Google did not initially disclose a Google+ security bug when it first discovered it this spring because it feared regulatory scrutiny and reputational damage, according to a Wall Street Journal report citing documents and people briefed on the incident.

Google wrote in its own blog post on the incident that it determines when to notify users about privacy and security bugs based on the type of data involved, whether it can accurately identify who to inform, whether there is evidence of misuse, and whether there is any action that a user can take in response, and that based on that criteria it didn't immediately alert users of the Google+ bug.

However, a memo prepared by Google's legal and policy staff and seen by the Journal shows that leadership was also concerned about causing a potential privacy scandal. The memo allegedly warned senior executives that news of the bug would cause "immediate regulatory interest" and draw comparisons to Facebook's Cambridge Analytica data scandal.