September 11, 2008

Google's Suggest And Search: Never Completely Private

By Phil Glockner of Scribkin (FriendFeed/Twitter)

Recently, I have been thinking about a particular feature of Google Chrome. If you haven’t used Chrome or haven’t been following the news about it, it is a new Web browser from Google. The feature I've been mulling over is its almost-magical location bar. Google calls this the address bar, but it is also called the location bar or URL bar.

Apparently, a dedicated open-source Google project team called Chromium came up with this new address bar technology, and they call it the omnibox.


On its face, the omnibox is a great improvement over the more generic location bars of pretty much every other Web browser out there. It’s a URL input field combined with a Google (or user-defined) search engine front-end, and it throws in several other tricks to boot. In my opinion, the only thing that really comes close is Firefox 3’s optimistically-named awesome bar. This is different than the location bar in Firefox 3, which by default only looks through your bookmarks and history to find matching search results. Google actually uses its vast search database, using a technology called Google Suggest.

Google Suggest

However, it’s not just in Chrome. Firefox also employs Google Suggest in the search input field next to the address bar if your search is set to Google. You can also find it on Google’s classic home page (i.e. not iGoogle), and in Google’s mobile application and site (if javascript is supported). On the surface, Google Suggest is great. Just start typing whatever you are looking for, whether it be a Web site or keyword, and Suggest goes off and tries to predict what you are typing with increasing accuracy. This is especially useful on mobile devices where typing can potentially be annoying.

Privacy Concerns

The one big drawback of this technology is that your search terms are transmitted as you type them to Google’s server. They literally know everything you type, including half-finished search terms that you subsequently erase without submitting. And what if you accidentally had copied a lot of text into your cut-and-paste buffer and dropped that in the address bar? The whole buffer would be in Google’s hands immediately.You can see where this could lead to a potential problem. What if an executive of a giant company started to search for an insider-trading tip just prior to dumping a lot of stock? Could these partial search results be requested by subpoena in a resulting civil trial?

Google’s Promise

Earlier this month, Google did in fact consider this issue and updated what and how much they cache from Google Suggest. You can read the details from the official Google blog here. In summary, they promise:
  • 98% of Google Suggest searches are not logged.
  • 2% of these searches are logged with IP addresses.
  • These 2% will have their logs will be ‘anonymized’ within 24 hours of search result, starting late this month or early next month.
Keep in mind that this promise is specifically for Google Suggest searches. If you actually submit your search query, Google’s standard privacy assurance goes into effect, which you can see explained very simply in this YouTube video. It seems reasonable to believe that Google is putting forth a good faith effort to protect your privacy while balancing the needs of their search business.

Another Dynamic to Consider

Google isn’t giving you the whole picture though. Sure, having a cutting edge search engine is what made them the first name in search. However, their business revenue comes from advertising, not search.How does this affect their high-wire balancing act? Well, it’s not completely clear. However, they didn’t become the first name in Web advertising by not involving search. In fact, search is key to the effectiveness of their advertising business.

The Google banner ads you see in your search result pages, and the Web pages with even more targeted advertising when you click on a link in that result page, this is how Google makes its money.You can safely assume that Google is always feeling pressure from their profit center to hand over as much information as possible on search results to help in making their advertising even more clairvoyant.

Traditionally, Google has been clever and has worked within the very simple dynamic of search terms, geographic locations, and statistical results in order to make this advertising highly targeted. However, their brain trust is gigantic. If you can think of something, anything they could possibly use to help their ad business, they probably are developing it in the lab, or are using it on their site. Local, national and international news at the time of the query. Related geographical searches. Platform search is performed on (Windows, Mac, mobile, etc.). Which query result is chosen. Time between search and click-through. Basically, everything.

Getting Back to Privacy

So how does this affect you? Well, the bottom line is, what you do on Google’s search engine will never be completely private. Like throwing a rock in a pond, the ripples are immediately noticeable and quickly die down, but the waves might not hit the opposite shore for a while. Tiny traces will always be left, and it is those traces Google uses to improve its search, and ultimately its search-based advertising.

The Bottom Line

You do have to make a decision if you want to participate in this giant information machine Google has built behind its sleek minimalist Web site. Some people think Google Suggest is going too far. Some may think that Google Chrome’s Incognito mode will keep them safely anonymous.The answer to both of these is: Not quite.
  • Google Suggest does gather more statistical data (such as typing speed, number of corrections, etc) but anonymizes that information quickly.
  • Incognito mode only works on the client side, that is to say, it keeps your audit trail off the books on your end. If you use Google to search for something with this mode turned on, they still get all the same info they would get if you weren’t using it.
The only real privacy solution, the only way to remain out of the grand Google experiment, is to not search online at all.

Read more by Phil Glockner at