Google Shared My Phone Number!

Duration

Podcast Version

This post is also available as a podcast. Listen here, download for later, or subscribe wherever you consume podcasts.

Earlier this month, I received a phone call from a user of Three Rings, the volunteer/rota management software system I founded1.

We don’t strictly offer telephone-based tech support – our distributed team of volunteers doesn’t keep any particular “core hours” so we can’t say who’s available at any given time – but instead we answer email/Web based queries pretty promptly at any time of the day or week.

But because I’ve called-back enough users over the years, it’s pretty much inevitable that a few probably have my personal mobile number saved. And because I’ve been applying for a couple of interesting-looking new roles, I’m in the habit of answering my phone even if it’s a number I don’t recognise.

Dan sits at his laptop in front of a long conference table where a group of people are looking at a projector screen.
Many of the charities that benefit from Three Rings seem to form the impression that we’re all just sat around in an office, like this. But in fact many of my fellow volunteers only ever see me once or twice a year!

After the first three such calls this month, I was really starting to wonder what had changed. Had we accidentally published my phone number, somewhere? So when the fourth tech support call came through, today (which began with a confusing exchange when I didn’t recognise the name of the caller’s charity, and he didn’t get my name right, and I initially figured it must be a wrong number), I had to ask: where did you find this number?

“When I Google ‘Three Rings login’, it’s right there!” he said.

Google Search results page for 'Three Rings CIC', showing a sidebar with information about the company and including... my personal mobile number and a 'Call' button that calls it!
I almost never use Google Search2, so there’s no way I’d have noticed this change if I hadn’t been told about it.

He was right. A Google search that surfaced Three Rings CIC’s “Google Business Profile” now featured… my personal mobile number. And a convenient “Call” button that connects you directly to it.

'Excuse me' GIF reaction. A white man blinks and looks surprised.

Some years ago, I provided my phone number to Google as part of an identity verification process, but didn’t consent to it being shared publicly. And, indeed, they didn’t share it publicly, until – seemingly at random – they started doing so, presumably within the last few weeks.

Concerned by this change, I logged into Google Business Profile to see if I could edit it back.

Screenshot from Google Business Profile, with my phone number and the message 'Your phone number was updated by Google.'.
Apparently Google inserted my personal mobile number into search results for me, randomly, without me asking them to. Delightful.

I deleted my phone number from the business listing again, and within a few minutes it seemed to have stopped being served to random strangers on the Internet. Unfortunately deleting the phone number also made the “Your phone number was updated by Google” message disappear, so I never got to click the “Learn more” link to maybe get a clue as to how and why this change happened.

Last month, high-street bank Halifax posted the details of a credit agreement I have with them to two people who aren’t me. Twice in two months seems suspicious. Did I accidentally click the wrong button on a popup and now I’ve consented to all my PII getting leaked everywhere?

Spoof privacy settings popup, such as you might find on a website, reading: We and our partners work very hard to keep your data safe and secure and to operate within the limitations of the law. It's really hard! Can you give us a break and make it easier for us by consenting for us to not have to do that? By clicking the 'I Agree' button, you consent to us and every other company you do business with to share your personal information with absolutely anybody, at any time, for any reason, forever. That's cool, right?
Don’t you hate it when you click the wrong button. Who reads these things, anyway, right?

Such feelings of rage.

Footnotes

1 Way back in 2002! We’re very nearly at the point where the Three Rings system is older than the youngest member of the Three Rings team. Speaking of which, we’re seeking volunteers to help expand our support team: if you’ve got experience of using Three Rings and an hour or two a week to spare helping to make volunteering easier for hundreds of thousands of people around the world, you should look us up!

2 Seriously: if you’re still using Google Search as your primary search engine, it’s past time you shopped around. There are great alternatives that do a better job on your choice of one or more of the metrics that might matter to you: better privacy, fewer ads (or more-relevant ads, if you want), less AI slop, etc.

× × × × ×

15 comments

  1. bjb bjb says:

    So they took your customer contact info and published it as retail business main contact?

    I wonder if they just took their customer files and stuffed it into their LLM? “What could possibly go wrong?”

    1. Dan Q Dan Q says:

      That’s what it looks like. I shared that phone number with them 4+ years ago for identity verification only, and checked that it wasn’t published on our profile.

      I’ve even got annual-ish emails from them saying “here’s the business info we’ve got for you, is it correct”, which DON’T contain my phone number (and instead have a link to “add a business phone number”).

      But sometime presumably 3+ weeks ago, they changed it “for” me, putting my personal mobile number into people’s search results. 🤯

  2. Hey the nuber on the google page is way not blurred enough, I can decipher it!

    1. Dan Q Dan Q says:

      That’s not my phone number. I edited the number before I applied the blur. 😁

  3. Anonymus Anonymus says:

    You’ve possibly now published your own phone number again. The screenshot of the Google admin page has your number (07*****54) blurred out with so little blur that it’s still quite easy to read.

    1. Dan Q Dan Q says:

      Nope, that number is one of Ofcom’s designated-fake numbers for film & TV usage. I modified the number in the image before applying the blur. Good eye, though!

  4. bigtech@bigtech.co.uk bigtech@bigtech.co.uk says:

    another reason to never give big tech a non-burner # for anything at all.

    1. Dan Q Dan Q says:

      100%. Of course, then you instead risk them deciding some years in the future that texting a now-inaccessible number is how they’re going to 2FA you, but I suppose that’s a risk anyway!

  5. Sigmund Hansen Sigmund Hansen says:

    It might be an Android phone you’ve called who marked the phone number as a business and added Three Rings to it. Might not be, I’ve just noticed I get queried after being called or calling numbers not in my contacts, whether it’s a business phone number.

  6. Joe Joe says:

    Even if you’re not a European/UK citizen (I’m not going to assume anything) you should be able to make a Subject Access Request to Google to obtain the information about when your details changed and who changed them.

  7. Aman Aman says:

    Which search engine would you recommend using? I wouldn’t even know where to start looking and how. Unless you’re talking about DuckDuckGo, but that seems too easy, no?

  8. delroth delroth says:

    Is it the same phone number that’s listed as app support contact for your Android App, by any chance? https://play.google.com/store/apps/details?id=uk.org.threerings.pwa&hl=en shows one ending in the digits “46”.

  9. Alan Alan says:

    I suspect “Learn more” just goes to one of these two linked pages:

    https://support.google.com/business/answer/2721884

    https://support.google.com/business/answer/3480441

    I.e. I suspect the transient help link isn’t customised for the specific update.

  10. Felix Felix says:

    Any registered Google Maps user can submit changes to the business informations (there’s a “suggest” button in Google Maps when you look at a company’s details). Those changes can automatically be activated and then they also should come up in your Google Business profile. So, the publication of the phone number could also have been initiated by a customer.

    1. Dan Q Dan Q says:

      If the business has been “claimed” using Google Business Profile, as is the case here, my experience is that such changes are added as suggestions for the business owner to approve, not just added immediately.

      Also, on previous ocassions that any change has been made, I’ve received an email. But not this time.

Reply here

Your email address will not be published. Required fields are marked *

Reply on your own site

Reply elsewhere

You can reply to this post on Mastodon (@blog@danq.me), Mastodon (@dan@danq.me).

Reply by email

I'd love to hear what you think. Send an email to b26608@danq.me; be sure to let me know if you're happy for your comment to appear on the Web!