Technology and security history
Why Google+ shut down
Google announced the wind-down of consumer Google+ in 2018 after its Project Strobe review. Low service usage and the difficulty of maintaining secure APIs coincided with two separate bugs affecting access to profile data.
Trusted by
Companies and institutions that need stable IT.
The Google+ shutdown
The account below sets out the confirmed information and separates the two distinct API bugs associated with the Google+ shutdown.
Key security problems affecting Google+
In March 2018, Google discovered and fixed a bug in one of the Google+ People APIs. Apps authorised to access a user's profile could see selected fields shared with that person even when the fields were not public. Analysis of two weeks of logs showed that up to 500,000 account profiles may have been potentially affected. Google found no evidence that developers knew about the bug or misused profile data.
Official Project Strobe announcement
Google's 8 October 2018 announcement explains the People API, profile fields and limits of its analysis. It also announces the wind-down of consumer Google+.Application and API security
Reviewing permissions and integrations limits third-party access to data required for a defined purpose.The second API bug — approximately 52.5 million users
A separate bug followed a November 2018 software update. For six days, apps could receive broader access to non-public profile fields belonging to a user and people who had shared data with that user. Google reported about 52.5 million affected users, but again found no evidence that developers were aware of or misused the access. On 10 December 2018, Google brought the planned shutdown forward from August to April 2019.
What was shut down on 2 April 2019
The shutdown applied to the personal consumer version of Google+ and its content. It did not close Google Accounts or services such as Gmail, Drive, Photos or YouTube. Google+ integrations and sign-in were retired earlier, while the enterprise product later transitioned to Google Currents. Currents was also shut down: Google states that customer access ended on 5 July 2023. Business collaboration migrated to spaces in Google Chat, not a restored consumer Google+.
Four lessons for organisations using cloud services
The Google+ story is not an argument against cloud services. It shows that every service and integration needs an owner, least-privilege access, an exit plan and control over data when a supplier changes strategy.
Application and ownership inventory
Maintain a current register of third-party applications, OAuth scopes and the accountable business owner for each integration.Least-privilege OAuth access
Revoke unused permissions regularly and restrict access to the data required for a clearly defined purpose.Verified data export
Define the export scope and format, then verify archive completeness and practical recoverability before the deadline.Supplier deadlines and migration rehearsal
Track security announcements, service-condition changes and retirement dates for APIs and sign-in functions. Test the migration sequence early enough that service retirement never becomes an emergency project.Questions before starting cooperation.
When was consumer Google+ shut down?
+
The personal consumer version of Google+ was shut down on 2 April 2019. The wind-down of APIs and integrations started earlier.
Do 500,000 and 52.5 million refer to the same incident?
+
No. The first figure relates to the People API bug disclosed in October 2018; the second relates to a separate bug introduced by a November 2018 software update.
Did Google confirm that developers exploited the data?
+
Google's announcements said it found no evidence that developers knew about either bug or misused the access they inadvertently received.
What is the main lesson for an organisation?
+
Every external service needs an owner, least-privilege permissions, an integration inventory, a verified data export, and a migration and access-revocation plan. The plan covers data, accounts, integrations, business dependencies and communication with users. First inventory the scope, then export and verify the data, switch integrations and revoke access.
Plan a secure service transition
We will identify dependencies, export requirements, evidence and the sequence of technical work.
Contact Virtline