> Except you don't need to whistleblow by testifying in front of congress or whatever. You can anonymously post on HN (or similar tech-oriented forums) with proof and it would be enough to get the ball rolling.
I'd bet that very few people would have the kind of access to see what violations of people's privacy are taking place and that proof someone posted to social media (besides a massive leak of innocent people's personal data) may not be verifiable by anyone other than google employees or regulators/government who could get into Google's internal systems.
I suppose that they could if there was a lie_to_public_about_data_collection() function in Android's source code or a massive store of location data that shouldn't exist just sitting unencrypted on our devices and being transmitted to google unencrypted, but other situations would be much less clear.
For example, when you open Google maps, you'd fully expect that your location would be sent to google. You'd also expect that google wouldn't keep that information tied to your account if you'd opted out of that tracking in your account settings. If google were keeping a copy of that location data on an internal server somewhere, associated with your dossier, but not made visible to users (or even most google employees) what proof would you expect to see posted to HN that we could verify for ourselves? Screenshots of the database/internal tool/documentation might be good, but screenshots can be faked and since we don't have access to the database, or the server deep inside google that hosts it, or their internal documentation we'd be unable to say for sure if it the screenshots were real.
Companies are using all kinds of tricks these days to catch whistleblowers like logging anyone who accesses sensitive information and adding hidden watermarks to documents and images. Just going to social media or the press could be very risky.