Even before I start formally interviewing Prabhakar Raghavan, Google's senior vice president of advertising and commerce, we're already talking about privacy.

As CNET's photographer gets ready to capture images of Raghavan in his corner office at Google headquarters in Mountain View, California, we ask if there's anything we should avoid snapping in the scene -- like the white board wall at the far end of the room with scrawls on it. A Google spokeswoman suggests taking down framed photos of his family that line the sill of a full-walled window. Raghaven says yes, the photos can come down, but that they'll deal with it later. We start the interview and eventually our photographer starts shooting, with the family photos still there in the background. (We won't publish those pictures.)

The sequence in a way personifies some of the challenges Google faces as it marches into an intense debate over privacy, data collection and security: At Google's scale, some things fall through the cracks. You can't always control the actions of third parties. And even if you have the best intentions, they don't always yield effective results.

Two days earlier, Google CEO Sundar Pichai said something striking for a company that makes more than $100 billion a year because it knows so much about the billions of people who use its services.

"Privacy should not be a luxury good," Pichai wrote in a May 7 op-ed in The New York Times. "We're also working hard to challenge the assumption that products need more data to be more helpful."

For that to work, Pichai's promise needs to be sincere. It's a meaningful expectation given that Google's ad business, which keeps its services free, is a money-minting machine that lets marketers run lucrative ads targeted to specific audiences. The targeting is based on personal info like your age, location or favorite restaurant. Google knows all that because of what you search for, the videos you watch on YouTube and the places you look up on Maps. The strategy has fueled Google's fortunes for two decades, and today it's the largest player in the massive online advertising market with a 31% share, according to eMarketer. Facebook is No. 2 with 20%.

Google CEO Sundar Pichai at the company's I/O developer conference last week. James Martin/CNET

Advertising is the most important business at Google. It's the lifeblood of parent company Alphabet's nearly $800 billion empire, with about 85% of the company's annual revenue coming from ads. That cash also funds the rest of the conglomerate's audacious moonshot projects, including self-driving cars, stratospheric balloons that beam down internet signals and research into extending the human lifespan.

Still, over the past year, consumers and lawmakers have taken a harder look at the privacy policies of giant tech companies. Facebook's Cambridge Analytica scandal last year brought data collection issues to the forefront. Google has also been criticized for its wide-scale data operation and the way its location history settings could mislead consumers with its disclosures. In response, Google and Facebook have both begun to preach the virtues of privacy. This month alone, Google announced features that let people auto-delete data and crack down on browser cookies.

But Raghavan, who'll address more than 5,000 advertisers, agencies and partners at Google's Marketing Live summit in San Francisco on Tuesday, says the company's future depends on getting privacy right -- for both advertisers and users.

And he agrees with Pichai that while Google has a stable of products capable of collecting even more information from people for ads, the company should use "as little of that data as possible over time" for targeting, while still showing people relevant ads.

"Whoever's leading the market [in five years] will be the ones who are actually the most trusted," Raghavan says. "If we can maintain that trust, then we can remain a market leader. If we don't, it's a question."

It's a question consumers are asking, too.

"Increasingly, companies like Google have tons of access to micro-bits of data about you that allow them to get a sense of you as a person, instead of aggregated information," says Betsy Cooper, director of the Aspen Tech Policy Hub. "That can lead to more targeted adds, but it can also lead to a sense of creepiness."

A room of one's own data

Google wasn't the first online advertising platform. But as it grew into a behemoth after the dot-com era, it set precedents in how -- and how much -- personal data was collected from users. It's hard to reconcile Google's newfound emphasis on personal privacy with the trove of information it's stockpiled over the last two decades.

So I ask Raghavan, who became Google's ad chief in October, why we shouldn't point to Google as the company that's caused the advertising data economy to evolve the way it has, and how it's going to work itself out of the box it built.

He doesn't really answer the question. Instead, he says there's a misperception about how Google uses data for advertising. He argues that Google collects personal information to make its products better, not to target ads. An example is a new feature announced last week for the Google Assistant that lets you list your mom as a relative, so when you ask for directions to her house, the voice-based AI assistant can tell you.

