This category is not covered. The document names no governing law, no court, no arbitration requirement, and no class action or jury waiver, because Google's dispute terms sit in its Terms of Service. The score is neutral: silence means this document imposes no arbitration on you, but it also gives you no forum commitment. The one relevant point is that Google commits to working with local data protection authorities on complaints it cannot resolve with you directly, which preserves a regulatory route.

Account rights are only partly covered here, since registration, suspension, and termination rules live in Google's Terms of Service instead. What this document does give you is strong: you can export everything, delete individual items, delete whole products, or delete the account itself at any time, and you can nominate someone to inherit access. The negatives are that Google can disable your account for abuse with no notice or appeal process described, and that if your account belongs to a school or employer, that administrator can read your mail, change your password, suspend you, and even block you from editing your own privacy settings.

This category is not covered. There is no indemnification clause of any kind in this document, no requirement that you defend or hold Google harmless, and no reciprocal promise from Google either. The score sits toward the top of the neutral band because the absence of a consumer indemnity is not a harm to you. Any indemnity obligation you actually carry will be in Google's Terms of Service, not here.

The disclosure quality here is excellent and the control tooling is among the best in the industry, with Privacy Checkup, My Activity, auto-delete timers, My Ad Center, and full data export. What holds the score in the medium band is the sheer breadth of what is collected and the fact that almost all of it is opt-out rather than opt-in. Google collects location from GPS, sensors, Wi-Fi, Bluetooth and cell towers, call and message logs, health data from its wearables, and your activity across more than two million partner sites, including while you use Incognito mode. Retention for security, fraud, and business purposes is open-ended, and the only encryption commitment made in the text is for data in transit.

This document defines its scope clearly and states plainly what it does not cover, which is better than most privacy policies manage. The scope is extremely broad, reaching every Google service plus Google code embedded in other companies' websites and apps, but the boundaries are stated rather than hidden. Because this is a policy rather than a contract you sign, it says nothing about how you accept terms, and it sets no age requirement in its own text, so the category is only partly covered.

This is the strongest section of the document. Google commits not to reduce your rights under this policy without your explicit consent, always dates its revisions, and publishes archived versions so you can see exactly what changed. That combination is well above industry norm and directly addresses the illusory contract problem. It falls short of best practice because there is no fixed advance notice period, Google alone decides what counts as a significant change, and email notice is promised only for certain services rather than all of them.