# Google Cloud privacy rating

Cloud computing platform from Google offering virtual machines (Compute Engine), Kubernetes, storage, databases and data analytics services.

## Summary

Google Cloud scores 50 out of 100 (grade D) on the server hosting criteria. It meets 6 of 12 criteria: no ads or data sales, transparency report, tells users about requests, security headers, Reverse DNS and IPv6. It partly meets independent audit and TLS configuration. It does not meet open source, no trackers or telemetry, mail-friendly (port 25) and anonymous payment. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade A+.

- Website: https://cloud.google.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: Google Fonts (not scored), Google Tag Manager
- Category: [Server hosting](https://privacyratings.com/server-hosting/)
- Also rated: [Gmail](https://privacyratings.com/email-providers/gmail/) (Email providers), [Gmail app](https://privacyratings.com/email-clients/gmail-app/) (Email clients), [Google Takeout](https://privacyratings.com/email-backup/google-takeout/) (Email backup tools), [Google Chrome](https://privacyratings.com/browsers/google-chrome/) (Browsers), [Google Search](https://privacyratings.com/search-engines/google-search/) (Search engines), [Google Authenticator](https://privacyratings.com/two-factor-authentication/google-authenticator/) (Two-factor authentication), [Google Messages](https://privacyratings.com/messengers/google-messages/) (Messengers), [Google Meet](https://privacyratings.com/video-calls/google-meet/) (Video calls), [Google Voice](https://privacyratings.com/virtual-phone-numbers/google-voice/) (Virtual phone numbers), [Google Public DNS](https://privacyratings.com/dns-resolvers/google-public-dns/) (DNS resolvers), [Chrome Remote Desktop](https://privacyratings.com/remote-desktop/chrome-remote-desktop/) (Remote desktop), [Google Keep](https://privacyratings.com/notes/google-keep/) (Notes), [Google Calendar](https://privacyratings.com/calendars/google-calendar/) (Calendars), [Google Docs](https://privacyratings.com/office-suites/google-docs/) (Office suites), [Google Forms](https://privacyratings.com/forms/google-forms/) (Forms and surveys), [Google Translate](https://privacyratings.com/translation/google-translate/) (Translation), [Google Gemini](https://privacyratings.com/ai-assistants/google-gemini/) (AI assistants), [Google Drive](https://privacyratings.com/cloud-storage/google-drive/) (Encrypted cloud storage), [Google Maps](https://privacyratings.com/maps/google-maps/) (Maps and navigation), [Google Analytics](https://privacyratings.com/web-analytics/google-analytics/) (Website analytics), [Google Home](https://privacyratings.com/smart-home/google-home/) (Smart home), [Google Nest Cam](https://privacyratings.com/security-cameras/google-nest-cam/) (Security cameras), [Fitbit](https://privacyratings.com/wearables/fitbit/) (Wearables and health), [Google Fit](https://privacyratings.com/fitness-trackers/google-fit/) (Fitness trackers), [Google Photos](https://privacyratings.com/photo-management/google-photos/) (Photo management)
- Grade: D (50/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The home page loads Google Tag Manager. |  |
| No ads or data sales | Yes | Funded by paid usage. The Cloud Privacy Notice says Service Data is not sold or shared with third parties. | https://cloud.google.com/terms/cloud-privacy-notice |
| Independent audit | Partial | Only the SOC 3 summary report is public; SOC 2 and ISO audit reports are available to customers. | https://cloud.google.com/security/compliance/soc-3 |
| Transparency report | Yes | Google publishes semi-annual counts of government requests for user data, with a separate section for Enterprise Cloud customers. | https://transparencyreport.google.com/user-data/overview |
| Tells users about requests | Yes | Google emails the account, or its administrator, before disclosing data unless prohibited by law or in emergencies. | https://policies.google.com/terms/information-requests |
| TLS configuration | Partial | Grade B | https://www.ssllabs.com/ssltest/analyze.html?d=console.cloud.google.com&hideResults=on |
| Security headers | Yes | Grade A+ (110/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=console.cloud.google.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Mail-friendly (port 25) | No | Connections to external destinations on port 25 are blocked, and no process to request an exception is documented. | https://docs.cloud.google.com/compute/docs/tutorials/sending-mail |
| Reverse DNS | Yes | PTR records for external IPv4 and IPv6 addresses are set on the VM's network interface. | https://docs.cloud.google.com/compute/docs/instances/create-ptr-record |
| IPv6 | Yes | External IPv6 addresses assigned to VM instances are not charged. | https://cloud.google.com/vpc/network-pricing |
| Anonymous payment | No | Payment is by credit card or bank account. Cryptocurrency is not accepted. | https://docs.cloud.google.com/billing/docs/how-to/payment-methods |

Source: https://privacyratings.com/server-hosting/google-cloud/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/server-hosting/google-cloud.md