So Google finally pulled the plug on Google+ today, or at least announced theyre pulling the plug, and if youre feeling a weird pang of nostalgia right now youre probably my age and you probably also forgot you still technically had an account.
Heres the actual news, stripped of the corporate blog-post fog: Google disclosed that a bug in a Google+ API exposed private profile data for up to 500,000 users, stuff like names, email addresses, occupation, gender, age, that sort of thing. Not passwords, not financial data, but still not nothing. The bug had apparently been sitting there since 2015 and Google found it back in March during an internal review they're calling Project Strobe. They say they found no evidence anyone misused the data before they patched it. Fine. Sure.
The part that actually stings, and the part most of the coverage today is focused on, is that they knew in March and are only telling us now, in October, seven months later. And the Wall Street Journal reporting that broke this open today makes it pretty clear why: an internal memo apparently flagged that disclosing the bug would likely draw the kind of regulatory attention Facebook got after Cambridge Analytica, and invite comparisons to Mark Zuckerberg testifying in front of Congress. So they sat on it. A legal and policy review decided silence was the safer play. Im not shocked, exactly, Ive covered enough of this stuff since 2011 to not be shocked by much anymore, but its still a little galling to see it spelled out so plainly in writing.
Anyway, the practical upshot: consumer Google+ is shutting down, over the course of about ten months, wrapping up sometime next August. Enterprise G Suite versions stick around because apparently there's still a use case there I dont fully understand. If you run a WordPress plugin or some login flow that uses Google+ sign-in, you've got a runway before it breaks, so this isnt a today problem, its a next-summer problem.
I want to be honest about something though: I dont think anyone is actually mourning Google+ today. I had an account. I think most people reading this had an account. Google practically frog-marched everyone into signing up around 2011 and 2012 by bolting it onto YouTube comments and Gmail contacts, remember that whole stretch where you couldnt comment on a YouTube video without a Google+ identity attached to it? Miserable. I posted maybe eleven things there total, ever, and half of them were reposts of stuff I'd already put on this blog. The Circles feature was genuinely a smarter way to think about audience segmentation than Facebook's flat friend list, I'll give it that much credit, but being smarter than Facebook in one narrow design decision was never going to be enough to overcome the fact that nobody's friends were actually there.
What actually matters here isnt the funeral for a social network nobody used. Its the pattern. This is the same month, practically the same week, that we're all still digesting the Facebook breach disclosure from a couple weeks back, and now here's Google admitting they sat on their own bad news specifically to dodge the same kind of scrutiny Facebook got. Two of the biggest platforms on earth making the same calculation, in the same season, and only one of them getting caught doing it proactively instead of getting caught by a journalist first. Google at least disclosed this one on its own terms rather than getting forced into it, I'll give them that sliver of credit too, but "we told you eventually" is a pretty low bar to clear.
If youve got old Google+ data you actually care about, Google says theres a Takeout option to export it before everything goes dark next year. I'd be surprised if more than a rounding error of users bother. I might poke through mine out of morbid curiosity this weekend, mostly to see what I posted back in early 2012 and cringe accordingly.