SEO and legal experts point to Google Analytics privacy issues

SEO and privacy experts have raised questions about a feature in Google’s Analytics Dashboard that allows website operators to find information on individuals who have linked to their site through social media sites such as Facebook and Twitter.

The Google Analytics tool, highlighted by SEO expert and SmartCompany blogger Chris Thomas in his blog today, allows websites to track who has linked back to their site. While most of these links come from blogs and websites, a significant number now come from Facebook profiles where users have shared a link with their friends.

As a result, not only can websites identify the Facebook and Twitter profile names who have visited their site, they can identify the specific pages those users have linked. Additionally, websites can then potentially visit these Facebook or Twitter profiles and gather further information, including potentially personal details.

Thomas says the issue poses a significant privacy threat to social media users, and questions whether it may even be a breach of Google’s own terms and conditions, which state that websites “will not (and will not allow any third party to) use the service to track or collect personally identifiable information of internet users”.

Google declined to comment on the story, but this afternoon provided the following statement:

“We don’t control the URL scheme that third parties use, or the URLs they provide. But Google doesn’t seek in any way to make any use of any user names or IDs that their URLs may contain.”

This issue comes as Google is currently facing investigations in several different countries for potentially breaching privacy laws after taking data from private WiFi networks with its Street View cars.

However, an industry source says that while the dashboard does allow websites to access this information, says Google doesn’t distinguish between other URLs and Facebook profiles. To the company, it’s just another link.

“When a Facebook or Twitter URL pops up in the dashboard, it’s because someone has clicked on that link. The Facebook profile of whoever posted the link will show up, not everyone who clicked on it.”

“Google doesn’t check if the URL contains a user-name. It’s just letters and numbers. I think what’s important is that people become aware of the URLs they construct, and know that their profile can be searchable.”

However, the source confirmed that Google does allow websites to identify which profiles posted the link in the first place.

One legal expert says the issue could pose a significant privacy problem, both for Google and individual users.

Antoine Pace, partner at Gaden’s Lawyers, says having Google identify individual users, and the sites they have visited, could be an extremely serious privacy matter.

Pace says he would like to see a warning on Facebook informing users that when they post a link, their information could be compiled by Google.

“The capacity for linking from Google or Twitter is quite wellknown and popular. There should probably be a warning saying that, by doing this, you are potentially disclosing your information, or something similar.”

The more important issue, he says, is whether websites are using information about individuals who they track on Google Analytics to compile personal data. For example, a business could find out who has visited their site, gather information on their Facebook profile and then use it to produce tailored advertising.

“This may actually depend on Facebook terms and conditions. There is quite a bit of a user-beware issue here. I would be counselling users to be very cautious with the disclosure of their personal information.”

“It could potentially be used by third parties. I’m not suggesting that Facebook gives that information away, or allows it to be used by third parties, but there is definitely a privacy issue here.”

Facebook was contacted for comment, but was not available for comment before publication.

Thomas says businesses have the capacity to visit these Facebook profiles, gain information including email addresses and even phone numbers, and then produce tailored advertising.

“You can seek these people out and market to them. I would certainly not use this information, but if I was going to, I would craft an email to them regarding what they’ve visited on the site.”

“You could send them an email offering a discount on a particular product, or encourage them to buy something specific. You could use email, if you found out their birth date you could send a discount for that day.”

Thomas suggests that Google implement some sort of cloaking feature so individual Facebook profiles aren’t identified, just the social network they come from.

But others believe the issue is more to do with how individual users protect their information.

Colin Jacobs, chair of lobby group Electronic Frontiers Australia, says webmasters need tools in order to collect data on where links are coming from. The more pressing issue is to educate Facebook users on how they can protect their data.

“You might not think of Facebook as your own website, but you really do have your own little section of Facebook. It’s an identifiable website, you’re directing traffic to a site, that’s how you approach it.”

“Everything is connected, and you need to be careful and make sure your privacy settings are good enough that you’re comfortable with what the public can see.”

However, Thomas says Google needs to work with both Facebook and Twitter to fix the issue. Having users protect their information won’t stop sites from identifying specific profiles.

Additionally, he says telling users to be careful about what links they post on their profiles won’t be a permanent fix. In every case, he warns, they can be identified.

But without a solution, Pace says users need to be “extremely careful”.

“If you are concerned about the use of your personal information, then you need to protect it. If you are scared about someone stealing your wallet, you don’t put it on the fence outside. Make sure your information is protected from the public.”