Is Google Drive worse for privacy than iCloud, Skydrive, and Dropbox?

The Google Drive cloud storage service launched yesterday to much fanfare, but as with any new Google product, there are important questions about how the company will actually use personal data uploaded to the system. Google sells ads against your data, after all, and the more data you give the company, the more opportunity it has to screw up. That means the Google Drive terms of service and privacy policy are critically important, and there's been a lot of selective interpretation floating around the web in the past 24 hours — and a lot of comparisons to the privacy policies of competitive services like Dropbox and Microsoft's SkyDrive.

That's great — all web services should be subject to harsh scrutiny of their privacy policies — but a close and careful reading reveals that Google's terms are pretty much the same as anyone else's, and slightly better in some cases. Let's take a look.

Google Drive

Google's biggest problem with the Google Drive privacy policy is that there isn't actually a specific Google Drive privacy policy — there's just Google's new unified terms of service and privacy policy. The move to combine and simplify the company's various service-specific terms into comprehensive documents earlier this year met with a great deal of criticism and even international scrutiny, but Google seems determined to maintain just one set of documents for users. That means the company has to use fairly expansive language to cover all the bases, and it can be a little off-putting. Here's the section from Google's terms of service that's causing all the controversy today, with my emphasis in bold:

Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.

When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones.

That's a lot of rights to give Google, on the face of it — in fact, it's basically every right you can give to Google as a copyright holder. But think about how limited Google's services would be if it didn't have permission to use, host, store, modify, communicate, publish, or distribute your content — it couldn't move files around on its servers, cache your data, or make image thumbnails, since those would be unauthorized copies. It couldn't run Google Translate or Google Image Search. It would be illegal to play YouTube clips in public. In short, Google is giving itself all the permissions it could possibly need to run all of Google services, with the specific limitations that it doesn't own anything you upload and it can't use your data beyond running its services.

Google is giving itself all the permissions it could possibly need

But what about that line about granting rights for "promoting and improving our Services," you ask? Can Google sniff around individual users Drive folders and use their images as the background on google.com? Well, no. Not only would that be insane corporate suicide, but that sort of behavior is forbidden by the Google privacy policy, which says:

We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones, and to protect Google and our users. We also use this information to offer you tailored content - like giving you more relevant search results and ads.
[...]
We will ask for your consent before using information for a purpose other than those that are set out in this Privacy Policy.

Again, it's expansive language, but it's clear that Google's after the ability to run its services and sell targeted ads, not dig around in your Drive folders. It would be a lot simpler for Google to offer a custom Drive-specific terms of service and privacy policy that set all of this out more directly, but as long as the company insists on having just one set of documents, this sort of expansive-but-limited language is what we're left with.

Update: Google just sent us the following statement to clarify its terms of service:

As our Terms of Service make clear, "what belongs to you stays yours." You own your files and control their sharing, plain and simple. Our Terms of Service enable us to give you the services you want — so if you decide to share a document with someone, or open it on a different device, you can.

Looking at some of Google's competitors, it's clear that they need the exact same permissions — they just use slightly more artful language to communicate them.

Dropbox

Dropbox's terms of service and privacy policy are much friendlier than Google's, and they only cover one product — Dropbox. That means they can be slightly more tailored to the service itself. Here's the relevant portion, again with my emphasis in bold:

By using our Services you provide us with information, files, and folders that you submit to Dropbox (together, "your stuff"). You retain full ownership to your stuff. We don't claim any ownership to any of it. These Terms do not grant us any rights to your stuff or intellectual property except for the limited rights that are needed to run the Services, as explained below.

We may need your permission to do things you ask us to do with your stuff, for example, hosting your files, or sharing them at your direction. This includes product features visible to you, for example, image thumbnails or document previews. It also includes design choices we make to technically administer our Services, for example, how we redundantly backup data to keep it safe. You give us the permissions we need to do those things solely to provide the Services. This permission also extends to trusted third parties we work with to provide the Services, for example Amazon, which provides our storage space (again, only to provide the Services).

That language is definitely friendlier than Google's, but it's actually more expansive, since it's more vague. Where Google specifically lists the rights and permissions it needs to run its services using precise legal terminology like "create derivative works," Dropbox just says you're giving it "the permissions we need" to run its services.

Dropbox's softer language means vaguer boundaries

Exactly what those permissions are is left unsaid and undefined — and could change as Dropbox changes the types of services it provides. Softer language means vaguer boundaries. It's up to you to decide what you're more comfortable with.

