Google accidentally collected childrens’ voice data, leaked the trips and home addresses of car pool users on Waze, and made YouTube recommendations with deleted watch history, among thousands of other privacy incidents, according to a leaked internal Google document tracking six years of privacy and security issues, as reported by 404 Media.
The search engine giant shortly announced the departure of chief privacy officer, Keith Enright after 13 years with no plans yet to replace him, amid a restructure of its privacy and legal compliance teams, Forbes reported.
Also Read | Google techie says getting rejected for promotion was ‘blessing in disguise’: ‘I knew I needed to show…’
The document included issues with Google’s own products or data collection practices, vulnerabilities in third party vendors that Google uses, as well as mistakes made by Google staff, contractors, or other people. These include:
Google Street View’s systems were transcribing and storing license plate numbers from photos, since Google uses an algorithm to detect text in Street View imagery. The report says that the data has been purged.
More than one million users’ email addresses from Socratic.org, a company that Google acquired were publicly exposed for more than a year and could already have been harvested, the report read.
A Google speech service logged all audio, including an estimated 1,000 childrens’ speech data, for around an hour. The team deleted all logged speech data from the affected time period, the report read.
Waze carpool’s feature leaked the trips and home addresses of some users.
A Google employee accessed private videos in Nintendo’s YouTube account, and leaked information ahead of Ninendo’s planned announcements. An internal interview concluded the activity was “non-intentional,” the report says.
YouTube made recommendations based on videos users had deleted from their watch history, which was against YouTube’s own policy.
Also Read | Google Doodle celebrates 7th phase of Lok Sabha polls with voting symbol
When iOS users of Google Drive or Docs set access controls on a file as “Anyone with the link,” Google actually treated it as a “Public” link.
YouTube videos uploaded as unlisted or private could appear publicly available for a short time.
Google told 404 Media in a statement, “At Google, employees can quickly flag potential product issues for review by the relevant teams. When an employee submits the flag they suggest the priority level to the reviewer. The reports obtained by 404 are from over six years ago and are examples of these flags—every one was reviewed and resolved at that time. In some cases, these employee flags turned out not to be issues at all or were issues that employees found in third party services.”
Also Read | Google Search algorithm secrets revealed by whistleblower
404 Media obtained the data from a source who did not provide their real name or identity. Google confirmed it as accurate.
Google also told Business Insider it implemented hundreds of new and additional protections over the last six years to ensure user security and privacy. For example, it updated YouTube’s policy around kids and data protection in 2019, limiting data collection on videos made for kids to only what is needed to support the service.