How much about you is online?
To state the obvious briefly, the internet giants are seriously big: Google is not only the world’s largest search engine, it is also one of the top three email providers, a social network and owner of the blogger platform and the world’s largest video site, YouTube. Facebook has the social contacts, messages, wallposts and photographs of more than 750-million people.
Given that such information could be used to sell us stuff, accessed by governments or law enforcement bodies (perhaps without warrants, under legal changes), or picked up by hackers, it is not unreasonable to wonder exactly how much the internet giants know about us.
US users of the sites are out of luck: there is no legal right under US law to ask a company to hand over all the information it holds on you. Users do have some say over how much companies are allowed to take, usually contained in the terms of service.
But European Union citizens are in a better position—under data protection rules, anyone can send a written request for their full data and, for a small fee, the company has to provide it, usually within 40 days.
It is a great chance to see exactly how much Google and Facebook really know about us and all we need is a test subject—perhaps an EU citizen who has been on Facebook since it came to the United Kingdom in 2005 and who has had a YouTube account almost as long and was on Gmail back when invitations to the service were something to beg, borrow and steal, rather than a nuisance.
The person would also have to be enough of an idiot to write about what was dug up in public. This left one obvious, unlucky test case in the Guardian offices: me.
Things did not get off to a great start with Google. The company has a main US branch, Google Inc, and subsidiaries in other countries. In the UK, that is Google UK Ltd. Here is the catch: Google UK Ltd, which is subject to the EU rules that let you access your data, does not hold it and the EU laws do not extend to the US parent company.
Thankfully, Google is not totally unhelpful. It has two tools that show the information it holds on you. The first, Google Dashboard, has run for about three years and gathers information from almost all Google’s services in one place.
Another feature, the account activity report, was launched recently and shows Google’s information on my logins in the past month, including countries, browsers, platforms and how much I have used the services.
Running these tools on my work email account (the Guardian‘s emails are managed by Google) is disconcerting. The dashboard can see I am a member of some internal Google groups and have a blogger account used to collaborate with researchers on Twitter riot data.
It shows my work Gmail account has 877 contacts, which gives me pause for thought, as does a list of the 398 Google documents I have opened. The site also lists my most recent sent and received emails.
A little more disconcerting is a chat history logging 500 conversations with 177 colleagues. Google chat is a handy way to collaborate in a large building, especially one full of journalists who seem to prefer to talk online (as Twitter activity testifies) rather than in the flesh.
The big relief comes when I note that Google is not tracking the internet searches I have made on my work account. Repeating this exercise for my personal Google account is less relaxing. There are several bits of extra information here. The most innocuous is a heavily neglected Google+ profile with a few hundred connections but almost no posts.
But it does link to my viewing history, which includes the Tottenham riots, Dire Straits, Pomplamoose and, bafflingly, a Q&A from the Ryan Commission into child abuse in Ireland.
News was “youtube user figures”, showing I am meticulous in my research. Mortifyingly, my last blogs search was a vanity one: “james ball”. Google also holds information on my login IPs and other anonymous non-logged-in data, but does not (yet) make this available.
There was some relief from the gloom, though. Google says the tracking for its display adverts does not draw from user data but comes instead from cookies—files that anonymously monitor the sites you visit.
Google’s ad preference page believes I am interested in online video, TV reality shows, printers, Egypt, politics and England. From this, it has concluded I am likely to be over 65 and male. I find myself more reassured than offended that Google has got this more or less wrong.
Facebook is a much trickier prospect. Unlike Google, Facebook processes some data in the EU, through its Irish branch, making it subject to access laws. These take up to three months because of a large volume of requests from campaigners, so I once again resorted to the site’s own tools.
Facebook’s main download tool was familiar—a downloaded archive that opens into something looking oddly like a stripped-down, uncluttered Facebook. It lists all my friends, every post ever made on my wall, my private messages and photographs.
The Facebook extended archive is a little creepier. Every event to which I have ever been invited is neatly listed, alongside its location, time and whether I said I would attend.
But there are gaping holes in what Facebook has made available to me—no posts from other users in which I am mentioned are included, not even from my friends. None of the 300-plus photographs in which I feature are there. Campaigners estimate that only about 29% of the information Facebook possesses is accessible through the site’s tools.
The tour through a decent swath of my personal data is at once disturbing and comforting. Disturbing because it reminds me mine is a life lived online. Among the huge tranche of information available to Google and Facebook alone is virtually everyone I know, a huge amount of what I have said to (and about) them and a vast amount of data on where I have been.
This is the core of the main comfort: despite their mountain of data, Google and Facebook seem largely clueless, too—they have had no more luck making any sense out of it than I have. And that, for now, is a relief.—