Google is currently being investigated in Europe over privacy concerns raised about how the search giant has used personal data to train its generative AI tools. The subject of investigation is led by Ireland's Data Protection Commission, which ensures that the giant technical company adheres to strict data protection laws within the European Union. This paper will establish whether Google adhered to its legal process, such as obtaining a Data Protection Impact Assessment (DPIA), before using people's private information to develop its intelligent machine models.
Data Collection for AI Training Causes Concerns
Generative AI technologies similar to Google's brand Gemini have emerged into the headlines because these tend to create fake information and leak personal information. This raises the question of whether Google's AI training methods, necessarily involving tremendous amounts of data through which such training must pass, are GDPR-compliant-its measures to protect privacy and rights regarding individuals when such data is used for developing AI.
This issue at the heart of the probe is if Google should have carried out a DPIA, which is an acronym for Data Protection Impact Assessment-the view of any risks data processing activities may have on the rights to privacy of individuals. The reason for conducting a DPIA is to ensure that the rights of the individuals are protected simply because companies like Google process humongous personal data so as to create such AI models. The investigation, however, is specifically focused on how Google has been using its model called PaLM2 for running different forms of AI, such as chatbots and enhancements in the search mechanism.
Fines Over Privacy Breaches
But if the DPC finds that Google did not comply with the GDPR, then this could pose a very serious threat to the company because the fine may amount to more than 4% of the annual revenue generated globally. Such a company as Google can raise billions of dollars in revenue every year; hence such can result in a tremendous amount.
Other tech companies, including OpenAI and Meta, also received similar privacy-based questions relating to their data practices when developing AI.
Other general issues revolve around the processing of personal data in this fast-emerging sphere of artificial intelligence.
Google Response to Investigation
The firm has so far refused to answer questions over specific sources of data used to train its generative AI tools. A company spokesperson said Google remains dedicated to compliance with the GDPR and will continue cooperating with the DPC throughout the course of the investigation. The company maintains it has done nothing illegal. And just because a company is under investigation, that doesn't mean there's something wrong with it; the very act of inquiring itself forms part of a broader effort to ensure that companies using technology take account of how personal information is being used.
Data Protection in the AI Era
DPC questioning of Google is part of a broader effort by the EU regulators to ensure generative AI technologies adhere to the bloc's high data-privacy standards. As concerns over how personal information is used, more companies are injecting AI into their operations. The GDPR has been among the most important tools for ensuring citizens' protection against misuse of data, especially during cases involving sensitive or personal data.
In the last few years, other tech companies have been prosecuted with regard to their data-related activities in AI development. Recently, the developers of ChatGPT, OpenAI, and Elon Musk's X (formerly Twitter), faced investigations and complaints under the law of GDPR. This indicates the growing pressure technological advancement and the seriousness in the protection of privacy are under.
The Future of AI and Data Privacy
In developing AI technologies, firms developing relevant technology need to strike a balance between innovation and privacy. The more innovation has brought numerous benefits into the world-search capabilities and more efficient processes-the more it has opened risks to light by leaving personal data not so carefully dealt with in most cases.
Moving forward, the regulators, including the DPC, would be tracking the manner in which the companies like Google are dealing with the data. It is sure to make rules much more well-defined on what is permissible usage of personal information for developing the AI that would better protect individuals' rights and freedoms in this digital age.
Ultimately, the consequences of this study may eventually shape how AI technologies are designed and implemented in the European Union; it will certainly inform tech businesses around the world.
One particular area of interest is Chinese-made EVs, which dominate the global market. This blog post delves into the privacy and security risks associated with these vehicles, drawing insights from a recent investigation.
In 2022, Tor Indstøy purchased a Chinese electric vehicle for $69,000 to accommodate his growing family.
Indstøy had an ulterior motivation for purchasing an ES8, a luxury SUV from Shanghai-based NIO Inc. The Norwegian cybersecurity specialist wanted to investigate the EV and see how much data it collects and transmits back to China.
