Many third-party apps, services and websites build on top of our various services to improve everyone’s phones, working life, and online experience. We strongly support this active ecosystem. But increasingly, its success depends on users knowing that their data is secure, and on developers having clear rules of the road. 
 
 Over the years we’ve continually strengthened our controls and policies in response to regular internal reviews, user feedback and evolving expectations about data privacy and security. 
 
 At the beginning of this year, we started an effort called Project Strobe—a root-and-branch review of third-party developer access to Google account and Android device data and of our philosophy around apps’ data access. This project looked at the operation of our privacy controls, platforms where users were not engaging with our APIs because of concerns around data privacy, areas where developers may have been granted overly broad access, and other areas in which our policies should be tightened. 
 
 We’re announcing the first four findings and actions from this review today. 
 
 Finding 1: There are significant challenges in creating and maintaining a successful Google+ product that meets consumers’ expectations. 
 
 
 
 Action 1: We are shutting down Google+ for consumers. 
 
 
 
 Over the years we’ve received feedback that people want to better understand how to control the data they choose to share with apps on Google+. So as part of Project Strobe, one of our first priorities was to closely review all the APIs associated with Google+. 
 
 This review crystallized what we’ve known for a while: that while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds. 
 
 Our review showed that our Google+ APIs, and the associated controls for consumers, are challenging to develop and maintain. Underlining this, as part of our Project Strobe audit, we discovered a bug in one of the Google+ People APIs: 
 
 
 
 
 
 Users can grant access to their Profile data, and the public Profile information of their friends, to Google+ apps, via the API. 
 
 The bug meant that apps also had access to Profile fields that were shared with the user, but not marked as public. 
 
 This data is limited to static, optional Google+ Profile fields including name, email address, occupation, gender and age. (See the full list on our developer site.) It does not include any other data you may have posted or connected to Google+ or any other service, like Google+ posts, messages, Google account data, phone numbers or G Suite content. 
 
 We discovered and immediately patched this bug in March 2018. We believe it occurred after launch as a result of the API’s interaction with a subsequent Google+ code change. 
 
 We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API. 
 
 We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused. 
 
 Every year, we send millions of notifications to users about privacy and security bugs and issues. Whenever user data may have been affected, we go beyond our legal requirements and apply several criteria focused on our users in determining whether to provide notice. 
 
 Our Privacy & Data Protection Office reviewed this issue, looking at the type of data involved, whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response. None of these thresholds were met in this instance. 
 
 The review did highlight the significant challenges in creating and maintaining a successful Google+ that meets consumers’ expectations. Given these challenges and the very low usage of the consumer version of Google+, we decided to sunset the consumer version of Google+. 
 
 To give people a full opportunity to transition, we will implement this wind-down over a 10-month period, slated for completion by the end of next August. Over the coming months, we will provide consumers with additional information, including ways they can download and migrate their data. 
 
 At the same time, we have many enterprise customers who are finding great value in using Google+ within their companies. Our review showed that Google+ is better suited as an enterprise product where co-workers can engage in internal discussions on a secure corporate social network. Enterprise customers can set common access rules, and use central controls, for their entire organization. We’ve decided to focus on our enterprise efforts and will be launching new features purpose-built for businesses. We will share more information in the coming days. 
 
 Finding 2: People want fine-grained controls over the data they share with apps. 
 
 
 
 Action 2: We are launching more granular Google Account permissions that will show in individual dialog boxes. 
 
 When an app prompts you for access to your Google account data, we always require that you see what data it has asked for, and you must grant it explicit permission. 
 
 Going forward, consumers will get more fine-grained control over what account data they choose to share with each app. Instead of seeing all requested permissions in a single screen, apps will have to show you each requested permission, one at a time, within its own dialog box. For example, if a developer requests access to both calendar entries and Drive documents, you will be able to choose to share one but not the other. Developers can read more on the Google Developer Blog. 
 
 This is what the process looks like today when an app requests access to any data in your consumer Google account (you've always been able to choose whether to grant that permission request): ||||| FILE - In this Dec. 4, 2017 file photo, people walk by Google offices in New York. Google is closing the consumer version of its long-spurned Plus social network after discovering a bug earlier this year... (Associated Press) 
 
 FILE - In this Dec. 4, 2017 file photo, people walk by Google offices in New York. Google is closing the consumer version of its long-spurned Plus social network after discovering a bug earlier this year that leaked some of the personal information about up to 500,000 people who still have accounts... (Associated Press) 
 
 FILE - In this Dec. 4, 2017 file photo, people walk by Google offices in New York. Google is closing the consumer version of its long-spurned Plus social network after discovering a bug earlier this year that leaked some of the personal information about up to 500,000 people who still have accounts... (Associated Press) FILE - In this Dec. 4, 2017 file photo, people walk by Google offices in New York. Google is closing the consumer version of its long-spurned Plus social network after discovering a bug earlier this year... (Associated Press) 
 
 SAN FRANCISCO (AP) — Google is shutting down its long-shunned Plus social network for consumers, following its disclosure of a flaw discovered in March that could have exposed some personal information of up to 500,000 people. 
 