To emphasize his point, he gives the analogy of a physical room filled with all the data Google collects about you. That includes information from Gmail, Drive and Docs, which Google says it doesn't use for advertising (though the company did use Gmail data for ad targeting until two years ago). Google only uses a "minuscule" amount of data that would take up a small corner of the room, he says. But he won't say exactly how minuscule that portion is. He does tell me that a few of the important signals include your search query and IP address.

Some might find the push for privacy a strange turn for Google and Facebook, Silicon Valley's biggest data hoovers. But the shifts could be attempts to pre-empt sea changes that have already started to rock both companies. For the most part, the turning point was Facebook's Cambridge Analytica scandal that became public in early 2018, in which a UK-based political consultancy co-opted the Facebook data of up to 87 million people. The incident raised alarms throughout the tech industry.

"It was intriguing to see that level of data access had been given to a third party. It was not the kind of thing we would have thought about," Raghavan says. "But it certainly led us to take a deep breath, take a moment to say, 'Hey, let's make sure we're still doing the right thing.'"

Looming regulation

The pressure is also coming from regulators. Almost exactly a year ago, the General Data Protection Regulation, or GDPR, took effect in Europe. The sweeping law gives citizens in the EU more control over their data, including being able to download a copy of the personal information a company has on you. There's been momentum for the US to adopt similar rules, and Pichai threw his support behind data regulation last week in his op-ed. Raghavan says he doesn't know exactly what that regulation could look like, but the GDPR is a good framework.

A year ago, Facebook and Twitter endorsed the Honest Ads Act, a bipartisan Senate bill that would require tech companies to disclose how political ads are targeted and how much they cost. More than a year after Facebook CEO Mark Zuckerberg and Twitter CEO Jack Dorsey supported it, Google is still a holdout.

"It certainly led us to take a deep breath, take a moment to say, 'Hey, let's make sure we're still doing the right thing.'" Google SVP Prabhakar Raghavan on Facebook's Cambridge Analytica scandal.

When I ask Raghavan if he would endorse it, a Google spokeswoman jumps in before he can answer and says the company supports the "spirit" of the bill. But Google hasn't supported the bill itself.

The tech giants have also been under intense scrutiny over their sheer size. Sen. Elizabeth Warren, a Democrat hopeful for the 2020 US presidential election, has made it a key part of her platform to break up the tech giants, including Google, Facebook and Amazon. And on the morning of our interview, Facebook co-founder Chris Hughes called for the split of the company he helped birth.

"I'm not an antitrust expert or anything," Raghavan says, when asked about those high-profile calls for action. The Google spokeswoman chimes in again. "We'll let the lawmakers deal with that."

Meanwhile, Google's challenges aren't only from external forces. Last month, parent company Alphabet posted a rare miss on sales estimates, its slowest growth since 2015. It didn't help that Google was hit with a $1.7 billion fine from the EU for what the commission called "abusive" ad practices. But the disappointing report also stemmed from growing ad competition from rivals like Amazon.

Raghavan declined to comment on the financial results.

Not by default

A few hours before Pichai published his New York Times op-ed last week, Google made two of its marquee privacy announcements at its I/O developer conference.

The first one cracks down on cookies used with Google's Chrome browser, which accounts for more than 60 percent of all web surfing. Cookies are little text files that follow you across the internet, and they can be useful for keeping you logged into a website or leaving an item in your online shopping cart if you exit the site without buying it. But cookies also let advertisers and publishers track your activity online as you explore the web.

Google said it will let people differentiate between the types of cookies they delete. So you could keep the useful stuff, like the cookies related to logins and settings, and get rid of the third-party ones for advertising.

The other announcement was for a browser extension you can install to tell you more information about the ads you see across Google services and from its ad network partners. That includes the names of third-party companies that were involved in targeting the ads, and companies that have trackers present in the ads.

A Google data center in Taiwan. Sam Yeh / AFP / Getty Images

Google also introduced a tool earlier this month that lets people auto-delete their data after either three or 18 months.

The new tools are a step in the right direction, but Google is in a tricky situation -- or as Raghavan calls it, "threading a balance." The search giant has to weigh user privacy and safety against disrupting business for entire industries that rely on its ad network.

