Kurt Opsahl [Senior Staff Attorney, Electronic Frontier Foundation]: "Over the past few weeks, Google's new social networking service, Buzz has upset a lot of people over inadvertent disclosures of personal information. The underlying privacy issue is that many users inadvertently published the list of the people they email and chat with most frequently using the Gmail and Gchat services that Google provides.

Under the original configuration, if you took the default options and didn't opt-out or edit this list during profile creation, this list became part of your profile, and thus becomes available to the public. Yet, these email and chat contacts are not necessarily people you want to advertise as friends via a public social network. Consider the issues with reporters and sources, doctors and patients, you and your former significant others, etc.

These problems arose because Google attempted to overcome its market disadvantage in competing with Twitter and Facebook by making a secondary use of your information. Since it is difficult to import lists of social network contacts, Google attempted to jump-start Buzz with lists drawn from its successful Gmail and Gchat services. While this may help Buzz grow and save users the time to type in all their contacts, it also has an inherent danger of inadvertent disclosure of private information.

Responding to criticism (including EFF's), Google moved away from the system in which Buzz automatically sets you up to follow the people you email and chat with most, and adopted an auto-suggest model, in which you are shown the friend list with an option to de-select people before publishing the list. While a full opt-in model would be less likely to result in inadvertent disclosures of private information, this is a significant step forward.

Though Google responded quickly to these privacy concerns, they never should have happened in the first place. While Buzz previously had a lot of these privacy options available, the user interface failed to provide users with the setting users had reasonably expected. Google should follow fair information practices and make secondary uses of information only with clear, unequivocal user consent and control, and test these controls to ensure that the default settings match with the expectations of the user."