After seeing this, I decided to dive deeper into my data console to see what else Google was storing about me that I might not have thought about. My next step was the “addresses” panel.
I thought this page would be interesting since I travel so much for work. Did it include only the address I gave Google in my settings? Was it only addresses I stayed at for X number of hours? Did it collect every place I’ve been? Was it collecting addresses I put into services across the web even though I didn’t tell Google to store this information? I was curious, especially after finding out about the “Not Saved” passwords database.
What I found was a long list of addresses, many of which were directly related to me and were addresses I’d clearly entered into the browser at one point or another, for various reasons. However, I also found several other pieces of information I did not expect and that actually were a bit creepy even to me, someone who spends his days trying to de-creepy the web.
For one, there’s my mom’s info. This was interesting. Maybe I entered this? Maybe it was in my contact information stored somewhere on my phone? Maybe it was scraped from an email or a purchase I made somewhere at some point? Who knows. I’m sure it wouldn’t be hard to link my mom and I to each other based on my internet activity. So while this was interesting, I wasn’t overly disturbed. I continued on.
Further down the list I found other, more unsettling revelations about what Google knows about me. It turns out Google has info connecting me to my grandma (on my dad’s side) who’s alive and well but has never had the internet, and my grandpa (on my mom’s side), who recently passed away in March 2019 and also never had the internet.
This was disturbing for several reasons, the biggest of which being that neither of them had ever logged onto the internet in their lives. Neither even had the internet in their homes their entire lives! Beyond that, Google knew their exact addresses and their middle initials. I couldn’t even have told you those things about my grandparents. Sure, I could drive you to their houses, but I couldn’t tell you their address off the top of my head. And lastly was the format of the data entry. The all-caps address on my grandpa’s account really threw me off because it made me feel as if the info was machine processed at one point or another, because I don’t enter information in all caps anywhere except in my handwriting, on paper. After seeing this, I began to investigate how Google might have 1) gained access to this info and 2) connected it to me.
There are only a handful of ways I could immediately think of to explain how Google could have done this:
- The simplest and most obvious answer is that I entered my grandpa's information online for him somewhere. But I didn't. I’m near 100 percent certain this isn’t the case. How can I be so confident? I didn't even know my grandpa’s middle initial. I was always told growing up that he didn’t have a middle name.
- I used my grandpa's information as a secret password phrase. I doubt it. And even if I did, I would have probably only used “Reyzlik” as a statement to “What’s your mother’s maiden name?” I definitely would not have entered his entire name. And I definitely didn't give them his full address if I did. At most I might have said my grandpa lived in Blair, Nebraska or something like that.
- I entered my grandpa's information in my contacts. I didn’t. I checked my records and all I had in my phone (or email contacts) was his business name and phone number. This sounds weird but if you know my family you’d know that my grandpa worked 32 hours a day so I had no reason to keep his home phone or his address. To this extent, I didn't even have his name as the contact title, it was labeled as "Ace" like Ace Hardware, his store. [See photos]
- My parents entered his information when I was logged into their home desktop between April 2019 and June 2019 while my computer was getting fixed after serious water damage. I thought this might have been a real possibility. However, I found out that they had not. He passed away on March 1st, 2019 and they said the only time they’ve used his information anywhere is with the lawyers, estate managers, bankers, etc who were helping in the process of our family dealing with his death.
That means the data wasn't manually entered by me or anyone using my account, but yet the data is associated with my account? How did that happen? The only thing I can think of is that at one point in history my grandpa gave his information to someone or some company in real life and his information was sold to Google at one point or another. Totally reasonable. Totally legal. But then that led me to another question: How did his data get associated with my Google account? Here are a few scenarios I ran through:
- Did they use geolocation to put us together? I’d say this is highly unlikely because my grandpa carried a feature phone that would require Google to tie an (supposedly) unidentified account to mine using CSLI information because he didn’t have any Google Accounts. Possible, but I’m going to say highly unlikely.
- My last name is Toscano and his is Reyzlik. Did they associate him with my mom whose maiden name is Reyzlik then associate him with me because of that association? I’m not sure. That seems unlikely and would (in my mind) probably mean they are creating some type of ancestry tree with the data they've collected on the world. Possible. But I’d like to hope that’s not the case.
Other questions I have:
- What other information does Google have about me/my family/others that I don’t know about?
- Where did this information come from in the first place? Was it marketers? Was it someone creating an account on his behalf and potentially trying to attempt identity theft?
- And ultimately, how did they connect us? We've never been Facebook friends. He's never sent me an email. The guy literally never had the internet, or a need for it, in his entire life.
Getting to the Root
Needless to say, I turned off the "Offer to save passwords" option and deleted any info I didn't want Google to have access to anymore. When I get some extra time my next steps are to 1) download my data and dig through it to find out how Google connected me to my deceased grandpa and 2) to see if Google erased the data I told them to erase or if it just allowed me to delete it from the page I was viewing. In neither case do I have any fundamental rights to know this, but I’m going to try my best to figure it out.
In the meantime, do you have any ideas as to how Google connected me to my dead grandpa? Any insights on whether or not Google is creating an ancestry type database? Any tips on how to find the root of this issue both for me and for others who may have experienced the same thing? Please comment below or email me directly. I look forward to hearing your insights and potential solutions to the issues!
To check out your data and see what Google knows about you, here are a couple immediate resource links:
If you're interested in seeing what addresses/people Google has connected to you, go to: chrome://settings/addresses
If you’re interested in seeing what credentials Google has connected to you, go to: chrome://settings/passwords?search=credentials
This article seems to have gotten a lot more attention than I would have imagined. I thought this would be a small issue that might spark some conversation around privacy and data rights so let me be clear: The point of this was not to claim illegal behavior by Google. I understand scraping of web data and purchasing of data is currently legal, that many companies do it, and that more than likely this all got put together in a legal way. It was simply to provoke thought as to how things connect and why we willingly allow this to happen. And clearly it provoked a conversation.
The question I’m going to leave you with is this: Is this how we want to carry on? Just because something is legal doesn’t mean it’s right. What would you like to see done? How would you like to see things changed?
I will be writing follow up articles that dive into other, more substantial issues in the coming months that I’ve been checking into for several months to make sure the proper steps have been taken to audit. If you have direct questions or thoughts, feel free to reach out.