Skydrive

The terms link on the bottom of Microsoft's SkyDrive page is actually broken and redirects to MSN, which is cute. But once you find Microsoft's global terms of service, they're actually pretty great — a masterpiece of plain-language legal dealing. (My favorite is this charming preamble: "If you don't agree, don't use the service. Thanks.") Here's the relevant section, again with my emphasis in bold:

Except for material that we license to you, we don't claim ownership of the content you provide on the service. Your content remains your content. We also don't control, verify, or endorse the content that you and others make available on the service.
[...]
You understand that Microsoft may need, and you hereby grant Microsoft the right, to use, modify, adapt, reproduce, distribute, and display content posted on the service solely to the extent necessary to provide the service.

That's pretty much exactly the same set of rights Google is asking for, with the same limitations. The reasons are the same, as well: Microsoft needs to be able to move and change your content at will in order to run its services. And since Microsoft's terms are also global, you've got the same set of issues granting it an expansive license to your content as you do with Google — "the service" isn't defined to strictly mean "SkyDrive" anywhere.

Microsoft takes a much harder line against copyright infringement than Google

Microsoft also takes a much harder line against copyright infringement than Google, saying it reserves the right to delete content if you violate the terms:

If you share content on the service in a way that infringes others' copyrights, other intellectual property rights, or privacy rights, you're breaching this contract.
[...]
We may refuse to publish your content for any or no reason. We may remove your content from the service at any time if you breach this contract or if we cancel or suspend the service.

By contrast, Google and Dropbox just generally say they will comply with the DMCA, and Dropbox additionally asks that you don't upload other people's intellectual property while making it clear that any liability for your actions is your own. Apple... well, we'll get to Apple.

iCloud

Apple's iCloud service is a little bit different from Drive and the others in that it doesn't provide direct document storage in folders, but it still stores an awful lot of user data in Photo Stream and Documents in the Cloud. And as you'd expect, Apple needs to give itself permission to handle that data. My emphasis in bold:

Except for material we may license to you, Apple does not claim ownership of the materials and/or Content you submit or make available on the Service. However, by submitting or posting such Content on areas of the Service that are accessible by the public or other users with whom you consent to share such Content, you grant Apple a worldwide, royalty-free, non-exclusive license to use, distribute, reproduce, modify, adapt, publish, translate, publicly perform and publicly display such Content on the Service solely for the purpose for which such Content was submitted or made available, without any compensation or obligation to you.

[...]

You understand that in order to provide the Service and make your Content available thereon, Apple may transmit your Content across various public networks, in various media, and modify or change your Content to comply with technical requirements of connecting networks or devices or computers. You agree that the license herein permits Apple to take any such actions.

Again, that's pretty much exactly what Google and Microsoft's policies say, for the same reasons. Apple goes one step farther in explaining that it will modify your data for the purposes of transmitting it across networks and displaying it on different types of devices, but the other companies lump that in under the permissions they need to run their services.

Apple says it can delete "objectionable" content at any time

In terms of copyright infringement, Apple says it will comply with the DMCA, and reserves the right to terminate the accounts of "repeat infringers." Apple also goes one step farther and says it can remove content at any time if it's found to be "objectionable":

You acknowledge that Apple is not responsible or liable in any way for any Content provided by others and has no duty to pre-screen such Content. However, Apple reserves the right at all times to determine whether Content is appropriate and in compliance with this Agreement, and may pre-screen, move, refuse, modify and/or remove Content at any time, without prior notice and in its sole discretion, if such Content is found to be in violation of this Agreement or is otherwise objectionable.

That's the harshest line yet — Apple says it can scan and delete any data it wants at any time if that data is "objectionable," without strictly defining what "objectionable" actually means. That's probably not going to be an issue for the vast majority of iCloud users, but it's something to think about if you're putting anything sensitive or on the fringe into your iCloud account.

Wrap-up

So what have we learned? Well, in order to run a massive online service that handles tons of user data, you need a lot of permissions from those users. Those permissions are fairly standardized, since the underlying copyright law itself is static — companies like Microsoft and Google need permission to copy and distribute your content to servers around the world to make services like Drive and SkyDrive work well. There's also a tension between friendly language and legal precision — drawing in sharp lines often requires aggressive wording, while there's real comfort in vagaries.

What's most important is how much trust you're willing to give away as your data moves to the cloud

In the end, though, the actual wording of these documents doesn't reveal much — they all set out to do the same thing, and they all accomplish their goals. What's most important is how much trust you're willing to give companies like Google, Microsoft, Apple, and Dropbox as more and more of your data moves to the cloud. Contracts are meaningful and important, but even the most noble promises can easily be broken. It's actions and history that have consequences, and companies that deal with user data on the web need to start building a history of squeaky-clean behavior before any of us can feel totally comfortable living in the cloud.