https://arxiv.org/abs/1907.06520
The "even in incognito mode" part seems odd:
> What Jack does not know is that incognito mode only ensures his browsing history is not stored on his computer. The sites he visits, aswell as any third-party trackers, may observe and record his online actions
The scope of incognito mode has recently expanded, but browsers still trust servers far too much (e.g. the Referrer header still exists, which is designed to leak private information).
> Your activity might still be visible to:
> - Websites you visit
> - Your employer or school
> - Your internet service provider
Edit: To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques.
Regarding IPs: it would be legally problematic and might be exposed leading to terrible press, large fines and a strong argument for more regulation, so there's a lot of incentive not to use it, and I'm not sure they would even need it given the vast amount of information they have on users.
Regarding fingerprinting: I believe somebody would have noticed. Google and FB are generally scrutinized much more than a random small ad-tech vendor.
It's incredible that on a site like HN people truly seem to believe that "incognito mode" equals some sort of anonymity and that there is such as thing like goodwill of Ad companies and that they won't take whatever data that is served on a silver plate (like the IP address).
And you know what's really troublesome? One's sexual preferences are unlikely to change by a lot. Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on.
Sure, and if you agree to it, they can. If you don't, however, and somebody blows the whistle, they'll be looking at huge fines in Europe and most of their lobbying will be void because their bought politicians will look very corrupt if they try to stop regulations.
Again, I don't believe that they don't do it because "it's not ethical". Rather, it's going to cost them lots of money if they do and get caught (and lots of good will, too), and I doubt that they need it. IPs would be another data point, but they have so many already that it may not add as much value. That's for FB, Google & co, of course, for small ad-tech companies it's different.
> Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on.
That's true, and the reason why you'd want to disable tracking completely. As a user, you gain nothing from companies being able to track you, but you lose plenty. Again, I'm not suggesting that companies aren't tracking users, I'm saying that Google and FB are likely not operating that obviously that far outside the law. They can, sure, but they'll need to run a large conspiracy to keep it secret, and large conspiracies are hard and rare.
Facebook collects data in shadow profiles.
Facebook collects login credentials for email accounts.
Facebook asks for phone numbers for "two-factor authentication" and then uses it in different ways.
Similar for Google. Most default options are enabled if you set up an Android phone (and these options and settings track you). Opt-in? Off by default? Nothing. Just to name one example.
Dark patterns to give consent everywhere, like buttons suggesting that opt-in is the only way to do it and so on.
All of this is kinda known, and illegal under GDPR. Consequences so far? None.
I'd vastly prefer that creative energy be directed to socially beneficial ends, but I have respect for the technical chops of people in adtech. However, it is fundamentally depressing that so many smart people spend their lives shattering the bounds of decency to get an ad impression for some useless item that will go into a landfill in 18 months. Aside from privacy the biggest tragedy here is the waste of brainpower spent promoting mindless consumerism in a world rapidly moving towards climate catastrophe.
It may be useful to tighten up anti-tracking-tech in incognito windows. Currently, since plugins aren't enabled in incognito windows by default, it has the opposite effect: while your cookies are hidden, you're loading each and every tracker when in incognito mode.