He co-founded Project Lion Cage with several industry acquaintances to examine his SUV and release the findings.
Since its inception in July 2023, Indstøy and his crew have provided nearly a dozen status reports. These have largely consisted of them attempting to comprehend the enormously complex vehicle and the operation of its numerous components.
In a fascinating experiment, Norwegian cybersecurity researcher Tor Indstøy purchased a $69,000 Chinese electric vehicle—an ES8 luxury SUV manufactured by Shanghai-based NIO Inc. His motive? To dissect the vehicle, uncover its data practices, and shed light on potential risks.
The project, aptly named “Project Lion Cage,” aims to answer critical questions about data privacy and security in EVs.
Electric cars are not mere transportation devices; they are rolling data centers. Unlike their gas-powered counterparts, EVs rely heavily on electronic components—up to 2,000 to 3,000 chips per vehicle.
These chips control everything from battery management to infotainment systems. Each chip can collect and transmit data, creating a vast information flow network within the vehicle.
However, studying EVs is also a challenge. Traditional cybersecurity tools designed for PCs and servers need to improve when dealing with the intricate architecture of electric cars. Researchers like Indstøy face unique challenges as they navigate this uncharted territory.
Indstøy and his team have identified potential areas of concern for the NIO ES8, but no major revelations have been made.
One example is how data gets into and out of the vehicle. According to the researchers, China received over 90% of the communications, which contained data ranging from simple voice commands to the car to the vehicle's geographical location. Other destinations included Germany, the United States, the Netherlands, Switzerland, and others.
Indstøy suggests that the ambiguity of some communications could be a source of concern. For example, the researchers discovered that the car was regularly downloading a single, unencrypted file from a nio.com internet address, but they have yet to determine its purpose.
China’s dominance in the EV market raises geopolitical concerns. With nearly 60% of global EV sales happening in China, the data collected by these vehicles becomes a strategic asset.
Governments worry about potential espionage, especially given the close ties between Chinese companies and the state. The Biden administration’s cautious approach to Chinese-made EVs reflects these concerns.
Automatic Content Recognition (ACR) is the invisible eye that tracks everything you watch on your smart TV. Whether it’s a gripping drama, a cooking show, or a late-night talk show, your TV is quietly analyzing it all. ACR identifies content from over-the-air broadcasts, streaming services, DVDs, Blu-ray discs, and internet sources. It’s like having a digital detective in your living room, noting every scene change and commercial break.
Ever notice how ads seem eerily relevant to your interests? That’s because of Advertisement Identification (AdID). When you watch a TV commercial, it’s not just about the product being sold; it’s about the unique code embedded within it. AdID deciphers these codes, linking them to your viewing history. Suddenly, those shoe ads after binge-watching a fashion series make sense—they’re tailored to you.
Manufacturers and tech companies profit from your data. They analyze your habits, preferences, and even your emotional reactions to specific scenes. This information fuels targeted advertising, which generates revenue. While it’s not inherently evil, the lack of transparency can leave you feeling like a pawn in a digital chess game.
Turn Off ACR: Visit your TV settings and disable ACR. By doing so, you prevent your TV from constantly analyzing what’s on your screen. Remember, convenience comes at a cost—weigh the benefits against your privacy.
AdID Management: Reset your AdID periodically. This wipes out ad-related data and restricts targeted ad tracking. Dig into your TV’s settings to find this option.
Voice Control vs. Privacy: Voice control is handy, but it also means your TV is always listening. If privacy matters more, disable voice services like Amazon Alexa, Google Assistant, or Apple Siri. Sacrifice voice commands for peace of mind.
Different smart TV brands have varying privacy settings. Here’s a quick guide:
Amazon Fire TV: Navigate to Settings > Preferences > Privacy Settings. Disable “Interest-based Ads” and “Data Monitoring.”
