A newly leaked Google database tracking potential privacy and security related incidents reported in the last six years suggests that Google may have accidentally done things like recording children’s voices, offering YouTube recommendations using a person’s deleted watch history, transcribing number plates of vehicles from Street View systems and more.
According to a recent report by 404 Media, the dataset, which was received from an anonymous tipster, includes privacy and security incidents reported internally by Google employees. These incidents includes reports about the company’s own data collection practices to vulnerabilities in third-party systems and range and also contain records of mistakes made by Google employees and contractors.
While most of these affect a small number of individuals, the 2017 Nintendo leak, which gave gamers an early look at Yoshi’s Crafted World was leaked by a Google contractor who worked for YouTube. Google has since then confirmed that the employee had downloaded the video using an admin account and shared it with his friend, who then posted it on Reddit. However, the entry was labelled by Google as “non-intentional.”
The report also suggests that Google Street View systems had stored license plates of numerous vehicles from photos, recorded the voices of around 1,000 children to improve its speech recognition services somewhere around the launch of YouTube Kids and even made privately uploaded YouTube videos public for a short amount of time.
Some other examples includes an unknown person tampering with customer accounts on Google Ads to change affiliate tracking codes and Waze’s carpool feature leaking user’s trips and work and home addresses.
Google claims that all the potential privacy and security-related incidents had been “reviews and resolved” at that time, but the leaked internal database does give us a glimpse of how one of the biggest tech companies in the world manages personal and sensitive information.