Google Drive: The truth about data ownership

Google Drive app displayed on a mobile

When launching Google Drive, Google proudly proclaimed the storage cloud service as being a place where you can "create, share, collaborate, and keep all of your work" and added that you can "upload and access all of your files, including videos, photos, Google Docs, PDFs and beyond".

What it didn't make quite such a loud fuss about were the terms and conditions that you have to agree to when signing up to use the Google Drive service and which, in part, state: “When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide licence to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes that we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content.”

Perhaps somewhat surprisingly I was not alone in reading the T&Cs, and I say that as most people appear to have developed a kind of legalese avoidance reflex which automatically finds and clicks the 'I agree' button before their eyes have had a chance to read anything, and not alone in being concerned with the possible implications of this clause.

However, I was certainly surprised to discover so many people who should really know a little better were managing to avoid reading the bit which says "You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours". My surprise here being that this statement immediately preceded the much-quoted paragraph concerning the worldwide license, yet many people seemed to be suggesting that Google somehow did want to own, or even pwn, your data.

That said, there are still some causes for legitimate concern about the wording of what followed, and was less widely reported by the Twitterati: "This licence continues even if you stop using our Services". That's the license in which you are granting Google the rights to use your data for the "limited purpose of operating, promoting and improving" its services as well as to "develop new ones”.

And there lies the rub methinks, this is less about data ownership and more about data usage, privacy and security. Google does not, as it clearly states, own your data; ownership remains with the user, but it sure as heck does seem to expect an awful big slice of privilege when it comes to what it can do with that data forever more.

Dropbox is explicit in disclaiming ownership of 'your stuff' nor does it claim any rights to it beyond the limited ones required to operate the service (which are explained in detail) and Microsoft's SkyDrive also makes similar statements regarding not claiming ownership stating "Your content remains your content" and adding that it does not "control, verify or endorse" that content.

Microsoft does state that "When you give others access to your content on the service, you grant them free, nonexclusive permission to use, reproduce, distribute, display, transmit, and communicate to the public the content solely in connection with the service and other products and services made available by Microsoft" whereas Dropbox insists "...aside from the rare exceptions we identify in our Privacy Policy, no matter how the Services change, we won’t share your content with others, including law enforcement, for any purpose unless you direct us to".

Interestingly, and please do pitch in with your comments if you have had better luck then me with this, but I couldn't actually find anything about rights over uploaded content when it comes to the Apple iCloud service, just a bunch of stuff about ensuring you have the right to upload the content that you share.

What scares me most about the Google Drive situation is that it would appear, and I readily admit I Am Not A Lawyer (thank goodness), that you hand over to them a perpetual right to use your data in order to promote Google services and develop new ones. Seriously Google, that's not why I want to store my data in the cloud and it's why I won't be storing it with you.

At the time of writing, Google has not responded to any requests for a comment to clarify the data ownership and privacy situation.

Davey Winder

Davey is a three-decade veteran technology journalist specialising in cybersecurity and privacy matters and has been a Contributing Editor at PC Pro magazine since the first issue was published in 1994. He's also a Senior Contributor at Forbes, and co-founder of the Forbes Straight Talking Cyber video project that won the ‘Most Educational Content’ category at the 2021 European Cybersecurity Blogger Awards.

Davey has also picked up many other awards over the years, including the Security Serious ‘Cyber Writer of the Year’ title in 2020. As well as being the only three-time winner of the BT Security Journalist of the Year award (2006, 2008, 2010) Davey was also named BT Technology Journalist of the Year in 1996 for a forward-looking feature in PC Pro Magazine called ‘Threats to the Internet.’ In 2011 he was honoured with the Enigma Award for a lifetime contribution to IT security journalism which, thankfully, didn’t end his ongoing contributions - or his life for that matter.

You can follow Davey on Twitter @happygeek, or email him at davey@happygeek.com.