Last week I had to build an app that used a Google API. The process was pretty familiar to me, and it went smoothly. But after about two days, Google contacted me, asking for clarification on what exactly the app did. 
In addition to the full documentation of the operations, I also had to endure a video that showed exactly every step. This was very strange as I had never encountered this before in all the years I have been using the company's API.
Let me remind you that I experienced something similar with a Facebook app: Have you tried using a Facebook app lately?
Then yesterday's news broke: Google+ service shutdown and data leaks. So the following news is probably a natural consequence...
Google announced yesterday that it plans to improve the privacy settings of users of Android, Gmail and other services and apps that use Google account data.
The company yesterday published the findings of an internal project called Strobe. The company used the project to analyze how third-party app developers interact with Google accounts, Android device data, and whether those interactions affect user privacy.
Google, as we reported yesterday, has decided to shut down Google+, the company's social network, and make some other changes to enhance user privacy, by restricting developers or changing existing APIs.
Some Android apps and services require additional permissions after installation or when a Google account is connected to the app. They may request access to your calendar, contacts, or access to files hosted on Google Drive.
These requests appear simultaneously, making it difficult for users to allow or deny access. Often, they cannot even grant these applications or services only certain permissions. It is an all-or-nothing approach.
Google plans to change permission requests by giving users individual permission requests. This will give them the ability to grant or deny requests individually.
The screenshot above shows the new process. It starts with selecting the Google Account you want to use to sign in, just like it does today. The process continues by displaying each request on its own screen, giving users the option to deny or allow data sharing features. Finally, a screen appears showing all requests and permissions.
New Gmail API policies will go into effect on January 9, 2019. Google plans to restrict which apps, using the Gmail API, have access to Gmail data.
Only applications that directly improve the functionality of email, such as email clients, email backup services, and productivity services (e.g., CRM services and mail merge services), will be authorized to access.
Google lists the following types of applications that will be allowed to use the APIs by Google Developers:
- Email clients.
- Email backup applications
- Productivity enhancing applications.
- Reporting or monitoring services and applications.
Applications that will continue to access the data will need to be reviewed by Google engineers. If you are a developer, you can read this article on the Google Cloud blog for more information.
Apps will only be allowed to use data for “functions that users need” and “will not be allowed to transfer or sell data for other purposes, such as ad targeting, market research, email tracking, and other unrelated purposes.”.
The final changes will also affect apps that request access to SMS, contact data, or general permissions on Android devices.
Only the app that is set as the default app for making calls or sending SMS will be allowed to access the data according to Google's new regulations.
There are of course some exceptions to this, e.g. for backup applications or voicemail applications.
Google is reportedly restricting third-party apps' access to user data, a step that is long overdue. It remains to be seen how it will work in practice and of course how developers will accept it.
Here we should probably mention that Google does restrict access to third-party applications, but the same data is constantly collected on the company's servers. If you forgot, let us remind you that Google dominates the online advertising space. So the above news may be encouraging for the end user, but essentially we should all know that there can be no security and privacy if our data is stored on the internet.
____________________________
- CLOUD: the law that passed under the table & concerns us all
- Copyright Directive in Europe: What does this mean?
