Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Google Businesses Privacy The Internet

Google Maintains a List of Everything You Ever Bought Using Gmail, Even if You Delete All Your Emails (cnbc.com) 120

Posted by msmash from the google-knows dept.
Todd Haselton, reporting for CNBC: In May, I wrote up something weird I spotted on Google's account management page. I noticed that Google uses Gmail to store a list of everything you've purchased, if you used Gmail or your Gmail address in any part of the transaction. If you have a confirmation for a prescription you picked up at a pharmacy that went into your Gmail account, Google logs it. If you have a receipt from Macy's, Google keeps it. If you bought food for delivery and the receipt went to your Gmail, Google stores that, too. You get the idea, and you can see your own purchase history by going to Google's Purchases page.

Google says it does this so you can use Google Assistant to track packages or reorder things, even if that's not an option for some purchases that aren't mailed or wouldn't be reordered, like something you bought at a store. At the time of my original story, Google said users can delete everything by tapping into a purchase and removing the Gmail. It seemed to work if you did this for each purchase, one by one. This isn't easy -- for years worth of purchases, this would take hours or even days of time. So, since Google doesn't let you bulk-delete this purchases list, I decided to delete everything in my Gmail inbox. That meant removing every last message I've sent or received since I opened my Gmail account more than a decade ago. Despite Google's assurances, it didn't work.
This discussion has been archived. No new comments can be posted.

Google Maintains a List of Everything You Ever Bought Using Gmail, Even if You Delete All Your Emails More

Google Maintains a List of Everything You Ever Bought Using Gmail, Even if You Delete All Your Emails

Comments Filter:

  • Google remembers everything (Score:5, Insightful)

    by duke_cheetah2003 ( 862933 ) on Friday July 05, 2019 @01:04PM (#58878402) Homepage

    Google has enormous data centers. What did you think was on all those storage devices? Search indexes? Hahaha. Google probably has a record of every interaction you've had with their infrastructure.

    • Google probably has a record of every interaction you've had with their infrastructure.

      Wink wink, nudge nudge. Say no more, say no more!

    • They profile you from your data and the smarter the analysis becomes the less valuable the data is to retain. Revisions may require the data to reprocess which is why they began to allow users to opt-out of some of the information until someday they will NOT retain your personal information beyond the minimum... seconds maybe.

      The analysis of your information is GOOGLE PROPERTY and you have no rights to it or even know what that information is. It may be done in real time; which should be their goal as they

      • Re:NO!! They do not need your data! (Score:5, Informative)

        by Kjella ( 173770 ) on Friday July 05, 2019 @02:56PM (#58878994) Homepage

        They profile you from your data and the smarter the analysis becomes the less valuable the data is to retain. Revisions may require the data to reprocess which is why they began to allow users to opt-out of some of the information until someday they will NOT retain your personal information beyond the minimum... seconds maybe.

        That's not how this works. They want to look at correlations which means tracking over time. While they generally disconnect your identity before analysis and other use cases, they retain the link so they can append more data. Otherwise they'd have no way of knowing that the person who visited Slashdot now also visited Ars Technica two minutes ago. Since you usually don't know in advance all the analysis that is useful you prefer to keep the raw data stream if you're legally allowed to. Even though that's de-identified it can be reverse identified if someone has specific knowledge of something you did, for example you're the only customer living in area X that ordered product Y in time period Z.

        Trust me, I've worked a lot with this and systems that are supposed to give you aggregate data, without allowing you to drill down into individual records. It's complicated and it's only a filtering layer on top of the raw data. It's still all there and technically there's no such thing as a one-way anonymization, if bussdriver (620565) is advertisingId 452352433 then technically we can do the same in reverse. Not always legally, but that's a different story. I've worked with marketing data, financial data, medical data... it all works the same way. What we do try for is a separation of concerns so not one person is able to piece it all together, but if we as an organization conspired to disrobe you we sure could.

        • I too work with large amounts of data, hopefully anonymized for most purposes, but the shit some of the people i work with have access to is scary.

