:

"Googler here, who worked on Workspace (which gmail is a part of). Anyone who works in workspace could confirm that, it's something that is taken very seriously."

I'm not sure how I could have been more clear...

It's a cut and paste from the linked support article, hardly my preferred mode of communication. Elsewhere in the thread I cut and paste from other content that's a little bit more plainspoken.

> The data never leaves gmail, and it's not used for any other purpose, and no one has access to it.

The FBI, NSA, CIA, and DoD have access to it, without a warrant (thanks to FISA 702), along with the entirety of the email corpus that produced it.

My comment was directly in reference to this thread's topic, which is the use of gmail data for ads vs. the use of gmail data for the personalization of gmail. Your comment isn't germane to that topic.

True, but the "no one has access to it" part is an unequivocal statement that happens to be false. We should keep in mind at all times who has access to all of Google's data whenever they wish.

You can't do threat modeling if you don't accurately model the various threats. Everyone at Google could be completely trustworthy but there's still huge insider risk thanks to US spying.

Again, my comment about "no one" was in the context of ads personalization, as in "no other part of google that might want to consume the model for broader use".

If we are going to do "threat modeling", we should also talk about the risk of nation state actors penetrating Google, or compromising your browser and getting access to your gmail that way. Or an accidental bug that changes everyone's password to be 12345. Yes, or the federal government could subpoena it.

Lots of things could be true and possible, but none of them are relevant in a discussion that's about the _internally permitted use of data within google_.

They are relevant in a discussion that's about the data flow from when Google gets data. As a Googler, the distinction between the two might feel very different, but as a user, I don't care whose fault it is, or what's technically going on in the legal description of Google's corporate structure; I didn't even notice the distinction between the two conversations (and assumed you were having the one I mentioned) until you pointed it out.

Yes, since 2017 no Gmail data is used for any Ad targeting, across any part of Google. Here's a NYT article: https://www.nytimes.com/2017/06/23/technology/gmail-ads.html

Unfortunately this goes against people's default (and incorrect) mental model of how Google operates, so it's been a very hard message to land.

Disclosure: Current Googler and I was a PM on Gmail at the time.

The message doesn't really land with me because it's so specific. Not using collected data for "ad targeting" leaves a LOT of room for uses of the data that I object to, including marketing purposes that don't happen to be ad targeting.

Maybe it goes against their mental model because Gmail did it for over 10 years and already broke the trust regular people placed in them.

That's good because my mailbox is filled with mail from other people. I signed up to gmail on day one using the x.lastname(at)gmail.com address format. Before dot meant "alias".

However I now get email from various people around the world with xlastname(at)gmail.com addresses. Apparently your email is not unique in the world, but only in your region, kind of (?!).

I get important emails (hotel bookings, insurance mails, trip reservations, orders, lawyer documents) from people which use xlastname(at)gmail.com in the USA, Canada, Australia, and Europe. All with similar names to me, obviously the surname is the same, but first name is different, just the same initial.

I've confirmed (by contacting some of them) that they are not missing out on any important documents. For some reason Google's system is duplicating emails meant for other people into my mailbox.

Only mails using x.lastname reaches MY inbox. If I tell someone I know to send a mail to xlastname I wont receive it, making the statement here...

https://support.google.com/mail/answer/10313

...false (for me).

I guess I'm God over all the non dotted versions of my email address. Thanks Google!

(However sometimes I wonder if other people see my emails as well)

> However I now get email from various people around the world with xlastname(at)gmail.com addresses. Apparently your email is not unique in the world, but only in your region, kind of (?!).

No, it's globally unique. I worked on this system for years. When it looks up an email address, it first looks in a globally consistent database [1] for an email record keyed by "canonicalized" address, with dots stripped out, everything in lowercase, and certain letter/number combinations replaced that are too similar like '1'->'l'. So if you sign up with x.lastname(at)gmail.com, no one else in the world can have xlastname(at)gmail.com, x1astname(at)gmail.com, xl.astname(at)gmail.com, etc. Part of this record's value is the original email address with the 'l's and '1's how you chose them. If those don't match the query, the system returns not found, just as it would if there were no record for the canonicalized form.

