iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In 2010, Google acknowledged that its Street View cars had collected samples of data sent over some open Wi-Fi networks—not just the network identifiers the company had previously disclosed. Canada’s privacy regulator later found that the samples included some complete emails, credentials, and sensitive information, and concluded Google had breached Canadian privacy-law principles on limiting collection, identifying purposes, and consent.
What happened in the Street View Wi-Fi incident?
Street View cars photographed streets and collected Wi-Fi network identifiers for location-based services. Google initially said the cars gathered network names, known as SSIDs, and router hardware addresses, known as MAC addresses. On May 14, 2010, the company corrected that account: its software had also sampled payload data—the information being sent over a network—from open, non-password-protected Wi-Fi networks. Google said it had not used the captured payload in its products. Google’s May 14, 2010 statement describes its account and response.
Network identifiers and payload are different kinds of information. An SSID or MAC address can help identify a nearby network; payload may include communications transmitted through it. Google said the payload capture did not include traffic on secure, password-protected networks. That is the company’s description of the collection, not a claim that every unprotected network or every communication was captured.
How did the data-collection code get into Street View cars?
Google attributed the collection to code written for an experimental Wi-Fi project in 2006. According to the company, the code was incorporated into Street View software in 2007 so the cars could collect basic network information. Google said the project’s leaders did not intend to collect or use payload data and described its capture as a mistake.
#1 Best Overall
Canada’s Office of the Privacy Commissioner examined the code and the company’s controls. Its 2011 report found the code had not received the privacy review Google’s procedures called for, and criticized shortcomings in management controls and privacy awareness. The company’s account of intent and the regulator’s findings about review and oversight are distinct: the former explains Google’s stated understanding; the latter records the regulator’s assessment. The commissioner’s Report of Findings #2011-001 sets out the Canadian investigation.
What information did regulators find?
The Canadian commissioner examined samples of the collected payload and reported finding names, addresses, phone numbers, email messages and headers, IP addresses, hostnames, cookie contents, instant messages, chat sessions, and, in some cases, login credentials and sensitive medical or legal information. The report cautioned that fragmented data could not always be connected to an identifiable person. It also found some information could be associated with people through matching or aggregation.
Rank #2
Google later said inspections showed that most of the data was fragmentary, but some complete emails and URLs, as well as passwords, had been captured. Fragmentary collection therefore does not mean that all captured material was harmless or impossible to connect to individuals.
The Canadian report cited estimates of approximately 600 gigabytes collected during the cars’ two-year operation, while explicitly cautioning that not all of that data should be considered personal information. That figure is not an estimate of payload data alone.
What did Canadian regulators conclude?
The commissioner found Google contravened principles under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) concerning limiting collection, identifying purposes, and consent. The report concluded that the commissioner-initiated complaints were well-founded.
For the Canadian data, the commissioner considered Google’s post-discovery safeguards adequate at that stage of the investigation, while deletion was still pending and subject to Canadian and U.S. law. The report recommended stronger privacy training and governance, qualified privacy review, senior-management accountability, and deletion to the extent legally permitted. These are the report’s findings and recommendations for Canada; they should not be treated as a complete account of legal outcomes in every country.
What did the U.S. FCC action mean?
The FCC’s April 2012 investigation document proposed a $25,000 forfeiture over Google’s failures to identify employees, produce emails, and provide compliant declarations during the investigation. It discussed whether the underlying payload collection violated the federal legal provision at issue but did not resolve that question. The proposal concerned Google’s response to the investigation; it is not, by itself, a final finding that the collection was unlawful under that provision. See FCC document DA 12-592.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How did Google respond, and what changes did it announce?
After discovering the collection, Google said it grounded the cars, segregated the data, contacted regulators, and decided to stop collecting Wi-Fi data through Street View vehicles. In July 2010, the company said the Wi-Fi reception equipment had been removed and described a process to remove related software before the vehicles resumed driving; it also said Street View imagery collection continued. Google’s July 8, 2010 update describes those steps as the company reported them.
Best Value
In October 2010, Google announced that it had appointed Alma Whitten as privacy director, enhanced employee training, and required engineering project leaders to maintain privacy design documents for review by managers and an internal audit team. These were announced controls, not independent proof that the controls were effective over time. The Canadian commissioner separately recommended stronger training and governance.
Why did the incident matter beyond Street View?
The episode showed how software written for one purpose can collect more than intended when reused without adequate privacy review. It also demonstrated why organizations need to define purposes, minimize collection, obtain appropriate consent, and make responsibility for privacy oversight clear before deploying systems—not only after a problem is found.
For individuals, the incident is a reminder that communications sent over an open Wi-Fi network may be exposed to collection. Use current security settings and avoid leaving a home network open. This does not mean that all Wi-Fi communications are exposed, or that a single equipment change removes every privacy risk.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the public record does—and does not—establish
The Canadian regulator documented findings about Canadian samples and made conclusions under Canadian law. Google described its own software history, response, and announced internal changes. The FCC document addressed investigative cooperation and left the underlying legal question unresolved. These records provide a clear account of the mechanism and important jurisdiction-specific findings, but they do not establish a complete current global legal status or a verified final deletion status for all collected data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
