The change in privacy policy was also coordinated with a chang in login procedures that had been in the works for several years as Google management sought to rationalize its array of services from a multiple-login ID process to a single Google account login that would give users access to all Google services.Since 2011,for instance, YouTube users have been required to login to a separate Google+ account if they want to login into YouTube services. when users create a user account, they automatically create a Gmail account and actomatically join Google+.In this sense, the new emphasis on a single point of entry to Google's services mirrors that of Facebook where there is a single login to a variety of services that Facebook has added to over time.In addition, a single login allows Google to cross-sell its services by automatically enrolling new accounts into various services. At the same time, the new pooling of personal information into a single account allows Google to sell more and better-targeted advertising based on a more detailed, fine-grained understanding of its users.
Despite its earlier statements supporting separateand unique services and accounts, by January 2012 Google had arrived at a position of becoming an all-encompassing,integrated Web presence that surrounded its users with a bevy of services,but also collected an extraordinary amount of personal information from multiple consumer activities.
within days of Google announcing its new privacy policy, EU authorities announced an investigation into the changes. France's data protection agency, CNIL, took the lead in a Europe-wide investigation of Google's pooling data on users gathered at any of its web service sites. The CNIL expressed doubts about the lawfulness and fairness of Google's processing of information from all its sites, and doubted it was incompliance with European data protection legislation. The European Commission had just recentlyoverhauled its 17-year-old data protection rules in January 2012. under the proposed new EU privacy rules (the General Data Protection Regulation), firms like Facebook, Google, Apple, and others that gather personal information would be required to ask users for their permission to store and sell their data to other businesses and advertisers. Firms are required to be transparent about how they use personal information.This is anathema to firms whose entire business model is based on the ability to use whatever personal information can be collected for business purposes, such as selling advertising or products and services.
In February 2012, CNIL requested that delay implementing its new privacy policy. Google claimed its new policy was in compliance with EU laws, and implementing the policy on March 1, 2012 despite objections from EU authorities. In the United States, a Similar reaction occurred, with eight lawmakers sending a letter to Google managerment objecting to the consolidation of users information and the potential for endangering consumers' privacy. Google has argued that users can search anonymously or while logged out of any Google service to avoid being tracked by Google, and they can use separate accounth on different Google services to keep their personal data in separate silos and avoid it falling into a pooled set of data. Users can control their ad preferences to some extent, and turn off their Web history.
In October 2012, 27 EU national privacy regulators sent a letter to Larry page, the CEO of Google, asking Google to modify its privacy policy and bring it into compliance with EU data protection laws and concerns. Claiming Google's new policy permitted
an unprecedented combination of data across different Google services, the regulators asked Google to modify its policy so that users would have a clearer understanding of what personal data is being collected, and can better control how that information will be used by Google and advertising firms. The regulators claimed that Google's new privacy policy did not give users any idea about how the information is being used or processed, or stored. On the matter of consent, the regulators disagreed with Google's claim that it was collecting personal data with the users' consent, only when users "opted in." The regulators pointed out that "opting in" for Google meant clicking the "I Agree" button before using a service. If the user wants to use the service, there is no option to opt out of Google's use of their personal information. The only way to maintain their privacy is to not use the service. By clicking "I Agree," users have to agree to allow Google to use their tion will be used or treated. The regulators gave Google three months to respond to their requests for a change in policy. Google responded by saying that it already complied with EU law and that it had worked closely with the CNIL to ensure its policies were lawful .
In February 2013, privacy regulators from France and other EU nations escalated their efforts by calling for "repressive actions," mostly fines. In June , tne CNIL issued a 15-page order finding that Google's use of personal data violated French law, and ordered six remedies, including disclosing how long it retains each type of user data, providing user consent to gather data, and stopping the combination of data from different Google services without a legal basis. It once again gave Google three months to make changes in its policy. Google, as it had previously, responded by issuing a statement claiming that it was fully compliant with EU and French law. In September 2013, the CNIL initiated a
court -like proceeding against Google seeking fines for failure to comple wiht the law. The agency can impose fines of up to €150,000, which is a pittance for a $50 billion firm like Google. However, the agency is considering classifying every Google user in France as an infraction. This would multiply the fine to a size that Google would likely take seriously.
European privacy authorities are pressing their case against Google's privacy policies. In September 2014, the main European agency for privacy regulation wrote a letter to Larry Page warning the company that it was failing to meet its privacy obligations throughout Europe. The regulators suggested Google offer users a simple switch that would allow them to turn off Google's ability to mix data from its many services. The letter also claimed Google had failed to properly implement the decition of Europe's highest court, the European Court of Justice in Luxembourg, which in June 2014 supported a Spanish lower court decision declaring that individuals have the "right to be for gotten" and can request search services like Google to expunge their personal information from Google's search engine. Google initially resisted this idea, but began implementing the policy in Europe only, and by November2014, had processed over 180,000 requests from individuals to remove their records. In December 2014, the French data protection authority declared that Google must implement the right to be forgotten across the globe and not just in Europe.