> I've confirmed (by contacting some of them) that they are not missing out on any important documents. For some reason Google's system is duplicating emails meant for other people into my mailbox.

I'd be _shocked_ if that were true. It'd be a very serious privacy incident and is contrary to my understanding of the system. Far more likely it's what I've seen with my own email addresses. Someone else incorrectly writes your email address instead of theirs into some system. Usually you're the only person who gets the email, but they might send something to two addresses, or they could even set up a forwarding rule from an address they have to an address they incorrectly think they have. They may say they're not missing any important documents, but maybe they have the documents in another system and don't know they're supposed to have gotten an email copy also. Or maybe they don't know what they're missing and don't understand what you're saying. This group of people was not selected for tech savviness. They might have just made a typo once, or they might keep doing this because they don't understand email at all.

> Only mails using x.lastname reaches MY inbox. If I tell someone I know to send a mail to xlastname I wont receive it, making the statement here... https://support.google.com/mail/answer/10313 ...false (for me).

That's odd. You can write to support if this is a problem. Support tickets actually reach engineers when necessary (yes, even for free gmail.com users).

It seems vaguely possible given the age of your account that your email record state and the current code are inconsistent in some way, like the field that stores your email address with the 'l's and '1's in your preferred form actually having the dot when it's not supposed to or some such. If there is such an inconsistency, one of my former teammates will fix the code or the database state (running a cleanup that finds all affected records) so they're consistent.

Or maybe the xlastname ones are just ending up in your spam folder. /shruggie

[1] old but: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.133...

Periods are ignored by gmail.

https://support.google.com/mail/answer/7436150?hl=en

I have [email protected], and I routinely get [email protected] mail intended for what is obviously two different people. I have no idea what their real email addresses are of course, but I've contacted both of them on Facebook and tried to explain that [email protected] is my email address, not theirs - neither replied, both continue to use it for tons of sensitive stuff. I don't understand why they haven't noticed the lack of critical, sometimes personal, email. It's bizarre.

I have a first-initial-lastname gmail address and receive more email for people with same-first-initial-lastname than I do actually for myself. One of them likes to go to expensive hotels somewhat often. I get the receipts. It's weird.

Trust once broken is next to impossible to restore. Besides that there is no way to verify this for outsiders, so you may as well assume that it is done because there is money in it. Google lost the moral high ground in these discussions long ago.

If Google personalizes your data, but doesn't pipe it into ads.google.com, then it's not ads data.

> how can I verify you are right to say so?

I mean, you could say "how can I verify Google isn't using my Google password to decrypt my Chrome data and pipe it into Google Ads", but you'd have no way of verifying that, besides taking their word for it. https://variety.com/2017/digital/news/google-gmail-ads-email...

That’s the crux with tech these days. Many companies took advantage of people’s data when they shouldn’t have. If they want to walk that back and behave in a good way, how can anyone prove it.. taking their word for it isn’t good enough.

For example, data on which videos on YouTube I watch are used to personalise my recommendations. My feed becomes subjectively more interesting to me. The ads aren’t personalised because I don’t see any ads. So my data is being used, just for my benefit. Does that make sense?

I wonder how many people (excluding those benefitting from the adtech industry) hold the view that they enjoy seeing personalised ads.

My guess is very very few.

I see ads on my Apple TV but they're not personalized, just random food delivery, lots if ads for chips, shampoo and meds, or the usual junk that you see on cable TV. I fail to see how this brings me any benefit.

>> The ads aren’t personalised because I don’t see any ads.

If you're watching YT and think you are not seeing ads, then you're being foiled.

>> So my data is being used, just for my benefit.

Apart from the word "just", I agree.

> If you're watching YT and think you are not seeing ads, then you're being foiled.

