Google’s Privacy Fine: What Resellers and WordPress Hosts Should Learn

Last updated: October 6, 2026

Two decades ago, Google's then-chief Eric Schmidt appeared on CNBC and addressed questions about how the company handled user information. His response surprised many given how much Google had claimed to care about user privacy at the time. That moment has never quite left the firm's reputation, and it sits uncomfortably close to the ad-tech business model that still powers much of the web.

For small agencies and freelance resellers, that history is more than a cautionary tale about big tech. A $22.5 million federal penalty tied to bypassing default Safari browser settings, alongside EU complaints over later policy changes, serves as the clearest public case study of what happens when a platform treats user data as raw material. Hosting resellers sit closer to that risk than they often realise.

The short version

• Former Google CEO Eric Schmidt told CNBC users should not be afraid of having data collected, suggesting the firm would use information only when it had justification to do so.
• Co-founder Larry Page challenged critics to separate "worry versus harm," arguing that bulk data collection is acceptable if no specific harm materialises.
• Google paid a $22.5 million federal fine after bypassing default Safari privacy settings.
• EU regulators also argued that subsequent privacy changes breached European law.
• The broader picture: monetising user data sits at odds with the privacy movement now reshaping the web.

Why this matters for resellers

Big-tech headlines rarely land on a one-person hosting shop. This one should. Reseller hosting is a trust business. You store other people's email, login sessions, form submissions and WordPress database rows. If clients discover you snoop on, sell or casually mine that traffic, the fallout mirrors what Google faced: regulator letters, bad press and churn.

The Schmidt and Page quotes are useful object lessons. The "if there's no harm, it's fine" framing is exactly the defence you cannot make in front of an angry client. Harm in privacy is usually defined after the fact, by a lawyer or a data-protection authority, not by the company holding the data. Page's argument was an attempt to shift that burden onto critics. It did not work.

Three questions to ask your own stack today

Say you run a small white-label hosting brand with dozens of client sites. Open cPanel's File Manager and pull the raw access logs from one shared account. You will likely see full IP addresses, browser strings and referrers going back weeks.

Now ask three questions:

• Do your clients know you hold this?** Check your terms of service.
• Do you actually need it?** Most analytics questions can be answered with aggregated, anonymised data.
• Can you delete it on request, today, without digging through backups?

If any answer is "not sure," that is your privacy liability list. Fix it before a client asks. The same goes for any WordPress plugin that stores form entries in the default `wp_options` table indefinitely; a ten-minute cleanup script removes years of stale personal data and shrinks your breach surface in one move.

Who should care — and what they should do

Our analysis

The Google story is a slow-motion warning. The $22.5 million penalty was the moment privacy regulators stopped accepting the "worry versus harm" defence as sufficient. Since then, GDPR, the EU Digital Services Act and similar rules have codified what Schmidt's response hinted at: companies no longer decide alone where the privacy line sits.

For resellers, three trends follow. First, vendor scrutiny will tighten — clients will increasingly ask what you do with their traffic data, especially EU-based ones. Second, "we just resell hosting" is not a shield — if your brand is on the welcome email and the invoice, customers see you as the data controller. Third, cheap differentiation is eroding — competing on price and bandwidth alone gets harder when buyers factor in privacy posture.

Hosts who quietly invest in logging hygiene, clear retention policies and a one-page public privacy statement will look more professional than those who do not.

What to watch next

Expect more EU-style rules to appear in Israeli and US contracts as multinational clients demand uniform standards. Watch for cPanel partners advertising built-in data-retention controls and anonymised analytics — those will become selling points within a year. And if you have ever used any version of the "we only use data when we have good reason" argument internally to justify keeping logs "just in case" — stop. That defence is effectively closed.

Key takeaways

• Reseller hosting is a trust business; sloppy data handling is a liability, not a technicality.
• The "no harm, no foul" privacy argument weakened after Google's $22.5M Safari fine.
• Audit cPanel logs and WordPress storage today; most sites hold more personal data than they need.
• Publish a plain-language retention policy before a client asks for one.