Structural risks
These risks apply to every Google (Alphabet) product. They are legal obligations and corporate
practices that individual products cannot override. A subsidiary cannot opt out of an
FTC consent decree. A company cannot selectively ignore its home country's intelligence
law for one product. These risks set a grade floor of
D — no Google (Alphabet) product
can score better than this, regardless of its own privacy settings.
critical
PRISM participant since 2009
2009-01-14
Google has been a confirmed PRISM participant since January 2009. Under this programme, the NSA can collect stored communications directly from company servers.
high
CLOUD Act jurisdiction (US)
2018-03-23
As a US company, Google must comply with the CLOUD Act, which allows US law enforcement to compel disclosure of data stored anywhere in the world.
high
$170M COPPA violation (YouTube Kids)
2019-09-04
Google paid $170 million to settle FTC charges that YouTube illegally collected children's personal information without parental consent.
high
Cross-product data consolidation
2012-03-01
Google merged privacy policies across all its products in 2012, allowing data collected by any Google product to be combined and used across all others. Your YouTube history feeds Search ads, Gmail content shapes Maps suggestions.