Actually running an ad blocker/paying for Premium means you aren't seeing ads, pushed by Google. Any creator might be showing you sponsorships/product placements of course, and Google has no say in that.

When I say "you're being foiled" I'm not talking about product placements. I'm talking about how Google designs its sorting algorithm for me, on my personalized YT front page and how that assortment challenges me to become involved, enticed even, to view/buy certain things.

So you think google is guiding you, based on your profile based on all the data they have collected on you, to (for example) specific tech product reviews in order to entice you to consume goods at retailer walmart/dell/apple/samsung etc?

>> So you think google is

Yes

>> guiding you

Yes

>> based on your profile

Yes

>> based on all the data they have collected on you

Yes

>> in order to entice you to consume goods

Yes

So is that a No to all the relevant bits then?

What relevant bits of of Google's conduct did I fail to address?

Although not what OP intended to say, personalization will eventually mean targeted pricing.

Exactly. The more data, the more control over interactions the other party has to extract maximum value. I’m always surprised when people don’t understand this. They get it if you talk about the real world, but don’t if suddenly the information is exchanged over computers.

I think it's more talking about gmail purchase records, which can be viewed here: https://mail.google.com/mail/u/0/#search/category%3Apurchase...

Interesting.

So, my gmail is [email protected]. I see SOMEONE else's purchase in my history. That persons name is shown as fname [email protected]. Same as mine except .i. is three spaces.

WTF? Does Google have a bug here? Is there an actual real life human I could send this to?

Edit: the only purchase I see of mine are for Apps I bought from the play store. These don't show up in the link that the Googler posted above.

Isn't it sad that a company that totally dominates modern email, plays so fast and loose with email standards?

And not just obscure standards; email addresses are very much public-facing elements of email. The expectation when you register an email address is that that address is now uniquely associated with you. The public does not expect that an email might be delivered to other inboxes than their own.

Why does gmail elide dots again? There must be some reason why a big email provider would deviate so egregiously from the conventions all other email services comply with.

/me not a gmail user, except for certain account recovery purposes.

Sounds like a security flaw. I’d submit it to a big bounty program.

The other person probably just entered OP's email address. I don't really get what OP is saying but make sure to note that periods are normalized out.

they are saying us.middlename.mannk@gmail is seeing receipts for [email protected]

The dots don't matter.

Exactly this.

I see, but these "receipts" are just emails. I would be extremely surprised if someone else's emails are getting routed to your gmail inbox. Seems very unlikely...

haha you should see the folks who are like:

[email protected] [email protected] [email protected]

etc. etc. etc.

Yeah, user error is more likely here, knowing the security in place at Google. That said, I suggested submitting it since the exercise of creating a repo will make it clear one way or another.

Win / win either way for OP. Learning opportunity or a bit of cash in hand for relatively little investment.

The link above, https://mail.google.com/mail/u/0/#search/category%3Apurchase... is just a search of your Gmail inbox for "category:purchases". You get exactly the same results by opening Gmail and entering "category:purchases" in the search box. Each of the results is an email that was delivered to your Gmail address, i.e. an email actually in your Gmail inbox or archive. So if you're saying you're seeing someone else's purchases, it means email meant for them was delivered to you (and you didn't notice it at the time for some reason). You can click through to each individual email to see when it was sent and by whom etc. So if it's a bug, it's a bug with Gmail delivery itself; it's not a bug with the purchase categorization specifically.

It’s not a security issue. It’s a user confusion and poor validation issue.

I was an early GMail user and have a common-ish name. I probably get 30-50 emails a month from confused people ranging from contracts to receipts to racy photos.

I used to get alert emails, from google, for what appeared to be someone with my email address in another tld. I probably could have reset their password and accessed everything. Maybe they can access my email.

I sought support but never got anything official and commenters brushed it off. But I'm pretty sure it was similar to your issue.

i think this is a case of gmail ignoring periods in your email address and applying the same rule elsewhere.

As an example name.lastname, na.melastname and namelast.name are all the same email address.