Google TV: Head to Settings > Device Preferences > Reset Ad ID. Also, explore the “Privacy” section for additional controls.
Roku: Visit Settings > Privacy > Advertising. Opt out of personalized ads and reset your Ad ID.
LG, Samsung, Sony, and Vizio: These brands offer similar options. Look for settings related to ACR, AdID, and voice control.
Your smart TV isn’t just a screen; it’s a gateway to your personal data. Be informed, take control, and strike a balance. Enjoy your favorite shows, but remember that every episode you watch leaves a digital footprint. Protect your privacy—it’s the best show you’ll ever stream.
This indicates that the only entities that are kept from knowing what a user is browsing on incognito would be their family/friends who use the same device.
At heart, Google might not only be a mere software developer. It is in fact a business that is motivated through advertising, which requires it to collect information about its users and their preferences in order to sell them targeted advertising.
Unfortunately, users cannot escape this surveillance just by switching to incognito. In fact, Google is paying a sum of $5 billion to resolve a class-action lawsuit filed against them, accusing the company of betraying its customers regarding the privacy assurance they support. Google is now changing its description of Incognito mode, which will make it clear that it does not really protect the user’s privacy.
Developers can get a preview of what this updated feature exactly is, by using Chrome Canary. According to MSPowerUser, the aforementioned version of Chrome displayed a disclaimer when the user went Incognito, stating:
"You’ve gone Incognito[…]Others who use this device won’t see your activity, so you can browse more privately. This won’t change how data is collected by websites you visit and the services they use, including Google."
(In the above statement, the text in bold is the new addition to the disclaimer.)
Chrome remains one of the popular browsers, even Mac users can use Safari instead. Privacy is just one of the reasons Apple fans should use Safari instead of Chrome.) However, there are certain websites that users would prefer not to get added to their Google profile which has the rest of their private information. Thus, users are recommended to switch to Safari Private Browsing, since Apple does not use Safari to track its users (it claims to).
Even better, use DuckDuckGo when you want to disconnect from the internet. This privacy-focused search engine and browser won't monitor or save the searches of its users; in fact, its entire purpose is to protect users' online privacy.
Most of the users are still unaware that even when the apps are not in use, the phone can still track and collect data without them being aware. Fortunately, there is a solution to prevent this from happening.
One may have ten, twenty or even thirty apps on their phones, and there is a possibility that many of these apps remain unused.
In regards to this, the cybersecurity giant – Kaspersky – warned that apps on a user’s phone that are not being used could still be collecting data about the device owner even if they are not using it.
A recently published memo from the company urged users to delete their old apps, stating: "You probably have apps on your smartphone that you haven't used in over a year. Or maybe even ones you've never opened at all. Not only do they take up your device's memory, but they can also slowly consume internet traffic and battery power."
The security memo continued: "And, most importantly, they clog up your interface and may continue to collect data about your smartphone - and you."
While spring cleaning the phones might not be on the priority list of people, it does not take away its significance. In case a user is concerned about ‘over-sharing’ their data, Kaspersky has shared a ‘one-day rule’ to ease the task of removing unused apps on phones.
According to the experts, following the practice of merely uninstalling one useless app each day will greatly increase phone performance and free up storage space. By doing this, users will be able to control how their data is used and prevent data harvesting.
To delete an app on the iPhone, users need to find the app on the home screen, touch and hold down the icon and tap “Remove app.” Android users, they need to go to the Google Play store, tap the profile icon in the top right, followed by Manage Apps and Devices > Manage. Tap the name of the app they want to delete and click to uninstall.
Users can still disable pre-installed apps on their phones to prevent them from operating in the background and taking up unnecessary space on the screen, even if they cannot be fully removed from the device.
ChatGPT has now entered data clean rooms, marking a big step toward improved data analysis. It is expected to alter the way corporations handle sensitive data. This integration, which provides fresh perspectives while following strict privacy guidelines, is a turning point in the data analytics industry.
