Do you use Gmail, even for personal mail? Do any of your clients use Gmail? If so, you might have noticed that there was a pretty massive shift in your privacy a couple of days ago. CNET corespondent Molly Wood called it a privacy nightmare. You might not have noticed it. But unless you take a few steps to protect yourself, Google may be sharing some of your confidences with the world.

When Google introduced Buzz — its answer to Facebook and Twitter — it hoped to get the service off to a fast start. New users of Buzz, which was added to Gmail on Tuesday, found themselves with a ready-made network of friends automatically selected by the company based on the people that each user communicated with most frequently through Google’s e-mail and chat services.

As well, if you connected to Buzz via iPhones or other mobile devices, your location could be broadcast to those people whom Google had decided should know where you were, who were emailing, and what you were saying.

As Miguel Helft in the NYTimes said: “E-mail, it turns out, can hold many secrets, from the names of personal physicians and illicit lovers to the identities of whistle-blowers and antigovernment activists.”

Evgeny Morozov wrote in a blog post for Foreign Policy, “If I were working for the Iranian or the Chinese government, I would immediately dispatch my Internet geek squads to check on Google Buzz accounts for political activists and see if they have any connections that were previously unknown to the government.”

Harriet Jacobs, a psuedonym for a woman who writes about violence against women, succintly writes on her blog that the people she receives email from most often include her ex-husband, his friends, and abusive comments. This, she writes, “is why it’s SO EXCITING, Google, that you AUTOMATICALLY allowed all my most frequent contacts access to me….My privacy concerns are not trite. They are linked to my actual physical safety.”

Harriet is not the only one who has to worry, and for Google to suddenly decide to monetize gmail by sharing gmail user’s data with a spectrum of un-approved users, certainly seems like a step away from “do no evil”.

Buzz is an “opt-out” service. In other words, your data, if you use gmail, was automatically disclosed to everyone with whom you’ve emailed more than once or twice.  The  people at Google just assume you want to be part of their new world where “[i]f you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.”

What distressed me most is that Google made Buzz automatic. It was folded into Gmail, assimilated your contacts and email history, and created these first social connections without ever asking permission. If you had ever created a Google Profile (an innocuous webpage that might collect comments you left on Maps or links to your LinkedIn profile), then Google went a step further — it published these social connections in a place accessible to the world. And even if you had not yourself created a Google Profile, your social connections could still be exposed on the other person’s Google Profile.

Don’t like it? The burden was on you to track all this down and make the privacy changes you wanted. Even if you did that, it wasn’t clear that it was even possible to truly “turn off buzz.” Flipping the switch at the bottom of Gmail didn’t work. Who knows how many people have been misled by that. (Google now acknowledges this on one of its support pages. All that switch does is “remove the Buzz label from your Gmail account,” or in other words, hide it within Gmail.)

Even after clicking “turn off buzz”, your Buzz connections persisted, they were still shown on your profile, and Buzz was still active (as you could readily see from a mobile client, such as an iPhone).

Yesterday’s slight modifications by Google make clear that this was indeed their design. Yesterday afternoon, Google released a statement.They did not back away from their business plan — they still make Buzz automatic and create these connections for you. Their response is, in essence, to blame you for not having figured out how to tweak these engineering settings yourself.

In particular, they point out that it’s possible to manually go through and block particular followers. But, to take one example, they do not mention the data leakage, in which these followers get access to information about your other social contacts before you block them. They also don’t mention that each Google-automated follower has to be blocked individually, which for journalists, attorneys, or anyone else with a large contact list that is concerned about client privacy, can take a significant amount of time.

Google did not ask your permission for this repurposing of your personal email information, it did not ask your permission to share it, and is not asking for your forgiveness now.

Imagine if Facebook had done this. Imagine they bought a major email provider, folded all of its users into their social network, and prepopulated lots of connections based on who they had emailed the most frequently.

Okay, now imagine that Facebook had placed a button on the email client page that said “turn Facebook off.” And that the button did not actually do what it said. Users and the press would be calling for Facebook’s head.

How to really turn off buzz

If the “turn off buzz” link at the bottom of Gmail isn’t the right way to actually turn the service off, what is?

Buried within its support pages, Google offers a three-step procedure you can follow to actually disable Buzz. Follow these steps in order, or it doesn’t work at all. The first step, contrary to what you might expect if you were not a Google engineer, is not to click “turn off buzz.”

1. First, you delete your google profile. You don’t hide it or change the name. You have to delete it completely. This doesn’t destroy your overall google account, but it does limit some of your functions. Here’s how to delete your profile.  (For those of us that never opted into having a profile, there is still some question as to what is being shown in other people’s feeds, or how to manage privacy settings.)
2. You have to go into buzz and manually delete your connections, including blocking everyone who is following you already. Depending on how many people Google automatically added, this could take a while.
3. Now it’s safe to go back to Gmail and click “turn off buzz.”

Even if Google ever changes their mind, and gives users an easy way to protect their data and their client’s data, this remains a massive violation of user trust on Google’s part. This sharing of personal information never should have been opt-out.

This is a huge shift in how Gmail uses our data. If this is Google’s method of dealing with our previously private data in the future, how many of us will really feel good about trusting our documents to Google Docs? Or our photos to Picasa?

Google has broken the trust, and taken the first public step towards evil. With millions and millions of user’s and their accompanying data, the question becomes, do they step back, or is there a greater evil coming?