          For instance if Google were to use some of these newfangled wifi signal strength attenuation techniques they could guess your approximate location whenever you used wifi on your phone, under the guise of trying to manage your data under the hood. If you're using mobile data they can definitely track you from cell to cell. This all seems relatively harmless (to

    • Google probably has a record of every interaction you've had with their infrastructure.

      Probably even the mouse movements on their pages.

    • i like how on the previous article about google auto deleting location history, when i made a joke about not trusting them to actually do it, i got scolded. and now more proof google deletes nothing. which never should have been a surprise to anyone.

  • Easily avoided (Score:4, Funny)

    by DontBeAMoran ( 4843879 ) on Friday July 05, 2019 @01:07PM (#58878414)

    That's why I buy everything from Amazon, with an Amazon email address.

    • That's why I have my own domain hosted on Fastmail.com for emails (pretty cheap!).

      • And I have a bunch of aliases so if I got spammed on one of my alias, first I know where it came from and second I just trash it and create a new alias. Ex: amazon@mydomain.com, ebay@mydomain.com, apache@mydomain.com, ...

        • I do that too, so when Comcast sold my contact info to T-Mobile I knew exactly who did it and that they were lying when they said they didn't.
          I used this at work as a coal mine canary. Vendors who sell your contact info won't stand behind the sale. Vendors who've been good, but start doing that are facing bankruptcy and are doing unethical things on the way down. I've gotten out early, saving my employer downtime using this one trick!

    • ...with an Amazon email address.

      Some people LIKE Google spying on them.

      I have a friend who bought 'plane tickets online and used his gmail address for the tickets.

      A few hours before his flight Google sent him a reminder that his flight was leaving soon and he was pleased about it!

    • I saw the article, and followed the links.

      The list was *completely* empty.

      I've had my gmail account since the early part of the invitation only period, and have bought oodles of stuff over the years.

      Of course, I've shut off every tracking and history option pretty much the day they appeared . . .

      The article (which I saw directly on CNBC before here) didn't suggest that he had turned off his various tracking options; just that he deleted his email . . .

      hawk

    • Re: (Score:1)

      by DogDude ( 805747 )
      You don't want Google tracking everything you buy, but you're ok with Amazon tracking everything you buy? Huh?

    • I'd like to laugh along, but are you certain that the google isn't capturing the transactions anyway?

      Reminds me of a funny story. When I heard about this mal-feature, I went to see what the google had on me.

      Turned out the only "purchase" the brilliant google managed to "capture" was from a spam complaint about a fake purchase via Amazon. The well-crafted phishing attempt was based on the scammer's theory that everyone has an account with Amazon. Too darned close to true, though I stopped using mine more tha

  • I went to the linked purchases page, and there were a handful of things there (a few things I'd purchased from the Play Store, and a few random Amazon purchases) but that's really it. I'm not sure how this guy is seeing information from all these other purchases.
  • I've bought a fair amount of stuff from Amazon and a few other places using my Gmail address for the email contact and confirmations and there's nothing listed on my Google purchases page. (maybe you're *special*) In any case, stop assuming something that happens to you happens to everyone.

  • Host your own (Score:1)

    by Anonymous Coward

    Mail-in-a-Box [mailinabox.email]

  • hundreds of thousands of receipts?

    A;so, if they're tracking perscriptions or medical information, there may well be HIPAA violations...

    • A;so, if they're tracking perscriptions or medical information, there may well be HIPAA violations...

      It's unlikely that Google is obligated to follow HIPAA. You can see more here [hhs.gov] under, "who is covered by the privacy rule."

      • Re: (Score:2)

        by tomhath ( 637240 )

        Something like "confirmation for a prescription you picked up at a pharmacy" is covered under HIPAA, and Google would likely be considered a business associate if they have access to the prescription.

        That's different from simply transporting the information (e.g. a courier who delivers a sealed envelope); Google is snooping on the contents of the envelope.

        • Google would likely be considered a business associate if they have access to the prescription.

          Having access to the information about your prescription doesn't make them a business associate, I don't know why you think that. Similarly, if I tell you about my preparation-H prescription, that doesn't automatically make you bound by HIPAA, even if you're a business.

    • Correct. HIPPA is Privacy.

      Know it.
      Learn it.
      Live by it.
      Sue by it.

