Privacy concerns loom over 'new' Google domain registration service

Google's invitation-only Domains name registration service works a lot like the old one but raises new questions about privacy and ad scraping

The recently announced Google Domains registration service will go up against the likes of GoDaddy in the domain name registration business. For those who have registered domains with Google in the past, the "new" service looks a whole lot like the old service, which has been in place for years. But there's a potentially troubling twist that involves Google's penchant for scanning anything and everything to create targeted ads.

The official Google Domains beta test announcement seems straightforward enough:

We're beginning to invite a small number of people to kick the tires on Google Domains, a domain registration service we're in the process of building. Businesses will be able to search, find, purchase and transfer the best domain for their business -- whether it's .com, .biz, .org, or any of the wide range of new domains that are being released to the Web.

In fact, you've been able to buy domain names from Google for many years. The method for doing so is integrated into the setup steps when signing up for Google Apps for Business. For example, the Deployment Quick Start invites new Google Apps for Business customers to "Purchase a domain from Google through the sign-up flow using Google checkout" and includes step-by-step instructions to "puchase my domain from Google." There's even a Google Lab Exercise that includes detailed instructions for buying a domain from Google. "As you purchased your domain from Google, you will NOT need to take additional steps to verify your domain ownership and to activate mail -- it's all done for you automatically!"

Turns out that people who thought they were buying their new domains from Google were, in fact, being shuffled off to GoDaddy or eNow -- one of Google's domain name "partners" who must be feeling distinctly unpartnered at this point, as Google moves in to shut them off.

The beta apparently offers new domains at $12 per year, which is the same price currently charged for Google domains in the Google Apps for Business signup process. Fair enough.

The big unanswered question: What about privacy of data stored on the domain? If Google is your registrar, can Google reach in and finger all of the data associated with the domain, in pursuit of better-honed advertising?

I turned to the Google Apps Administrator security and privacy statement. Realizing that Google Names is different from Google Apps for Business, the points made are the closest I can find to what we might expect from the new domain registration service:

Google may only share information with third parties in conformity with our Privacy Policy and your Customer Agreement. Google does not share or reveal private user content such as email or personal information with third parties except as required by law (see the Google Transparency Report), on request by a user or system administrator, or to protect our systems. These exceptions include requests by users that Google's support staff access their email messages in order to diagnose problems; when Google is required by law to do so; and when we are compelled to disclose personal information because we reasonably believe it's necessary in order to protect the rights, property or safety of Google, its users and the public.

That's certainly reasonable, but it gets more complicated:

Our systems scan and index emails and some other user data for multiple purposes; this scanning is 100% automated and cannot be turned off. Scanning enables us to, for example, perform spam and malware detection, sort email for features like Priority Inbox, and return fast and powerful search results when users search for information in their accounts. The scanning and indexing that our systems run also enable us to display contextually relevant advertising, including in Gmail. If your domain disables ads, we will not use your data to display such advertising to your users. Domains using the free Standard Edition of Google Apps cannot disable ads.

Cue the Red Wedding music from "Game of Thrones."

As best I can tell, Google has not yet released a privacy statement for these new really-Google-registered domains. GoDaddy and eNow domains presumably follow their own rules.

It'll be interesting to see if Google can wean itself from its snooping ways.

This story, "Privacy concerns loom over 'new' Google domain registration service," was originally published at Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow on Twitter.

Copyright © 2014 IDG Communications, Inc.