Would fname.i.lname be the same as fnamelname?

fname.i.lname@ == fnameilname@

The "i" only exists in one of the addresses.

Exactly. "Would fname.i.lname be the same as fnamelname?" -> No.

"[email protected]" is the same address as "[email protected]"

Thanks for the link. Unfortunately, there is no UI for removing this category when it's incorrect or when I wish to opt out.

Ironically, since the only purchases my Gmail contains receipts for are for someone who isn't me but apparently decided to use my email address, whatever database these are feeding that Google thinks is "about me" is steadily being corrupted to death by a complete stranger.

Oh well :)

> Oh well :)

Not going to be so great when they engage in criminal activity that points back to you. I do a password reset on their account whenever I find someone using my email. Then you can change the email to a throwaway or delete the account. It's unsafe to let it be.

There is a long paper trail full of evidence of my attempting to contact people to get them to stop sending me someone else's email. If some idiotic prosecutor can't tell the difference between some jerk in Missouri and me, they deserve the judge's derision when the confusion is uncovered.

Gmail does not allow changing email addresses, and if I delete the account, I lose access to a recovery email that I'm executing a multi-year migration away from. That's simply not an acceptable step to take to mitigate the unlikely risk you describe.

There's also some jerk at AOL who forwarded their email to me mistakenly over a decade ago, and I've tried to contact AOL, which of course they won't consider since I'm not the person who set the broken forward.

While I appreciate your concern, I've already taken it into consideration as best as permitted by the tools available. If you are aware of a way to change a gmail address without creating a new Google Account, then of course I would love to hear about it.

It's a lost cause. I'm over a decade into the transition you are undertaking and I've basically just accepted that it will always be an account I can't get rid of - so I use it as a "you need my email address but I don't trust you" account. Nobody ever has any concern if you give them a gmail account.

Over 50% of the email this account receives is for other people and frequently the "To:" field isn't even an exact match for my address!

If you do start getting stuff that looks like it might cause you problems: be proactive. Do not wait around to embarrass some prosecutor. By that time, you've already spent thousands of dollars and had your reputation dragged through the mud. I once started getting legal threats meant for someone else. I had a lawyer call up that lawyer and it was cleared up in less than 10 minutes. Another time I started getting emails from/to a person with the same name as me at the State Department that definitely should not have been sent through a non-government server. I talked to someone I knew at the US Attorneys Office about it and those emails stopped immediately (doubt that guy still works there, LOL).

Yes, none of it was ever a lawyer.

I believe the suggestion is to do something about the account on the other service that has been pointed to your address, e.g., if United Airlines is sending you mail about flights you never booked, perform a password recovery on the UA account thereby locking out the person that entered the wrong email address. I'm not sure I agree. But then it doesn't often happen to me.

That could be inferred as unauthorized computer systems access under various laws, so I don't personally, but it's definitely something you can try to do in varying degrees.

It's pretty deceptive that they don't disclose these are categorized and stored for advertising purposes. That's unethical IMO.

On the About Gmail page, in large bold text is stated:

"We never use your Gmail content for any ads purposes" emphasis mine.

That might qualify as deceptive.

Why do you think that this is being used for advertising purposes? Because HN user potatoman22 asserted that with no evidence?

I don't have any evidence, I just assumed it was being used for that from other discussion on this post.

Right, and in the absence of evidence making assumptions is a very natural human thing to do. But eth0up went through the trouble of finding pretty compelling evidence that the data was not being used for advertising purposes, quoted it, and still chose to believe the opposite.

Yes, because whimsical potato, I am true, fearless believer and desciple, hater of evidence, prophet of assumption, protector of anonymous tubers.

Not because google is in the business of data and advertising or has the ability to cleverly manipulate language to their advantage or would ever consider being evil. I'm quite confident google wouldn't use such data in ways that could be connected to advertising. All your google data are belong to privacy.

> Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community.

https://news.ycombinator.com/newsguidelines.html

Bear in mind that while I can't refute you, the parent question was pretty snarky in its implication.

