I received lots of feedback to yesterday’s post “Lawyers (or journalists) with Gmail accounts: Careful with the Google Buzz”. My focus was the privacy implication of Google automatically publishing the identity of people you have communicated with in the past.

What distressed me most is that Google made Buzz automatic. It was folded into Gmail, assimilated your contacts (and email history), and created these first social connections without ever asking permission. If you had ever created a Google Profile (an innocuous webpage that might collect comments you left on Maps or links to your LinkedIn profile), then Google went a step further — it published these social connections in a place accessible to the world. And even if you had not yourself created a Google Profile, your social connections could still be exposed on the other person’s Google Profile.

Update: On February 13, 2010, Google announced it would be making the privacy options for Buzz more explicit. I wrote about the good (and bad) parts of that announcement in this newer post.

Now there is a “Buzz” preference pane under your Gmail settings. And the little “turn off buzz” link does take you to this preference pane:

New Buzz Preference Pane

The choice at the bottom of this preference pane explains that by disabling Buzz you are disconnecting your followers and deleting your Google Profile. Those happen to the be the same steps I discuss below — so when it was posted, these tips were apparently the right way to proceed. But Google has now given you a single button to do the same thing.

If you clicked the small “turn off buzz” link in the footer during the first few days of the service and were never presented with this preference pane, you may need to turn it back on (using that same link at the bottom) before you can fully disable the service.

Don’t like it? The burden was on you to track all this down and make the privacy changes you wanted. Even if you did that, it wasn’t clear that it was even possible to truly “turn off buzz.” Flipping the switch at the bottom of Gmail didn’t work. Who knows how many people have been misled by that. (Google now acknowledges this on one of its support pages. All that switch does is “remove the Buzz label from your Gmail account,” or in other words, hide it within Gmail.)

Even after clicking “turn off buzz”, your Buzz connections persisted, they were still shown on your profile, and Buzz was still active (as you could readily see from a mobile client, such as an iPhone).

Yesterday’s slight modifications by Google make clear that this was indeed their design

Yesterday afternoon, Google released a statement. (( Who wrote this statement? A person with the shiny new title “Product Manager, Gmail and Google Buzz.” My flip suggestion yesterday that Buzz had assimilated the Gmail client seems rooted in the organization chart. Google is shifting its well-respected email platform into being a social-media tool, whether its users like it or not. )) They did not back away from their business plan — they still make Buzz automatic and create these connections for you. Their response is, in essence, to blame you for not having figured out how to tweak these engineering settings yourself. (( In particular, they point out that it’s possible to manually go through and block particular followers. But, to take one example, they do not mention the data leakage I talked about yesterday, in which these followers get access to information about your other social contacts before you block them. ))

Their post does note a couple of very slight tweaks they have made that make their service less objectionable for users new to Google. But the basic deal remains the same. Google did not ask your permission for this repurposing of your personal email information, it did not ask your permission to share it, and is not asking for your forgiveness now.

Imagine if Facebook had done this. Imagine they bought a major email provider, folded all of its users into their social network, and prepopulated lots of connections based on who they had emailed the most frequently.

Okay, now imagine that Facebook had placed a button on the email client page that said “turn Facebook off.” And that the button did not actually do what it said.

Users and the press would be calling for Facebook’s head.

How to really turn off buzz

If the “turn off buzz” link at the bottom of Gmail isn’t the right way to actually turn the service off, what is?

Buried within its support pages, Google offers a three-step procedure you can follow to actually disable Buzz. Follow these steps in order, or it doesn’t work at all. The first step, contrary to what you might expect if you were not a Google engineer, is not to click “turn off buzz.”

(I just saw that CNET has also printed up these instructions, with helpful screenshots.)

  1. First, you delete your google profile. You don’t hide it or change the name. You have to delete it completely. This doesn’t destroy your overall google account, but it does limit some of your functions. Here’s how to delete your profile.

  2. You have to go into buzz and manually delete your connections, including blocking everyone who is following you already.

  3. Now it’s safe to go back to Gmail and click “turn off buzz.”

Make sense? Well, if you think about the whole social graph Google built automatically based on your email history — as if you and everyone else were just pieces of data whose permission was irrelevant — I suppose it does. You first have to disconnect all those nodes (by blocking your followers) and delete the hub (your profile) so you don’t get new connections. This process makes mathematical sense, but not human sense.

What should Google do?

What would make human sense is for the “turn off buzz” link to take you to a page that gives you a big button that really, really does turn off Buzz.

Update: And now it does! (See the yellow box above.)

Until then? The “turn off buzz” link is like those office thermostats you find sprinkled around a large workspace. The thermostats don’t work at all. But the feeling of control they give the occupants is a nice placebo effect.

If you want to still participate in Google Buzz but to have more control over your privacy, you’re left with the privacy tips and warnings I offered yesterday and the hope that Google will offer up a decent preference pane in the future.

And even if Google does give us a nice, big “opt-out” button, this remains a massive violation of user trust on Google’s part. This sharing of personal information never should have been opt-out. This is a huge shift in how Gmail uses our data. If this is Google’s method of dealing with our previously private data in the future, how many of us will really feel good about trusting our documents to Google Docs? Or our photos to Picasa?

Will it take an engineering degree (and constant vigilance) to protect your confidential information from being published?

I have no theoretical objection to a Google-run social network. I would like a nice way to easily share stories from Google Reader, for example.

What bothers me is that Google seems to think that its behavior with our email history was acceptable, even commendable. If this is truly the new Google attitude toward user privacy — if they are willing to do this even with emails, traditionally a private realm — that should give you pause before you decide to sign up for the next great Google webapp.