Harvard Business Publishing

On July 3 a New York Federal Judge ordered Google to hand over their complete record of viewers' behavior, including user names and internet protocol addresses in service, to Viacom's $1 billion copyright infringement suit against Google's YouTube service. It raises the very interesting question, does Google keep too much information on its users, and does your company too?

Every company, including Google, is rushing to know their customer's desires better than anyone else. Google does a superior job of tracking, mining, and delivering customer's wants faster and in more detail than any other media firm. This brilliant competence underpins their stratospheric valuation. Other companies like Progressive, USAA, or Active Health also have deep knowledge of their customer's activities and use it to improve their products and services.

Yet firms need to be watchful not to go too far. Customers come to Google because they trust the firm, and all trust is built upon reciprocity. Today, Google holds all the cards: they know what their customers do, where they live (in terms of IP addresses) and, when people set up an account, who they are. Google trades on how you, and I, and billions of others behave. And Google provides a GREAT service to us all.

However, if they are not careful, Google will fall into an old media paradigm in which those who deliver eyeballs can sell access to that audience without consent of those being sold -- which sounds strangely like government without consent of the governed. Google is not unlike King George who unleashed in the colony of America a band of "subjects" who fought to be citizens. Citizens, unlike subjects, choose to participate, or not participate, in the reigning power structure.

Google professes to do no evil, yet, it does not give its "governed" any rights at all to control how information is captured on them, what level of disclosure they want to give, nor how the information about them is used and sold.

Many companies have this problem, and I'd like to start a dialog about what it would take to enable more trust, and more user-controlled identity management.

For example, what if the user could control what data are kept and or not kept about them? What would happen if users of Google, of any system, could elect to not have any of their actual behaviors tracked?

Second, what if all username systems had multiple levels of disclosure under control of the user? If Google had a more robust identity management system, they could turn over to Viacom the viewing habits of their audience, but never need to disclose their screen names or their IP addresses.

Third, and this may be the most radical notion, what if any person could request all and any data captured on their behavior from the company doing the capturing. Put another way, don't I own my own behavior? Imagine 1,000,000 people going to Google and asking for their search data, so that they could turn the data over to a new search company that offered to do an even better understanding what those million people wanted.

What rights do you think your customers should have about their own data?