Compare and contrast with "We will never use...'

> You can see the information it has already collected if you use Google, by visiting: https://myaccount.google.com/purchases

The weird thing is that page doesn't even list the purchases I've made from google itself. Does it even work?

Did you mean purchases from Google Voice, Google Fi, Google One, YouTube, Google Cloud, or Nest? Or purchases with Google Pay, Android Pay, or perhaps "send money with Gmail"?

Recently discovered these all seem to be unlinked, after I has to change my payment instrument in a dozen different places.

Related, Google Pay and GPay are totally different apps by Google on my phone. So confusing.

yeah Google has a pretty serious case of shipping the orgchart.

Are you accusing Google, the company that released a Spotify competitor named "Google Play Music All-Access," of shipping its org chart?

never in my life I would slander my employer in such a way, never!

> Googler, opinions are my own.

Honest question here, why do people put this in their response? I don't think there is any chance that one might thing "kyrra" is speaking on behalf of Google.

I like it when people disclose that they have a deeper connection to a company being discussed than most people. It's fair disclosure, especially because it indicates where their biases may lie (and we all have biases).

But once someone says "I work for X", they must also say that they're not representing the company. Companies get a bit upset if their employees appear to be representing company positions without authorization, even if no reasonable person would thing they were.

Google requires this disclaimer when you talk about the company publicly, probably for legal reasons

Source: I work at Google

Disclaimer: Googler, opinions are my own.

Perfectly sensible policy and I for one appreciate insiders clarifying misinformation especially on such issues, while still notifiying their potential conflicts.

Disclaimer: I am not a googler, opinions are what google tells me to think.

wonder how well this really works.

Some comments I see (not speaking of this thread per se, but in general on HN) are really close to conveying internal company information. Which is beyond mere opinion and only available to someone inside the company. Some people clearly use the disclaimer to elevate their "opinion" to the level of authority.

It's not about access to information. It's about removing the possibility of being confused for a spokesperson of Google's.

This is in contrast to comments you see here like "hi, Ben Foobar from [company being discussed] here", where the company is being formally represented and communicating with HN.

Naturally Google doesn't engage this way on HN, but the disclaimer is written out of habit and an abundance of caution.

It's less a disclaimer of being an official response, I think, and more a case of pointing out a potential bias.

My list seems to stop in May 2021– maybe something to do with being Gsuite user?

It looks like there is a section called "Smart features and personalization" in the GMail settings (not the general Google account settings; specifically the GMail settings) under the General tab.

It indicates that "Gmail, Chat, and Meet may use my email, chat, and video content to personalize my experience and provide smart features. If I opt out, such features will be turned off."

It's strange that this major privacy setting is buried specifically in the GMail section and not mentioned in the main Google account Privacy Checkup. I never knew it existed.

Not to give undue credit to Google.... but I do recall a popup in gmail about personalization not too long ago (either this year or last) with the option to opt-out.

Might have just been to the EU/UK users though?

Mine is empty as well, so I must have found the toggle someplace. Also, I fwd then delete all my gmail to my "real" email account but presumably Google could have already "read" my mail.

Mine is empty as well. I think this article is misleading. The takout list does not come from gmail, but are "purchases made directly within Google Search, Maps, or Assistant".

I do wish gmail would keep track of all my purchases. Keeping a folder named "shopping" is ok, but it could be so much more.

Next to each purchase I'd love to see: - link to a manual, youtube videos about this product. - remainders when stock is low (for things I might reorder).

The only item I see is a food delivery I ordered through google maps "order now". Otherwise, nothing.

But Google follows and track you without actually using their products as well, and they do it at massive scale. When the pervert is taking pictures of your daughter at the beach promising to fade out the face you don't take go to other beach as an answer. Your company tracks everyone everywhere, not only on their properties.

Zero respect for Google or Googlers just like I have 0 for perverts.

