When I give data like Email, documents or my search history to Google I trust that they will

  • keep my data secure (from hackers, employees, foreign governments, etc.)
  • keep it private
  • only use it for its intended purpose
  • make backups.

Is there a third party or government organization that checks if they do indeed follow their privacy policy? (and what happens if they do not)

Also, since I am an EU citizen, will my data stay within the EU?

To summarize from the answers:

  • there is no outside verification, the checks are done by Google internally
  • data can be stored anywhere, not just in the country of the customer
  • 1
    subjective question?
    – joyjit
    Jul 27, 2010 at 17:34
  • Chris, I can't comment on the rest of your questions, but "Also, since I am an EU citizen, will my data stay within the EU?" strikes me as a little, umm, odd. Are you really suggesting that if you go on holiday to the US or Asia (or lots of other places for that matter), you don't want access to your email or docs in Google Docs, etc. In fact, I think I'll craft an answer that Google could provide: "Of course, sir, just so long as you pomise that you yourself will stay within the EU". Jul 27, 2010 at 19:22
  • When I said 'stays' within the EU I meant if it will be stored on a server within the EU or elsewhere. I'm no privacy expert but I know that the EU has stricter laws than other countries (i.e. the US).
    – laktak
    Jul 27, 2010 at 21:02
  • IANAL but the EU's data protection rules say that certain types of personal data on EU citizens cannot leave the EU without their consent, this means that the servers holding certain categories of personal data on EU citizens must be physically in an EU country, or held by company and country that agree to strict regulation of that data. Eg see the US-EU "Safe Harbor" act that allows certain US companies to store EU citizens' data en.wikipedia.org/wiki/Safe_Harbor_Principles
    – GAThrawn
    Jul 28, 2010 at 13:57
  • 2
    Google can put your data on its homepage, right above the searchbox. Red and large. In a <blink> tag.
    – badp
    Jul 31, 2010 at 20:49

4 Answers 4


I doubt anyone other than Google could truly answer this, but a few thoughts come to mind:

  • Google is a US-based company that has datacenters all over the world. Where, geographically, your data resides is likely algorithmically-base, though I'd suspect that they'd try to localize storage
  • What is the intended purpose for data that Google has? It's at least for them to be able to make money on advertising (they are, after all, and advertising company that happens to do search)
  • I don't know of any organization that verifies the Privacy Policy is followed until or unless it's breached

Google have lots of privacy information on their website:


You might also find the Google Apps Security whitepaper interesting. I don't know how much of it extends to the consumer version of Google products, but it should give you some idea of what the infrastructure looks like and how its managed:


Except in a few very specific circumstances (eg services for US Government) Google make no guarantees about where data is stored. However they are extremely proactive about ensuring they can fulfill their privacy and contractual obligations no matter where your data is stored.


This is not a direct answer to your question. However, I ran across this recently and it is very relevant to your question. At least you may be able to explicitly monitor what is being sent to Google:

Google is collecting a lot of data about how we use the web. The new Google Alarm Firefox addon visually & audibly alerts you whenever your personal information is being sent to Google servers.

Even outside Gmail and YouTube you are constantly sending Google your information through their vast network of “tracking bugs”: Google Analytics, Google AdSense, YouTube embeds, API calls… all of this data can be used to monitor & track your personal web browsing habits.

Google Alarm shows notifications, plays sound effects and keeps running stats about the % of websites you’ve visit with Google bugs present.

Disclaimer: I have no first hand experience with this plugin.


You can't expect that your data won't be able to be subpoenaed by US law. Google didn't mount a legal defense when they were subpoenaed to reveal the IP addresses of some Caribbean journalists. http://www.readwriteweb.com/archives/google_may_hand_over_muckraking_journalists_ip_add.php

If you need real privacy than you shouldn't use a cloud based service and encrypt mails.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.