The hallmark of Google Plus so far has been Circles. In contrast to Facebook where you’re either a friend or you’re not (until you put people into lists), Circles has you categorize people as friends, family, coworkers, etc. right from the start. This compartmentalization is meant to make targeting specific audiences and managing privacy easier.

This sounds simple, and it is if your circles are static. But things start to get hazy when your circles have changing memberships.

Is posting to a circle like sending email? In this model, each message is sent off to everyone who’s in the group at that particular time. When you add someone to the group, they get access to messages sent only while they’re a member. When you remove them, they get to keep those messages but nothing more.

Or is it more like giving out keys to a locked diary? Facebook walls and protected Twitter feeds fall into this category. When you add someone to the group, they get access to all of the accumulated content up to that point, past and present. When you remove them, the system revokes their access to all content.

It turns out that when you add someone to a circle in Google Plus, they get access to all of the content that’s ever been posted to that circle, if not in their stream then by drilling into your activity. This kind of falls in line with the locked diary model. But unlike this model, removing someone from your circle does not revoke their access. Instead, a number of scenarios can play out.

Compare what you expect to happen in each of the following situations with what actually occurs.

You make a post to a circle, but realize you don’t want Alice, who’s in the circle, to see it. You quickly remove her from the circle. Google Plus indicates to you that Alice no longer has access to the post, but if it made it into her stream, she can continue viewing it! Alice can even see comments made by others after she was removed, though she cannot make comments herself or share it with others. What does and does not end up in a person’s stream is not entirely clear. You post to a circle, and Bob replies yet again with a drama-filled comment. You decide to remove him from the circle once and for all. Because Bob has commented, he now keeps full access to the post. In this case, Google Plus correctly indicates that he has access. He can continue adding comments to the post, and he can share it with others outside the circle by default. And on top of that, he can see subsequent comments made to the post. You posted some personal things to your circle, but that was awhile back. You add Carol, who you’ve just made friends with, to your circle. Unfortunately, she starts to act creepy and so you remove her. These old posts most likely did not make it into Carol’s stream. Even if she went into your profile’s activity and commented on them there, she will lose access to them. If the posts did make it into her stream though (which might be possible if they’re not that old and/or her stream is not that populated), she keeps access. You just have no way of knowing which case it is.

Granted some of these are most certainly due to bugs, but this serves as a reminder that Circles are not as airtight as you might think.

And though not as farcical as Wave, the model Google has created here is still complex, confusing user expectations for how the system works and social norms for how it should be used.

This confusion will inevitably lead to gaffes. Even if these boil down to user error and not some technical failure, Google should not be entirely free from blame.