On one hand, Google has been criticized for not activating its privacy tools automatically, instead putting the onus on people to seek them out. Raghavan defends the decision to make the tools opt-in, adding that making them default settings would be "ham-handed."

"The idea here is not to, in a broad stroke, say we've solved the problem and there you have it," Raghavan says. "Because the default turn-off doesn't solve the problem."

He says acting too harshly toward cookies might encourage bad actors to track people in more nefarious ways. He also said it would be "killing the ecosystem" for publishers that depend on that data.

He also argues that the tools currently in place aren't all that hidden. Raghavan says there were 2.5 billion visits last year to people's Google Accounts page, where you can set your ads preferences or turn off ad targeting altogether. But that page also includes settings for password info, security and payments. When it comes to people actually accessing ad settings, the number drops dramatically to 20 million per month. (For context, Google has eight products with more than a billion users each, including search, YouTube and Android.)

Google declined to disclose how many turned off personalized ads.

"Google would never undermine their core business model. I don't think they could ever really be a privacy-focused company." Jeremy Tillman, president of Ghostery

Others argue the move to crack down on cookies could be anticompetitive, since Google already has many ways to gather information about users through its own services. They say the new cookie settings could then hurt competitors while leaving Google to draw from other wells for data. Raghavan again argues that Google doesn't use most of the vast amounts of data it collects on its own services for ad purposes.

"The criticism is a little bit of fear-mongering," he says. "I don't anticipate that these changes are going to kill businesses."

At the end of the day, Google isn't fundamentally changing its ad business with either of these announcements. And that disappoints privacy advocates. But executives in the digital ad industry say it's by design.

"If you took the most radical approach, you make it very hard on digital advertisers," says Ari Paparo, CEO of Beeswax, a New York City-based ad tech startup. Paparo was formerly a vice president at DoubleClick, an ad firm Google bought in 2008. "It's not surprising they didn't want to take any very strong moves."

Jeremy Tillman, president of the ad blocker maker Ghostery, is less charitable. His company sparred with Google earlier this year after some developers became worried Google would prevent ad blockers on Chrome. He calls the search giant's privacy push a "red herring." "Google would never undermine their core business model," he says. "I don't think they could ever really be a privacy-focused company."

'You'll never make money'

Raghavan's office is adorned with knickknacks that give you a sense of his past lives. There's an old California license plate and a throwback Yahoo logo, a badge of honor from his days as the head of Yahoo Labs, the tech brand's research arm. His bookshelf includes Japanese for Busy People, three volumes of The Art of Computer Programming and two books on game theory.

The senior executive, who's originally from Chennai, India, joined Google in 2011. Three years later, Pichai put him in charge of Google Docs, Drive, Hangouts and other productivity apps. Under his watch, the company created versions of those services specifically for business customers. The lineup of apps, called G Suite, now has 4 million paying customers.

But Raghavan's relationship with Google began long before that. When he was teaching at Stanford University in the late '90s, he met two graduate students named Larry Page and Sergey Brin who were starting a search engine. They asked him to join, but he declined. "I said you'll never make any money."

Larry Page, CEO of Alphabet Getty Images

Last October, he took over Google's ads business from its former boss Sridhar Ramaswamy. Raghavan says he doesn't regularly see his old friend Page anymore, and the privacy push didn't really come from Google's co-founder and former CEO. "Larry doesn't get involved in that level of operation and detail," he says.

Instead, it's Pichai who talks a lot about the "primacy of privacy," Raghavan says. What does that mean? "He's made it clear that [privacy] is absolutely paramount to him in the way he wants to run the company." Raghavan says. We should expect "a steady drumbeat" of privacy-related announcements.

In the meantime, Google says it's trying to tamp down the tech industry's appetite for data. The company touts breakthroughs in AI like "federated learning," which relies on Google's systems getting smarter by using raw data on people's devices, instead of transferring it to the cloud, so Google doesn't actually see the information, but still learns from it.

"You'll see us continue to try and roll out more major innovations," Raghavan says. "But at the same time, curtail the amount of data that's collected and stored."

It's promising, but for now, Google has to contend with 20 years of data collection. And old habits are tough to kick. ●