Your respect is worthless

It’s empty for me as well. I guess I opted out of a lot of things.

You can't attack another user like this, regardless of whom they work for. I've banned this account. It's important to quality of discussion here that people be free to post about things they know about, and people tend to know a lot about what they're working on or what other people at their employer are working on. Allowing full-out attacks like this would disincentivize them to post, which would be strictly bad for HN: more aggression, less information. We want exactly the opposite of that.

---

Separately, would you please stop creating accounts for every few comments you post? We ban accounts that do that. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html.

You needn't use your real name, of course, but for HN to be a community, users need some identity for other users to relate to. Otherwise we may as well have no usernames and no community, and that would be a different kind of forum. https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...

I read that as just more information not any sort of justification. I reacted more negatively to your response than to the parent.

From Google's viewpoint, it's in the EULA and you voluntarily agreed to it.

This is how they keep Gmail free.

Presumably, you've known that Google uses all the data it keeps about you for marketing purposes? Heck, even my grandmother knows this.

If you want to (supposedly) bypass this surveillance, look at purchasing a local GSuite for your use. Or look for something non-Google entirely.

Not defending Google or dude above, but at this point I really can't blame neither Google nor people working there. Almost everyone in a position to affect change is well aware of this and everything morally reprehensible either Google, Facebook, Apple, Reddit, TikTok, Twitter, Snap, Medium (add like 20 more) does.

Complaining about companies will change nothing as long as there are people using them. Whenever the privacy topic comes up a few people come back with I have nothing to hide, or it's too difficult to figure out which is good, or my life is busy and I can't focus on that, or it's all fucked might as well just install cameras in my shower. All this means is that: a lot of people don't care or are too nihilistic to want to change, and neither of these groups deserves sympathy.

If you still use Gmail, you don't get to complain that they scan your email, or use it to sell you stuff, etc... If you use Alexa you don't get to complaint that they might be using other trigger words to register interest, or that your parrot ordered something by mistake. These companies have been making their position on all of this extremely well understood over the last freaking decade.

If you're in a position to let someone who's genuinely not aware of this and still uses Google, you can maybe consider telling them, if they change then that's a net positive on the side of humanity, if they don't then it's on them.

That is not at all a fair take. These companies go out of their way to make their onboarding funnels as seamless as possible, and then jam all the negative side-effects of signing up into an impenetrable wall of text. Not everyone has been in tech for a decade, new users fresh to the internet and life in general sign up every day and these companies rely on their naivety and exploit that.

The consequences are clear to US but we know what to care about, there are teenagers on Facebook, Instagram, anbd Google services. Do you really think they understood the implications of lifelong digital surveillance? Not to mention the thousands of smaller tracking and advertising companies that bottom-feed in the background without so much as a peep. Your behavior lives in the databases of companies you've never heard of before, and they sell it for pennies such is their value of your privacy.

You probably consented to Facebook having access to your photographs in order to do the business you expected them to do with it, such as show it to others in your friends group. Did you anticipate them using your face in advertisements? Did you expect them to run ML algorithms on them in order to suck out advertising interests, did you anticipate the use of your data to form cohorts that allow you to be advertised at by companies you've never heard of?

Depending on when you signed up, you couldn't have, because half of these things didn't even exist when many of us gave them consent. Now think of the billions of users these companies have that don't even know what the word cohort means, and your position is essentially that well they don't know they should be mad, so it's fine to exploit them.

I didn't say people should be blamed for signing up, but for continuing to use these companies and services after seeing many people burn or because they prefer the convenience. If you:

- want the convenience - are not willing to pay for it - and have gone out of your way to avoid doing your research on how this thing works

== it's on you

but i'm not saying this to blame people really, i want people who are in this position to take responsibility for themselves and look up wtf is (for example) google doing and how is it free, then choose if they're ok with that (and stop complaining) or are not (and quit it). Enough people leaving Gmail will absolutely make a dent in how Google thinks. I'm optimistic about this. More people are waking up to the technological-slavery we're living in.

