Last month, Google made a couple of interesting moves in the name of user privacy.

The first is a (largely) symbolic move to increase the transparency of apps on the Google Play Store, while actually doing very little. The second will make it easier for users to remove personal information from search results.

Data Privacy in the Google Play Store

Google is in the process of rolling out a long-overdue feature to Play Store apps – a “Data Privacy” section that mimics Apple’s “Privacy Nutrition Labels” that was released in 2020.

Like Apple’s feature, this feature promises to show users the specific privacy and security practices for each individual app.

Items shown include:

• Type of data collected by the app (location, photos & video, contacts, personal info, etc.).
• Why that data is collected.
• Whether the data is encrypted and can be deleted.
• Whether the app follows Google’s Families Policy.
• Whether the app has undergone an independent security review

Previously, users would need to either click through to an app’s privacy policy or download an app and see which permissions were requested when the user opened or used specific features of the app.

The Problem – Compliance.

This is the app store equivalent of the “security theater”

While that’s a lot of good information to give to users before they download an app, there’s a small problem.

In Google’s description of the process to developers, they say (emphasis mine):

You alone are responsible for making complete and accurate declarations in your app’s store listing on Google Play. Google Play reviews apps across all policy requirements; however, we cannot make determinations on behalf of the developers of how they handle user data. Only you possess all the information required to complete the Data safety form. When Google becomes aware of a discrepancy between your app behavior and your declaration, we may take appropriate action, including enforcement action.

https://support.google.com/googleplay/android-developer/answer/10787469#zippy=

It seems like this system is just begging for abuse.

Many unscrupulous developers have multiple Google Play Store accounts. If one is banned, they move on (or create) another.

Having a more “up-front” privacy dashboard on Google’s Play Store – that is not actively monitored by Google – will do nothing to enhance the privacy of users or their data. No malicious developer will report incriminating data collection, which means that it will be up to the community to report apps that aren’t conforming to their own policies.

This is the app store equivalent of the “security theater” that the TSA is (in)famous for. It may look like an app collects little to no information, based on what they report, but there is no way for users to be sure. And if a developer is discovered misreporting their data, they get a slap on the wrist.

Request PII Removal from Google Search

Another interesting move from Google happened this month.

A blog post announced an expansion of policies that allow people to request to have certain personal information be removed from Google Search.

This updated policy now allows users to request the removal of the following types of personally-identifiable information:

• phone number
• physical address
• email address
• login credentials (when they appear in Google Search results)

These are in addition to the items that were already covered under Google’s content removal policy, which includes:

• Confidential government ID numbers (social security number, etc.)
• Images of official ID cards
• Credit card and bank account numbers
• Personal records (like medical records)
• Images of signatures

This is a good move towards protecting a certain class of vulnerable people. While I have no doubt that it will not be perfect, it is an acknowledgment that some “public” information does not need to be so easily accessible by everyone.