 The announcement came in a Monday blog post , which marked Google's first public description of the privacy bug. 
 
 Google deliberately avoided disclosing the problem at the time, in part to avoid drawing regulatory scrutiny and damaging its reputation, according to a Wall Street Journal story that cited anonymous individuals and documents. 
 
 The Mountain View, California, company declined to comment on the Journal's report, and didn't fully explain in its blog post why it held off on revealing the bug until Monday. 
 
 The Google Plus flaw could have allowed up to 438 external apps to scoop up user names, email addresses, occupations, genders and ages without authorization. The company didn't find any evidence that any of the personal information affected by the Plus breach was misused. 
 
 The timeline laid out by Google indicates the company discovered the privacy lapse around the same time that Facebook was under fire for a leak in its far more popular social network. Facebooks' breakdown exposed the personal information of as many as 87 million of its users to Cambridge Analytica, a data mining firm affiliated with President Donald Trump's 2016 campaign. 
 
 Congress summoned CEO Facebook CEO Mark Zuckerberg to be grilled about his company's privacy issues in April. 
 
 Google CEO Sundar Pichai recently declined to an invitation to travel to Washington to testify before the Senate about foreign governments' manipulation of online services to sway U.S. political elections. His absence incensed some lawmakers, who left an empty chair for Google alongside the Twitter and Facebook executives who appeared before the Senate committee in September. 
 
 "With this breach announcement, the empty seat bearing Google's name just became a lot hotter," said Mike Chapple, an associate professor of information technology, analytics and operations at the University of Notre Dame. 
 
 Pichai went to Washington to mend political fences with lawmakers in late September and agreed to participate in a White House roundtable on technology that President Trump intends to attend. He also will appear in House hearings after the midterm elections in November. 
 
 Google has a strong incentive to position itself as a trustworthy guardian of personal information because, like Facebook, its financial success hinges on its success to learn about the interests, habits and location of its users in order to sell targeted ads. 
 
 The desire to peer into people's lives is one of the reasons that Google launched Plus in 2011. It was supposed to be a challenger to Facebook's social network, which now has more than 2 billion users. But Plus flopped and quickly turned into a digital ghost town, prompting Google to start de-emphasizing it several years ago. 
 
 But the company kept it open long enough to cause an embarrassing privacy gaffe that could give Congress an excuse to enact tighter controls on data collection. 
 
 "Every data mishap strengthens the bipartisan case for Congress to take action on data protection," said Jonathan Mayer, an assistant professor at Princeton University who formerly worked in the Federal Communications Commission's enforcement bureau. 
 
 Europe began to impose tougher online privacy regulations in May. Those rules also include disclosure requirements for data breaches. Those rules don't apply to the Plus problem because Google discovered it before they took effect. 
 
 ___ 
 
 AP Technology Writer Frank Bajak in Boston contributed to this story. ||||| Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, according to people briefed on the incident and documents reviewed by The Wall Street Journal. 
 
 As part of its response to the incident, the Alphabet Inc. unit on Monday announced a sweeping set of data privacy measures that include permanently shutting down all consumer functionality...
– Google is shutting down its long-shunned Plus social network for consumers, following its disclosure of a flaw discovered in March that could have exposed some personal information of up to 500,000 people, the AP reports. The announcement came in a Monday blog post, which marked Google's first public description of the privacy bug. Google deliberately avoided disclosing the problem at the time, in part to avoid drawing regulatory scrutiny and damaging its reputation, according to a Wall Street Journal story that cited anonymous individuals and documents. The Mountain View, Calif., company declined to comment on the Journal's report, and didn't fully explain in its blog post why it held off on revealing the bug until Monday. As for Google+, it will be shut down over the next 10 months, but will remain open for enterprise customers who use it within their companies. When Google launched Plus in 2011, it was supposed to be a challenger to Facebook's social network, which now has more than 2 billion users. But Plus flopped and quickly turned into a digital ghost town, prompting Google to start de-emphasizing it several years ago. But the company kept it open long enough to cause an embarrassing privacy gaffe that could give Congress an excuse to enact tighter controls on data collection. The Google Plus flaw could have allowed up to 438 external apps to scoop up user names, email addresses, occupations, genders, and ages without authorization. The company didn't find evidence that any of the personal information affected by the Plus breach was misused. The timeline laid out by Google indicates the company discovered the privacy lapse around the same time Facebook was under fire for a leak in its far more popular social network. Facebook's breakdown exposed the personal information of as many as 87 million users to Cambridge Analytica, a data mining firm affiliated with President Trump's 2016 campaign.