Googlers voice stinging critique of company's actions on privacy in previously unreported internal interviews made public by US judge

Many Google employees and executives believe the company is failing its users on privacy as it persists with practices that are opaque, overly invasive, and that push the limits of personal data use to target ads, according to a series of soul-searching internal interview excerpts that have emerged into public view through litigation.

"Won't it creep people out to know how much we are paying attention?” one Googler wondered in one of the internal interviews conducted by Google’s Privacy and Data Protection Office, or PDPO, starting in 2020.

Excerpts of the internal interviews, without the names of the interview subjects, became public for the first time in recent days when a federal judge in California, in a step that largely appears to have gone unnoticed, unsealed an order requiring Google to pay $100,000 in sanctions for improperly withholding the material from plaintiffs suing the Internet giant over its allegedly illegal collection of their personal data through its Chrome browser. The existence of the interview excerpts cited in the judge's order has not been previously reported.

"At Google, we still seem to believe that fantasy that users agreed to this,” an employee said in another interview.

"I see a lot of evidence of us doing what [L]arry and [S]ergey wanted us to do which is pushing the boundaries and then dealing with the consequence. I don't know if you can change the company because this is the dynamic,” said a third Googler, apparently referring to the zeal of co-founders Larry Page and Sergey Brin to monetize user data to target advertising.

As part of her order requiring Google to pay the sanctions, US Magistrate Judge Susan van Keulen excerpted nearly three dozen statements by Google employees working on privacy — "including high-ranking executives" — who level unvarnished and often stinging critiques of the company’s privacy practices. One common critique was that the arm of Google that generates the bulk of its revenue by targeting search and display ads views privacy as an obstacle to the company’s success.

"Our data infrastructure is not designed for privacy," one Googler said in one of the excerpts that van Keulen included in her order. "Privacy is not the priority for most people in ads,” another Googler said. "There are core stakeholders at the company who think that [privacy] is impossible or too hard to do and therefore not worth it,” says a third.

"Sundar proudly likes 2 AC [account consent] settings. Users don't,” said another, apparently referring to CEO Sundar Pichai.

"There is no coherent strategy" on "privacy at Google,” said another.

The interviews were part of an effort Google launched in mid-2020 related to “privacy, transparency and control services,” according to internal documents the judge quoted in her order. The plaintiffs in the case, who battled Google in a day-long evidentiary hearing Monday over the company’s motion for summary judgment in a Chrome case, learned about the project last December when they deposed Sam Heft-Luthy, a member of the Google PDPO, which is charged with Google's data protection compliance and with applying privacy principles to new products.

The plaintiffs requested the documents in December. But it took four months, until this April, before Google stopped claiming the documents were protected by attorney-client privilege and made them available to the plaintiffs. Google told van Keulen that the documents “were inadvertently withheld as privileged,” but it also aggressively pushed back on the plaintiffs' requests, saying they were "misquoting and misconstruing internal Google emails and draft documents."

The discovery battles in the Chrome case became so intense that the two sides brought over 80 evidence discovery disputes to the court, requiring 16 discovery hearings and resulting in judges and a court-appointed special master hearing the case issuing more than 40 orders.

A key reason van Keulen ordered Google to pay the $100,000 in discovery sanctions is the company didn’t comply with its litigation responsibility to “immediately” turn over the interviews in which Heft-Luthy interviewed a wide array of Google stakeholders working on privacy issues across the company, and the final presentation.

“The Court finds that Plaintiffs suffered some prejudice as a result of Google’s belated disclosure of the [redacted] final paper and the interview notes associated with the project,” van Keulen wrote in the order, which was dated Sept. 8. “Because Google did not produce the [redacted] final paper or interview notes until after the close of fact discovery, Plaintiffs were prevented from seeking deposition testimony from any of the interviewees.”

Google said today that the interview excerpts have been taken out of context. “These excerpts and documents have been mischaracterized by plaintiffs and we will continue to defend ourselves," said José Castañeda, a Google spokesperson.

A lawyer for the plaintiffs, David Straite, declined to comment.

The names of the Google executives interviewed were not included in van Keulen’s order, which was partially redacted when it was unsealed in late September, several weeks after she initially ruled on the plaintiffs’ motion for sanctions. The interviews conducted by Heft-Luthy led to a final internal white paper presentation, which had four credited authors, 11 credited contributors and 11 credited reviewers, including several senior executives.

Among the conclusions in that internal presentation was that Google’s approach to privacy consent “has become out-of-step with user expectation and regulations. It makes it difficult for people to understand how we use their data in all circumstances, to make the right choices for them, and for us to take clear positions and distinguish ourselves from our competitors.”

“Our research analysis and stakeholder interviews have shown that Google’s consent approach, enabling the broad collection of and use of personal data, is a root cause for our systemic privacy challenges,” the presentation concluded.

The interviews with individual employees, however, hint at a conflicted divide within Google between people whose job it is to grow ad revenue through the use of data, and others tasked with protecting the data of Google’s users.

Google’s Privacy and Data Protection Office "is someone you want to hide things from because if they know they will make things worse,” one Googler told Heft-Luthy in one of the interviews he did with employees working on privacy.

"If people were the deciders, they wouldn't take the deal, but they are not the deciders,” another employee said. "Consent is no longer consent if you think of ads as a product,” said another Googler.

Other employees, echoing the complaint that Pichai doesn’t want users to have one-step privacy controls, complained about that lack of simple controls for big platforms such as Android and Chrome. Re-engineering Google’s products to be more privacy protective would require “a massive investment,” another observed, sounding doubtful company leadership is willing to take those steps.

"We are not taking our responsibility as a steward of user data seriously," a Googler said in another interview.