The Nest-Google Privacy Statement

15 January 2014

Marco Arment has taken a critical look at the privacy statements made by Nest Labs, Inc. following the announcement of its acquisition by Google Inc. (an announcement that has had a somewhat mixed reception).

Marco's post focuses on this FAQ in the Nest statement:

Will Nest customer data be shared with Google?
Our privacy policy clearly limits the use of customer information to providing and improving Nest's products and services. We've always taken privacy seriously and this will not change.

He rightly cautions against taking such a statement at face value; the statement's intended to sound reassuring, but doesn't actually answer the question posed or provide any real comfort to those concerned about the prospect of Nest's personal data being shared with Google.¹ He concludes that:

Obviously, Google and Nest should be considered one entity with one product line and shared services in the future, regardless of whose name is painted on the front of the thermostat.

And that view is supported by the Nest privacy policy. Don't worry, we won't get too bogged down in the fine print - the very first line refers to:

what kind of information Nest Labs, Inc. and its subsidiaries and affiliates (collectively, "Nest") collects and stores

The significant piece is the phrase '(collectively, "Nest")'. It means that "Nest" is a defined term. Every time you read the word "Nest" in the remainder of the privacy policy, it covers not only Nest Labs, Inc., but also its subsidiaries and affiliates. Which, on completion of the acquisition by Google, will arguably include Google, Inc. So, when the privacy policy says (incidentally, using almost identical wording to the FAQ above):

How does Nest use the information it collects?
We use this information to provide and improve Nest Products and services...

that may shortly mean, "to provide and improve Nest *and Google* Products and services". And if Google's an affiliate, it won't be a third party for the purposes of the privacy policy. So sharing data with Google wouldn't breach the undertakings given by Nest about not sharing data with third parties.

Marco highlighted that Nest's privacy policy can be changed at any time. That's true, although not always as straightforward in practice as you might expect. However, it may not need to be changed at all in order for Nest to share personal data with Google. And that's something to bear in mind next time you're asked for consent to use your personal data - companies and corporate groups change all the time and the company you give your data to today might not be the company you're dealing with tomorrow.

^1. I don't own any Nest products. I do use some Google services. This post is not intended to make any comment on the merits of the concerns that some have expressed about personal data held by Nest being shared with Google - I don't have any strong views on that.↵