ChatGPT's addition to data clean rooms introduces a multitude of benefits. The technology's natural language processing prowess enables users to interact with data in a conversational manner, making the analysis more intuitive and accessible. This is a game-changer, particularly for individuals without specialized technical skills, as they can now derive insights without grappling with complex interfaces.
One of the most significant advantages of this integration is the acceleration of data-driven decision-making. ChatGPT can understand queries posed in everyday language, instantly translating them into structured queries for data retrieval. This not only saves time but also empowers teams to make swift, informed choices backed by data-driven insights.
Privacy remains a paramount concern in the realm of data analytics, and this integration takes robust measures to ensure it. By confining ChatGPT's operations within data-clean rooms, sensitive information is kept secure and isolated from external threats. This mitigates the risk of data breaches and unauthorized access, aligning with increasingly stringent data protection regulations.
AppsFlyer's commitment to incorporating ChatGPT into its Dynamic Query Engine showcases a forward-looking approach to data analysis. By enabling marketers and analysts to engage with data effortlessly, AppsFlyer addresses a crucial challenge in the industry bridging the gap between raw data and actionable insights.
ChatGPT is one of many new technologies that are breaking down barriers as the digital world changes. Its incorporation into data clean rooms is evidence of how adaptable and versatile it is, broadening its possibilities beyond conventional conversational AI.
Due to their business model, which involved selling their goods via resellers, these businesses have typically had little contact with the final consumer. However, several manufacturers smartly constructed digital experiences to interact with, sell to, and gather data from their customers directly as a result of resellers being closed or operating at reduced capacity.
Data that was previously gathered and owned by resellers or intermediaries was suddenly made directly available to manufacturers for them to profit from and learn from. This opened up new revenue streams by charging other organizations for their data, using it to cross- or upsell products, or making the customer experience less complicated.
With all likable traits of data collection, there however exists certain risks that comes with it. These risks not only include data hack, malware or data theft but also exploitation of the collected data that may lead to a brand wreckage or even legal challenges to an organization.
In order to minimize the damaging consequence, organizations are advised to develop a proactive ethical framework rather than any reactive measure, in order to govern the use of technology and data. These principles create a foundation of security and respect for clients, reducing consumer harm.
Moreover, with the evolution of cyber threats, the previously admired strategies are now outdated. There is no longer a secure border or barrier. Through the use of security-in-depth techniques like encrypted communications, segregated areas, granular authentication and authorization, and sophisticated intrusion detection systems, system design should enable risk management and security enforcement across the whole architecture.
Lastly, the manufacturers are also urged to reconsider their views on data in order to effectively address privacy. Particularly, they ought to give top priority to well-considered governance systems that allow for informed choice-making with regard to data collection, access, and utilization. Manufacturers could guarantee that data is treated properly and ethically by designating data owners. For enterprises, having a solid governance framework is important for safeguarding user data and privacy.
US Immigration and Customs Enforcement (ICE) have come under scrutiny for its questionable tactics in data collection that may have violated the privacy of individuals and organizations. Recently, ICE's use of custom summons to gather data from schools, clinics, and social media platforms has raised serious cybersecurity concerns.
According to a Wired report, ICE issued 1,509 custom summons to a significant search engine in 2020, seeking information on individuals and organizations involved in protests against ICE. While the summons is legal, experts have criticized the lack of transparency and oversight in the process and the potential for data breaches and leaks.
ICE's data collection practices have also targeted schools and clinics, with reports suggesting that the agency has sought information on students' and patients' immigration status. These actions raise serious questions about the privacy rights of individuals and the ethics of using sensitive data for enforcement purposes.
The Intercept has also reported on ICE's use of social media surveillance, which raises concerns about the agency's ability to monitor individuals' online activities and potentially use that information against them. The lack of clear policies and oversight regarding ICE's data collection practices puts individuals and organizations at risk of having their data mishandled or misused.