> how is it free

Because it's subsidized by their massive advertising business? They don't need to be this invasive to keep that up.

And they track paying customers too.

Funnily enough I am cynical about this, I don't think people will en masse figure it out and ditch the services as I don't think it's on teir radar at all. Which is perhaps why I feel more strongly that it's exploitation versus a choice they make.

It's why in this circumstance I am pro regulation on the adtech industry, as I feel it is the only way to protect people who don't see the dangers. Similar to how regulation is the only way we get ethical food production at such a large scale. When systems get too big, past regular human scale and on to conglomerate scale, it's hard for the average person to see and understand the whole system and its harmful factors.

Thanks for the considered reply by the way.

>These companies have been making their position on all of this extremely well understood over the last freaking decade

I don't think that's fair. These systems are extremely complex. I work in the user privacy space for a company you've heard of, and I can't say that people don't care. I think they don't understand. They don't understand that these companies have PhD educated ML data scientist getting paid outrageous salaries mine your behavior and influence it. I will never, ever blame the user for being exploited. I will always blame the people who continue to work on these systems, because these systems are evil.

> They don't understand that these companies have PhD educated ML data scientist getting paid outrageous salaries mine your behavior and influence it

What I think is a fallacy is that _any_ of us even understands exactly what that means. The data science crap is (from what I hear from people in the industry) is mostly hype.

> I will never, ever blame the user for being exploited.

It's not exactly exploitation if the user is aware of what's happening and change causes them only inconvenience. People don't even turn off GPS on their phone even though they only actively use positioning like once a week just to avoid the inconvenience of having to go to privacy settings and turn it on/off, basically they'd rather be tracked the whole time just to save 3 seconds. If you do this you're not being exploited, you're willingly accepting this transaction. It's their loss.

The thing that every single person can see is that these companies don't have the customer's interest primarily in mind. Google is not giving free stuff because they're generous (and they shouldn't be, people should understand that companies exist to make money by "supposedly" providing value). Their standard position is hypocritical. Amazon argues for higher min wage not because they care about welfare, but because they want to prevent competition from even a 1% chance of gaining a tiny share in some market, as long as min wage can only be paid by Amazon and not some random small business, they're winning.

Our problem is not that companies are doing any of this. It's that when EA did that whole gambling/surprise-box crap, people complained and complained for months, but a lot of those same people STILL played the same stuff and bought stuff from the company. This leads to the conclusion that people don't want anything to be different, but they like to complain and have moral high standing.

> The thing that every single person can see is that these companies don't have the customer's interest primarily in mind.

I've tried to talk about privacy with many people, but very few people think about things like that. They don't even know what things like "server" mean. Even if they have a vague awareness that companies are conspiring against them, they give up because they have been told that "'They' already have all my data so there is nothing I can do."

I understand the difficulty in explaining the technical stuff. Partly i think it's also on people to learn a little. Not in a few months and not to become tech savvy, but ust the basics about what the heck internet is and what's the difference between that and the web for example. Technically this is a 50 year old invention, if you absolutely understand nothing about the internet you're almost actively trying not to learn or read, with that being said I think we should have more basic technical education specifically designed for non-tech people.

> Even if they have a vague awareness that companies are conspiring against them, they give up because they have been told that "'They' already have all my data so there is nothing I can do."

Yeah like I said, it's a nihilistic attitude. For example saying that more countries should have nuclear weapons just because around 9 have it already is cannot be an argument. 10 countries having them is more dangerous than 9.

And by the same rational, if Google already owns you, it doesn't mean that you it's ok to sign your soul away to TikTok now!

> they give up because they have been told that "'They' already have all my data so there is nothing I can do."

This is the second most common reaction I get when I talk about these issues with laypeople.

The most common reaction I get is that they just don't believe me.

> Partly i think it's also on people to learn a little.

It isn't just limited to non-tech people. Even many programmers even aren't aware of it. They know how to code, but they don't understand the larger systems that they are a part of.