WASHINGTON, D.C. — Google has said that
the cars used for its “Street View” mapping service had been mistakenly
collecting personal data that people sent over unsecured WiFi networks
for several years.

Google said it was “profoundly sorry for this error,” which is likely
to intensify criticism of the Internet giant and Street View by privacy
advocates and officials in a number of countries, particularly in
Europe.

The Mountain View, California-based Google said it will end the
collection of WiFi network information entirely by the Street View cars
which have been used in over 30 nations.

It was also taking steps to delete the private data, which was
scooped up as the cars drove around taking photographs and gathering
publicly broadcast WiFi information for mobile versions of the online
mapping service.

Street View, which is available for the United States and certain
other countries, allows users to view panoramic street scenes on Google
Maps and “walk” through cities such as New York, Paris or Hong Kong.

Amid concerns that thieves could use pictures of private houses to
gain access and that photos of people were being published without their
consent, Street View already blurs faces and car registration plates.

The collection of WiFi network information by Street View, which
began in 2006, has been controversial, particularly in Germany.

Google had insisted previously it was only collecting WiFi network
names and MAC addresses, the unique number given to a device like a WiFi
router.

“It’s now clear that we have been mistakenly collecting samples of
payload data from open (ie non-password-protected) WiFi networks,” Alan
Eustace, Google senior vice president for engineering and research, said
in a blog post.

Eustace said a coding error was responsible for the collection of
personal data sent by people over unsecured WiFi networks.

Google did not specify what data was gathered but it could
potentially include emails or details about which websites a person had
visited.

Eustace said Google discovered that personal data had been swept up a
week ago following a request to audit WiFi data from the Data
Protection Authority in Hamburg, Germany.

“As soon as we became aware of this problem, we grounded our Street
View cars and segregated the data on our network, which we then
disconnected to make it inaccessible,” he said.

“We want to delete this data as soon as possible, and are currently
reaching out to regulators in the relevant countries about how to
quickly dispose of it,” Eustace said.

“Given the concerns raised, we have decided that it’s best to stop
our Street View cars collecting WiFi network data entirely,” he added.

He said personal information was collected only from
non-password-protected WiFi networks and “we never used that data in any
Google products.”

A Google spokesperson said about 600 gigabytes of personal
information had been gathered, roughly the amount as in a standard
computer hard drive.

Eustace said the data was just fragments. “Because our cars are on
the move, someone would need to be using the network as a car passed by,
and our in-car WiFi equipment automatically changes channels roughly
five times a second,” he said.

“Maintaining people’s trust is crucial to everything we do, and in
this case we fell short,” he said.

“We are profoundly sorry for this error and are determined to learn
all the lessons we can from our mistake.”

John Simpson of Consumer Watchdog, an advocacy group that is a
frequent critic of Google, said the company had demonstrated a “lack of
concern for privacy.”

“Its computer engineers run amok, push the envelope and gather
whatever data they can until their fingers are caught in the cookie
jar,” Simpson said.

“The takeaway from this incident is the clear need for government
oversight and regulation of the data all online companies gather and
store,” he said.

Google said Street View cars have been collecting WiFi data in
Australia, Austria, Belgium, Brazil, Britain, Canada, the Czech
Republic, Denmark, Finland, France, Germany, Greece, Hong Kong, Hungary,
Ireland, Italy, Japan, Luxembourg, Macau, Mexico, the Netherlands, New
Zealand, Norway, Poland, Portugal, Romania, Singapore, South Africa,
South Korea, Spain, Sweden, Switzerland, Taiwan and the United States.