As the use of data becomes more prevalent in law enforcement, it is essential to ensure that agencies like ICE are held accountable for their actions and that appropriate safeguards are put in place to protect the privacy and cybersecurity of individuals and organizations. One expert warned, "The more data you collect, the more potential for breaches, leaks, and mistakes."
Privacy and cybersecurity are seriously at risk due to ICE's use of bespoke summonses and other dubious data collection techniques. It is essential that these problems are addressed and that the proper steps are made to safeguard both organizations' and people's rights.
Here, we are comparing DuckDuckGo with Qwant to discover which search engine is better at safeguarding its users' privacy beyond the marketing claims.
Any search engine company's efforts to collect data is a highly risky task. There is a very blurry line between the quantity of data that is required and the amount that is excessive. Once a search engine service crosses this blurry line, one can infer that the notion of privacy is simply abandoned.
IP address, device type, device platform, search history, and links clicked on results pages are some of the instances of data collected by major search engine companies.
However, they do not necessarily need to collect all that data, compromising users’ privacy. So, what kind of data do Qwant and DuckDuckGo collect on their users?
The Qwant search engine service, according to Qwant, aims to gather as little information as possible. While this is partially accurate, it still gathers some information that could violate your privacy, such as your IP address, search phrases, preferred languages, and news trend data. The privacy of the user is heavily prioritized in the data processing methods used by Qwant. To be fair, they made a significant effort.
Qwant's weakness is that it largely depends on outside services, some of whose privacy policies may not always protect the privacy of users. Qwant, for instance, relies on Microsoft to conduct ad services for revenue purposes. For this, it needs to collect and share the IP addresses and search terms of its users with Microsoft. Some of us may be aware that Microsoft is not exactly a privacy pioneer.
However, Qwant asserts that it does not transmit search terms and IP addresses together. Instead, to make it difficult for the parties concerned to link search phrases to IP addresses, search terms, and IP addresses are transmitted differently utilizing several services.
In other words, they hinder the ability of outside services to create a profile of you. However, some contend that the sheer fact that Qwant gathers this data constitutes a potential privacy breach.
In ideal terms, the right amount of data collected is ‘no personal data at all.’ Your IP address, cookies, search terms, or any other personally identifiable data are never collected by DuckDuckGo. Every time you use the DuckDuckGo search engine, you are in fact using it as an entirely new user. There is no way for DuckDuckGo to determine if you have been there previously.
Most of the data generated as a result of your interaction with the DuckDuckGo is destroyed once you exit the search engine. This is part of the reason why DuckDuckGo does not have a clear idea of just how many people use its search engine.
Clearly, in terms of data collection and sharing their user data with a third party, one can conclude that DuckDuckGo is the most privacy compliant in comparison with Qwant.
Search leakage occurs when a search engine fails to properly delete or anonymize data that can be given to a third party when you click on a link on search result pages. Your search history, browser history, and in some situations, cookies are a few examples of data that might be compromised.
In order to prevent search leaks, both DuckDuckGo and Qwant have implemented a number of precautionary measures, including, but not limited to the encryption of your data.
However, a challenging privacy problem for both search engines is that they store your search terms in the URL of their result pages. While it does not appear to be a privacy issue, it is. Both DuckDuckGo and Qwant unintentionally reveal your search history to the browser of your choice by keeping your search keywords in their URL parameters.
This implies that despite your best efforts, everything you may have done to keep your search private could be undone if you use a browser that monitors your browsing activity, particularly how you use search engines.
In terms of search leakage, neither DuckDuckGo nor Qwant convincingly outperforms the other.
If one needs a less invasive option than the likes of Google, Bing, and Yahoo, then either Quant or DuckDuckGo could be an alternative. Both search engines take great care to ensure that whatever you do on their site concerns only your business.
However, if you prefer the strictest privacy options available, then DuckDuckGo might be a better choice.