Privacy Policy for Sign In With Google Button
If your website or mobile app allows users to log in or create an account by using their Google accounts, there are a few things you'll need to do.
Google has specific requirements when it comes to implementing a Google sign-in button.
This article will look at what Google requires, and show you examples of how you can comply when you add a Google Sign-In button to your site or app.
Requirements from Google
Google's EU User Consent Policy
Google's policies also require you to comply with the "EU User Consent" Policy if the Google sign in button is used.
Padlet obtains consent by requiring users to click Allow to show they consent.
Examples
Here are a few additional examples of websites and mobile apps that are using the Google Sign In feature and how they're doing it.
Users are informed that Slides will collect an email address and basic profile info when they click to log in with Google. A user must click Allow to complete the login-with-Google process:
Khan Academy places the Google Sign-In button at the top of its login page.
Its Privacy Policy is placed underneath the log-in section with a statement that says, "By logging in, you agree to our Terms of Service and Privacy Policy.":
Khan Academy's Privacy Policy includes a section titled How we collect and use data that includes a sub-section for Information from Integrated Services like Facebook or Google.
This sub-section lets users know that if a user registers through one of these services (Facebook or Google), Khan may collect personal information that the user had already given to the other service:
Basecamp uses a colorful Google button for signing up through a Google account.
Basecamp's information on its legal agreements is listed and linked at the bottom of the page in the website footer:
Clicking on the link takes users to a list of policies, terms and other legal stuff. The Privacy Policy of Basecamp is in this list.
Basecamp's Privacy Policy doesn't specifically mention Google Sign-in functionality but says that when a user signs up for Basecamp, a name, company name and email address will be asked for.
While a user can assume that this is the information that Basecamp collects from the user's Google account, Basecamp would benefit from being more specific and mentioning the Google sign-in functionality, and so would your website or mobile app policy.
If a user is signing-up for an account, Basecamp informs the user that certain information will be collected through Google, including who the user is on Google, an email address, and basic profile info:
Wave doesn't provide a Privacy Policy link on its sign in page where the "Sign In with Google" button is located:
However, on its sign-up page where users can first register for a Wave account, the Privacy Policy page is linked and users are informed that by signing up, consent to its Terms of Use and its Privacy Policy.
This ensures that a user, at least, has access to Wave's Privacy Policy the first time the accesses Wave.
Towards the end of its Privacy Policy, there's a section titled "Additional Features" where third-party logins, such as through Google, is mentioned. The statement informs users that logging in via Google and Yahoo is available, and a basic overview of how this feature works is provided:
A few paragraphs down in its agreement, Wave lets users know that some functionality of the website is highly dependent upon APIs from third parties, such as Google, and that personal information may be collected from these third parties to the extent that the user authorizes Wave to collect that information.
Full Contact gives users the option to create an account directly, or sign up with Google. The Privacy Policy is linked slightly below this section.
In its Privacy Policy, the only mention of personal data collected while creating an account is in the Information You Provide to Us section that states:
"We may collect Personal Data from you, such as your first and last name, gender, e-mail and mailing address, professional title, company name and password when you create an account."
There's no direct mention of taking this information from Google.
PowToon places the Google sign-in button first in a list of three across the top of the login page:
Similarly to Wave, the Privacy Policy of PowToon isn't listed on this page. However, it's also not listed on the Sign up page. The Terms of Use page is linked here, but no Privacy Policy.
While the PowToon's Privacy Policy is mentioned in the Terms of Use, it's not linked to that agreement.
I had to do a web search to find the actual PowToon's Privacy Policy. The only mention within the Privacy Policy of information collected during sign-up is in the very first sentence that says:
"When buying a PowToon subscription or signing up for a free account, we request information such as your name, email address, home address, credit card information (should you purchase an account) and profession. Of course, you may also visit our site anonymously."
It looks like this:
This Privacy Policy should - at minimum - be made available to users on the sign-up page, which has not been done here.
Dailymotion's sign-in page has an option where users can choose whether they want to create a Dailymotion account, or if they already have an account. Both of these options provide the ability to sign in with Google.
The Privacy Policy of DailyMotion can be found in the footer of the website under the "Legal" category.
Dailymotion mentions personal information collected during registration for an account in its Data Collected section which states:
"We collect and subsequently process the Data that you voluntarily provide on the registration form on the Website including your user ID, a valid email address, and your date of birth."
There's no mention of data that isn't provided on the registration form on the website, such as data that would be provided if a user chose to sign up through Google.
If you choose to allow your users to sign into your website or mobile app via a Google sign in button, you may need to do each of the following to be fully compliant:
- Have a Privacy Policy that you adhere to and don't update without informing your users
- Let users know what personal information you will be collecting from them and how you will be using this information (Include this information in your Privacy Policy)
- Obtain consent from users to collect and use this information (the Allow button constitutes consent when you let users know that by clicking Allow, they're agreeing to your Terms)
- Give users a way to change or revoke this consent
- Comply with all requirements outlined in the Google Platform Developer Policy, the Google Buttons Policy, and the EU User Consent Policy