Dead End: Google Buzz

Abstract

Google launched Buzz on 9 February 2010 by switching it on inside Gmail for roughly 176 million users. It set each user up to follow the people they emailed and chatted with most, and put that list on a public profile. Within two days Google was rewriting the product; within four it had dropped automatic following altogether and apologised. The Electronic Privacy Information Center took the case to the Federal Trade Commission, which in 2011 imposed the first FTC order ever to require a company to run a comprehensive privacy program, with outside audits every two years until 2031. A separate class action ended in an $8.5 million fund paid to privacy organisations. Google announced Buzz’s shutdown on 14 October 2011 and switched it off that December, twenty-two months after launch.

Why Google Built It

By 2009 Facebook had passed 300 million users. If people found things through friends instead of through queries, the assumption underneath Google’s advertising business (that search is how the web is navigated) was in question. Google had tried social already: Orkut, launched in 2004, had taken Brazil and India and never reached the United States.

Buzz came out of the Gmail team, with Todd Jackson as product manager for both. The argument was about distribution rather than features. A new social network has to persuade people to visit a new address, make an account, and drag their friends along. Gmail already had the accounts, the interface, the attention, and a record of who talked to whom. Buzz would live in the sidebar of a product people already had open.

The Launch

Buzz appeared in every Gmail account on 9 February 2010. Signing in produced a new Buzz section and a set of connections Google had chosen: the contacts a user emailed and chatted with most often, followed automatically, in both directions. Once a user created the required public profile, the lists of people they followed and who followed them were displayed on it, visible to anyone.

Uptake was immediate and so was the damage. In the first two days, by Google’s own count, tens of millions of people tried Buzz and posted over nine million times.

The clearest account of what that meant came from a blogger writing under the pseudonym Harriet Jacobs at Fugitivus, a survivor of an abusive marriage who kept a pseudonymous blog and forwarded its comments to Gmail. Her third most frequent email contact was her abusive ex-husband, because they shared custody of children. Buzz connected her to him, and to the people who sent threats to her blog, and exposed what she had been sharing with her mother and her boyfriend through Google Reader. Her post was picked up by TechCrunch and then by mainstream press within days. Lawyers and journalists worked out the same problem in their own terms: the most-emailed list of a reporter is a list of sources.

Default exposure against default privacy

Buzz did not leak data through a bug. It published a correct inference from private data, by default, and offered an opt-out. A social feature that adds people to a private network and asks whether they want to publish is recoverable if a user ignores it. A feature that publishes and asks whether they want to hide is not: the harm happens between the moment of exposure and the moment the user notices, and the people most at risk are the least likely to notice in time. Google’s Feb 11 defence was that the opt-out checkbox existed. It was the right answer to the wrong question.

Four Days of Retreat

On 11 February, two days after launch, Jackson posted three changes: a more prominent option to keep the follower lists off the public profile, the ability to block anyone rather than only users who had already made a profile, and a clearer display of which followers would actually appear in public.

That was not enough, and Google said so two days later. On 13 February the auto-follow model was replaced by auto-suggest: nobody was set up to follow anyone until they had reviewed a list and clicked through it. Buzz stopped automatically attaching public Picasa albums and Google Reader shared items. A Buzz tab appeared in Gmail settings, with the option to turn the product off entirely. Jackson’s post ended: “We quickly realized that we didn’t get everything quite right. We’re very sorry for the concern we’ve caused.”

Three days after that, at Mobile World Congress in Barcelona on 16 February, Eric Schmidt gave the other version. “I would say that we did not understand how to communicate Google Buzz and its privacy,” he said. “There was a lot of confusion when it came out on Tuesday, and people thought that somehow we were publishing their email addresses and private information, which was not true… the important thing is that no really bad stuff happens in the sense that nobody’s personal information was disclosed.” The chief executive was calling it a communications failure while his product manager was apologising for the product.

The same day, the Electronic Privacy Information Center filed a complaint with the Federal Trade Commission, arguing that Buzz violated user expectations, contradicted Google’s own privacy policy, and possibly federal wiretap law.

The FTC Order

The FTC proposed a settlement on 30 March 2011 and made it final on 24 October 2011. The charge was deception: Google had told Gmail users their information would be used to provide the service they signed up for, then used it to build a public social network.

The terms:

No misrepresenting privacy or confidentiality practices, or compliance with privacy frameworks.
Affirmative express consent before sharing previously collected information with third parties in any way that contradicts the promises made when it was collected.
A comprehensive privacy program, with a named responsible executive and risk assessments.
Independent third-party privacy audits every two years for twenty years, to 2031.

It was the first time an FTC order required a company to build a comprehensive privacy program rather than a security program, and it became the template for the agency’s later technology settlements. It also set the frame for what followed: in August 2012 the FTC fined Google $22.5 million for placing tracking cookies on Safari users, a penalty available only because the Buzz order was already in force.

A separate class action ended differently. Google agreed in November 2010 to an $8.5 million fund, approved in June 2011, paid out to privacy education and policy organisations rather than to users. Nobody whose contacts had been published received anything, on the reasoning that the affected group was too large and the individual harm too hard to price.

Shutdown

Google announced on 14 October 2011 that Buzz was going, and switched it off on 15 December. Google+ had launched on 28 June 2011, and the announcement framed the end of Buzz as consolidation.

Buzz had not recovered from its first week. The audience that stayed was mostly technology journalists and Google employees. The name had also become the reference point for every subsequent story about Google and privacy, which made it a liability inside Gmail while Google was trying to introduce a social product people were supposed to trust.

Google+ was built against that memory. Circles required an explicit choice of audience for every post, and every connection was a deliberate act. Google’s internal privacy review for new products was strengthened, partly because the FTC order now required it. Google+ then failed for an ordinary reason: people’s friends were already somewhere else.

From Buzz to Google+

Vic Gundotra led Google+ and took engineers from the Buzz project with him, along with parts of its plumbing, including the real-time update system and the comment threading. They treated Buzz as a lesson rather than a starting point and rebuilt instead of extending.

Google’s other social failures of the period are covered in Dead End: Google Wave, Dead End: Google+, and Dead End: Orkut.

Dead End: The Email Graph Is Not the Social Graph

Buzz confused two different structures. The communication graph records who a person actually deals with: the divorce lawyer, the source, the ex, the recruiter, the doctor, the colleague nobody else knows about. The social graph records who a person is willing to be seen with. Email accumulates the first kind of information precisely because it is assumed to be private, which is what made it such a good seed for a social network and such a dangerous one.

The technical objection was not that social features belong outside Gmail. Google shipped social features into Gmail afterwards and still does. The objection was that data collected under one promise was used to build something else, which is the exact behaviour the FTC’s consent requirement was written to prevent, and which turned a product-design argument into twenty years of federal supervision.