To briefly state the obvious, the internet giants are seriously big: Google is not only the world's largest search engine, it's one of the top three email providers, a social network, and owner of the Blogger platform and the world's largest video site, YouTube. Facebook has the social contacts, messages, wallposts and photos of more than 750 million people.
Given that such information could be used to sell us stuff, accessed by government or law enforcement bodies (perhaps without warrants, under legal changes), or — theoretically, at least — picked up by hackers or others, it's not unreasonable to wonder exactly how much the internet giants know about us.
In the U.S. and EU
U.S. users of the sites are out of luck: there's no legal right under U.S. law to ask a company to hand over all the information it holds on you. Users do have some say in how much companies are allowed to take, usually contained in the terms of service.
But EU citizens are in a better position — under Europe-wide data protection rules, anyone can send a written request for their full data and, for a small fee, the company has to ship it out, usually within 40 days.
It's a great chance to see exactly how much Google and Facebook really know about us, and all we need is a test subject. Perhaps an EU citizen who's been on Facebook since it came to the United Kingdom in 2005; who's had a YouTube account almost as long; and was on Gmail back when invitations to the service were something to beg, borrow and steal, rather than a nuisance. They'd also have to be enough of an idiot to write about what they dig up in public. This left one obvious, unlucky test case in the Guardian offices: me.
Things didn't get off to a great start with Google. The company has a main U.S. branch, Google Inc, and subsidiaries within other countries. In the U.K., that's Google U.K. Ltd. Here's the catch: Google U.K. Ltd., which is subject to the EU rules that let you access your data, doesn't hold it. A spokeswoman for the U.K. regulator, the Information Commissioner's Office, confirmed that EU laws on subject access requests do not extend to the U.S. parent company.
Thankfully, Google isn't totally unhelpful. It has two tools that help show the information it holds on you. The first, Google Dashboard, has run for about three years and gathers information from almost all of Google's services in one place.
Another feature, the account activity report, has launched recently, and shows Google's information on my logins in the past month, including countries, browsers, platforms and how much I've used the services. Running these tools on my work email account (the Guardian's emails are managed by Google) is disconcerting. The dashboard can see I'm a member of a few internal Google groups, and have a blogger account used to collaborate with some researchers on Twitter riot data.
Data showing my work-gmail account has 877 contacts — and listing them — gives me some pause for thought, as does a list of the 398 Google docs I've opened. The site also lists my most recent sent and received emails.
A little more disconcerting is a chat history logging 500 conversations with 177 colleagues. Google chat is a handy way to collaborate in a large building, especially one full of journalists who seem to prefer to talk online (as Twitter activity testifies) rather than in the flesh.
The big relief comes when I note Google isn't tracking the internet searches I've made on my work account. Repeating this exercise for my personal Google account is less relaxing. There are several bits of extra information here. The most innocuous is a heavily neglected Google+ profile with a few hundred connections but almost no posts.
Slightly more embarrassing is a seemingly connected YouTube account, apparently set up at a time when I thought using character names from role-playing games was a good account-naming policy.
It has only one surviving video — a student interview with Heather Brooke — but does link to my viewing history, which includes the Tottenham riots, Dire Straits, Pomplamoose and, bafflingly, a Q&A from the Ryan commission into child abuse in Ireland.
News was “youtube user figures,” showing I am meticulous in my research. Mortifyingly, my last blogs search was a vanity one: “james ball.” Google also holds information on my login IPs, and other anonymised non-logged-in data, but doesn't (yet) make this available.
There was some relief from the gloom though. Google insists the tracking for its display adverts — it is the market leader in online advertising — doesn't draw from user data, but comes instead from cookies, files that anonymously monitor the sites you visit. Google's ad preference page believes I am interested in online video, TV reality shows, printers, Egypt, politics and England. From this, it has concluded I am likely to be over 65 and male. I find myself more reassured than offended that Google has got this more or less wrong.
and Facebook
Facebook is a much trickier prospect. Unlike Google, Facebook processes some data in the EU, through its Irish branch, making it subject to access laws. These take up to three months due to a large volume of requests from campaigners, so I once again resorted to the site's own tools.
Facebook's main download tool was familiar. A downloaded archive that opens into something looking oddly like a stripped-down, uncluttered Facebook, this lists all my friends, every post ever made on my wall, my private messages and photos.
The Facebook extended archive is a little creepier. Every event to which I've ever been invited is neatly listed, alongside its location, time, and whether I said I would attend.
One piece of information — a supposed engagement to a schoolfriend, Amy Holmes — stands out. A Facebook “joke” that seemed faintly funny for about a week several years ago was undone by hiding it from any and all Facebook users, friends or otherwise (to avoid an “... is now single!” status update). The forgotten relationship helpfully explains why Facebook has served me up with bridalwear adverts for several years, and reassures me that Facebook doesn't know quite everything.
Or does it? There are gaping holes in what Facebook has made available to me. No posts from other users in which I'm mentioned are included, not even from my friends. None of the 300+ photographs in which I feature, uploaded by friends and family, are there.
Campaigners estimate that only around 29 per cent of the information Facebook possesses on any given user is accessible through the site's tools.
The tour through a decent swath of my personal data is at once disturbing and comforting. Disturbing because it reminds me mine is a life lived online. Among the huge tranche of information available to Google and Facebook alone is virtually everyone I know, a huge amount of what I've said to (and about) them, and a vast amount of data on where I've been. Such detailed tracking would have been an impossibility even 10 years ago, and we're largely clueless as to its effects.
This is the core of the main comfort: despite their mountain of data, Google and Facebook seem largely clueless, too — they've had no more luck making any sense out of it than I have. And that, for now, is a relief. © Guardian Newspapers Limited, 2012
