When it comes to data privacy, an ambiguous line in Google's Terms of Service leaves many things open to interpretation.

Ever since Google Drive debuted Tuesday, we've watched journalists, privacy advocates, even security firms, dogpile on Google's policies over what it can do with data you store on its servers. The outrage has subsided somewhat, thanks to the swift work of Google's communications firefighters, but even with clarification, one line in Google's Terms of Service still gnawed away at us.

"Derivative Works"

To recap, one paragraph in Google's company-wide Terms of Use statement was highlighted by many publications to imply that Google retains the right to repurpose any data you upload:

"When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes that we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content."

Wow, sounds scary! Google can create "derivative works"-- does that mean it can use my G+ profile picture in an ad? Or publish the rough draft of this story that I saved in my Google Drive?

The Electronic Frontier Foundation's digital rights analyst Rebecca Jeschke, and many other privacy lawyers say "derivitive works" is a standard line giving Google the right to manipulate your data and run its services. Dropbox, Microsoft SkyDrive, and Apple iCloud all use similar legalese.

Like any cloud service provider, Google has to copy your data to its servers to process, and then deliver your requests. Google Translate is an easy example: once you enter words in a Google Translate box, it gets sent to Google's servers (located around the world), copied, processed, and sent to you in Azerbaijani or whatever language you requested. And to do this without violating copyright laws, Google needs licenses to copy your data. Now-archaic copyright law simply dubs this "derivative works."

Google was also quick to point out another line in its ToS to journalists:

"Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours."

Unsatisfying Response

But Google (and Jeschke's) explanation is only partially satisfying. Yes, the "derivitive works" line is standard business legalese, and you technically own your own content, but is there anything preventing Google from interpreting these vague lines the way the rest of us have—that it can do anything it wants data you upload to its servers?

Unfortunately, there's no clear-cut answer here, says Aaron Brauer-Rieke, a fellow at the Center of Democracy & Technology.

"This is not unusual language when it comes to cloud drive services, but there is some ambiguity here with the wording," he says. "All these licenses do give Google a lot of rights over what it can do with your data."

"The real unknown here is what Google can do with your publicly shared information."

Like your Blogger post, or a Picasa album that you set as "visible to anyone with a link"-- can Google use that in a promotional item?

Technically, yes.

Realistically, will it? Brauer-Rieke doubts Google would ever go that far for fear of jeapordizing the public's trust. After all, trust is the lifeblood of cloud-based service providers.

"I wish users had more certainty, but ultimately Google's goal is to make sure they don’t inadvertently get sued for delivering their services."

Google's privacy policy, a separate document, says the company will never bypass your share settings in order to use content for promoting its services. If you choose to share your document with four people, Google will only ever let those four people see it. Files you upload to Google Drive are private by default anyway, but it's definitely worth taking some time out to review your privacy settings for other Google content.

The takeaway here is that you have a responsibility to make your Google (or Skydrive, Dropbox, Facebook, Twitter, etc.) content private, if you don't want Google manipulating it for its own purposes. Don't be lazy.

For more, see PCMag's Hands On With Google Drive.