[dahwolf]

You didn't engage with the actual criticism.

You don't seem to have any knowledge at all about how personal data transfers work in the case of a merger or acquisition. Which is a radically different scenario from two standing independent companies exchanging personal data.

It's common practice and common sense that you get access to customer data when you take over a company, how else would you even run it? This has been true and normal for centuries. The concept still stands when applying the strictest of modern privacy laws, it's called "legitimate business interest". Meaning: there is no business without this data, the personal data is required to deliver the service at all.

So no, it's not a selling of your data, it's a change of control. And no, it does not require your consent.

If you don't want to see accusations of "sensationalist" you shouldn't confidently spread hot takes on topics you don't even seem to comprehend the basics of. And if you then go wrong and get corrective feedback as is happening on the Twitter spread, perhaps not double down.

[gregdoesit]

With a company being sold: yes, customer data is also sold.

Google had not been in the business of selling its businesses until now (and thus was not selling customer data either). They were in the business of building own products (sometimes shutting them down) and buying other companies.

This is a first they shut off a division and also sell off customers’ data.

[dahwolf]

Taking control of a company and thereby getting ACCESS to customer data is not the same thing as selling customer data. They are radically different concepts.

As to whether Google has done this before or not is completely irrelevant.

[gregdoesit]

But this is NOT a company being sold! And not even a division or a product sold. It’s not a merger or acquisition. It is, what you described as this: “two standing independent companies exchanging personal data.”

Google Domains and Google Cloud Domains is shutting down: no technology or people transfer happens. Customer accounts are what are sold, as laid out in black-and-white by Google:

“On June 15, 2023, Google entered into a definitive agreement with Squarespace, where they intend to purchase all domain registrations and related customer accounts from Google Domains.”

We can argue what it means to sell “customer accounts from Google Domains” from Google to a third party company.

My interpretation that this is selling customer data (that is needed for the buyer to operate them: it’s selling, none the less, to a third party who is not Google). To me, this sounds like a new era starting where customer accounts owned by Google can be sold (and this is the first). Which is fine: but then Google cannot claim they will not do this, going forward. This was the deal Google promised its customers - which implied they won’t sell off eg Gmail acccounts to a third party, YouTube accounts, or Google Domain accounts.

Google didn’t write that Squarespace is “getting access to customer data”. They wrote Squarespace is purchasing these accounts (likely this wording to avoid writing that Google is selling this: but same difference). Google’s wording: not mine.

https://support.google.com/domains/answer/13689670?hl=en#:~:....

[zerkten]

>> But this is NOT a company being sold! And not even a division or a product sold. It’s not a merger or acquisition. It is, what you described as this: “two standing independent companies exchanging personal data.”

This is just semantics on your part. Whether it's a company being sold, a division, or only a product, then reasonable companies will consider the data handling in a similar way with multiple gap analyses to mitigate concerns. Context is going to dictate what happens. Lesser companies will not consider this heavily and you can end up with the data being more of the value for the transaction. Whether we like it, or not, we are left to trust that these companies will make efforts to enact good policies and follow them.

What I'd expect to happen here is that Google and Squarespace will familiarize themselves with the posture on both sides and Google will want the standards to at least be maintained to a level which removes liability to them. They are very aware of the scrutiny and a big player here so they can force the acquirer to step up to a certain degree.

I don't know enough about Squarespace's security, or complete business model, but they'll be trying to work out what gaps they may need to fill. Google may have clauses that require that this data can't be co-mingled, or must be handled in specific ways for certain countries. The actual handling and what is communicated can take some time as the teams work out how they deal with any gaps. It's also possible that Google find some gaps on their side and have to resolve them before any transfer could actually happen.

Given the implications of service continuity if domains aren't transferred or operational, I can't imagine that they would ask customers to take some action. It creates a support nightmare with confused customers talking to support and then being unhappy they still took the wrong action when you ask them to approve the transfer.

[gregdoesit]

Thank you. After having gone through more of this - and receiving more long-form input - I am with you that this is, almost certainly, not "selling of customer data."

Thanks for your comments, I appreciate it. Now is the part when I would want to go back and edit all my comments here (and on Twitter), but cannot thanks to the append-only nature. I can delete: but then e.g. this post points to nowhere and the context is lost. I deleted the orginal tweet given it's clear it has incorrect information / missing information, replaced with: https://twitter.com/GergelyOrosz/status/1671959124337217536?...

Some longer form thoughts, and also input from someone who is quite well versed in privacy: https://blog.pragmaticengineer.com/google-domains-to-shut-do...

[eddythompson80]

> As to whether Google has done this before or not is completely irrelevant.

Isn't that the whole issue in discussion? Google never did this before, and as a result they could always claim "we will never, ever, sell your information". This just changed as now they decided to sell that data to Squarespace. So they can't claim that anymore, right?

I understand that Google had no other option. As far as I know, ICANN requires a registrar to transfer domains to another registrar if they are going out of business. So either they support the service forever, or sell their user data to another registrar and remove that statement as they no longer uphold that statement.

They got themselves into that business. No one forced them to sign an agreement with ICANN that could one day force them to transfer that information to someone else, but they did.

[gregdoesit]

Coming back - as I can no longer edit my comment.

I am pretty sure I was wrong, and you were right. Thank you. Deleted the original tweet, replaced with: https://twitter.com/GergelyOrosz/status/1671959124337217536