Google relents, offers "WiFi sniffing" opt-out

An article on Google's grandly-named European Public Policy Blog, which offers "Google's views on government, policy and politics in Europe", has gently announced what the search-and-advertising behemoth calls A new option for location-based services.

Google's location-based services rely extensively on its controversial global database of WiFi access points.
The idea is simple. Google's many StreetView cars and bicycles spend their time driving around our suburbs, snapping a continuous stream of photographs of houses, gardens, offices, parks - whatever they pass on their
all-encompassing journeys.

Whilst they're about it, the StreetView vehicles also make digital recordings in other parts of the electromagnetic spectrum - to wit, they sniff out WiFi access points and record their identification information and location.

Most access points spend long periods of time with the same MAC address and network name, and in the same place. So, a list of the access points currently within range of your laptop or mobile phone lets Google make a pretty good guess at your current location.

This obviates the need for GPS - which is slow to lock when you first power it up, drains your battery if you leave it running, and doesn't work well indoors.

Google's outward-facing explanation of the benefit of its massive WiFi database is that it represents value to you - it helps you find out where you are. Sadly, most of the time you already know where you are. You're at home, or in the office, or stuck yet again in a traffic jam on Parramatta Road on your way to work. Or from it.
The inward-facing explanation, of course, is that it represents value to Google - it helps Google know where you are. And that's good for targeted advertising, and that's great for business.

Anyway, after pressure from various privacy-minded data protection authorities in Europe, Google has changed its stance on its WiFi location database. You will soon be able to opt out, Google says, from being a part of the access point service.

The details of how this will work have not yet been released. How you will opt out has not been explained. And calling it "opting out" when you didn't opt in in the first place is a little cheeky.

It doesn't even sound from the blog article as though Google intends to remove your access point data from its database if you opt out. The lawyerly prose in the article simply says that if you opt out, "[Google's] services will not use that access point to determine users' locations."

(Actually, this is a Catch-22. Google pretty much has to keep you on file, simply in order to know that you didn't want to be on file in the first place. Otherwise they'd just add you back in next time the StreetView WiFi scanner came round - and then you'd have to opt out again. Sadly, you can't opt out of the StreetView collection process proactively.)

Nevertheless, this is an interesting change because it shows that, with enough pressure, even data-accumulation juggernauts like Google can be persuaded to change their ways.

In short: if big companies are doing things online with your data which you aren't happy with, don't just keep quiet. Write to your Privacy Commissioner. You can make a difference!

nb : nakedsecurity.sophos