      • Correct. HIPPA is Privacy. Know it. Learn it. Live by it. Sue by it.

        It's difficult to take advice from someone regarding HIPAA when they don't spell the acronym correctly.

        Get your shit together.

  • I mean come on now! (Score:1)

    by Anonymous Coward

    If people are honestly shocked anymore at the lengths Google and most major tech companies will go to use its user base and abuse their personal privacy, I've got news for them....it most likely is far, FARRRR worse than the GP knows about. They are, well most are anyway, all out for massive profits first, everything else a very distant second. You can't pay for houses in Silicon Valley or newer tech "hub" and vacation homes in foriegn countries with lax money laundering and taxation laws by NOT screwing ov

  • Hardly surprising they don't delete anything (Score:5, Interesting)

    by Mr_Silver ( 213637 ) on Friday July 05, 2019 @01:36PM (#58878552)

    I used to have a Google Calendar entry titled "Pay cleaner £21.25". That's just a pound sign but, you know, Slashdot and UTF8.

    When I added the ical URL to Outlook, Outlook would complain furiously that the pound sign had been incorrectly encoded. Eventually I deleted the entry from Google Calendar because the cleaners rates had gone up.

    Five years later and Outlook still complains about the pound sign being incorrectly encoded. At first I thought it was Outlook (because, you know, Microsoft) but I've manually downloaded the feed and, despite being deleted, it's still there.

  • Dude! Teh G READS YOUR FUCKING EMAIL! (Score:1)

    by Anonymous Coward

    What do you not understand?!

  • Just looked at my purchases. Not much to see. A book I bought last year on Google Books, two purchases of NFL Red Zone in 2017, though one was actually a cancellation.On 2016 I see an evaporation fan for a refrigerator (First purchase that MIGHT be seen from random Gmail), 2 apps from the Google Play store, another book from Google, and another Red Zone cancellation.

    That's it since 2015. Except for the fan, all were Google specific purchases. I know I bought many other things with receipts in Gmail which d

  • Why single out Google, I am sure pretty much everyone does it. It's like saying McDonald has junk food that will kill you... I hate it when people single out one company for something that everyone is doing. Have a dog in a fight, do we?

    • you've made an assertion without a shred of proof

    • It's like saying McDonald has junk food that will kill you... I hate it when people single out one company for something that everyone is doing.

      Weird, I went to a restaurant a few days ago and they didn't even sell any junk food.

      • Weird, I went to a restaurant a few days ago and they didn't even sell any junk food.

        What was on their dessert and alcohol menu?

        • I don't think they had a dessert menu, but my entree came with dessert, which was an orange.

          I did see somebody eating taiyaki, so they did have other desserts.

          I didn't look at an alcohol menu, but there were at least a dozen choices of wine visible.

          But just because something is a dessert doesn't mean it is junk food.

  • https://www.youtube.com/watch?v=2TnkJ8_BmSI

  • Not just the ones you think they recorded.

    All of them. Every single one.

    Technically, it's the metadata from them, but it's pretty much the same thing.

    Literally TURN OFF YOUR PHONE and your TV (not sleep, OFF) and your other devices if you don't want them recording you.

    Actually, that won't always work. Pull the power cord.

  • When I go to the listing, it clearly states that only I can see the info. I see a lot of Amazon purchases, but it only gives the order number and amounts, not what item(s) was purchased. It can be a handy tool especially if I can't remember when I bought something, I can search this list. I assume most everything I do online is being recorded by somebody, if I want complete privacy, I have to really work at it to achieve that end, and even then it isn't certain. I bet this guy posted a link to his artic

    • Re: (Score:2)

      by PPH ( 736903 )

      When I go to the listing, it clearly states that only I can see the info.

      Ouch! My sides!

  • "Don't Be Evil...unless you can make boatloads of sweet, sweet cash doing just that."

  • You get the idea, and you can see your own purchase history by going to Google's Purchases page.

    The author of the article must have something else going on... Because 99% of my purchases are missing.

  • Google purchases
    No purchases
    Purchases made using Search, Maps, and the Google Assistant will be shown here

    There are "confirmations". Google chrome and some pistol ammo.

Slashdot Top Deals

You can be replaced by this computer.

Close