Hacker News Reader

Comment by jedieaston | Hacker News Reader

It'd be impossible for Google Analytics to not collect data from a incognito tab without it knowing that it is incognito somehow (like if Chrome attached a header to all outgoing requests that said incognito=1 or something). But then websites would know you are in incognito, and find some other way to track you without leaving cookies on your box (like logging the IP address for the request and merging all incognito requests into one profile, which would be accurate enough).

What do they want Google to do? They warn you specifically of this anyway when you open an incognito tab:

You've gone incognito

Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. Learn more...

Chrome won't save the following information:

Your browsing history

Cookies and site data

Information entered in forms

Your activity might still be visible to:

Websites you visit

Your employer or school

Your internet service provider

View on HN

It would be easy. They'd have to just not collect, collate, fingerprint, and otherwise acquire enough PII to de-anonymize anyone that touches a script that feeds back to their servers.

> "Google tracks and collects consumer browsing history and other web activity data no matter what safeguards consumers undertake to protect their data privacy," reads the complaint. The search giant surreptitiously collects data through Google Analytics, Google Ad Manager, website plug-ins and other applications, including mobile apps, according to the complaint.

The web worked fine in the days before Google started building a profile of everyone who interacts with the internet so that they can sell us garbage we don't need. So how about stopping with the voracious data collection feeding into a permanent profile? You know, like the web used to work?

Just because it is now doesn't mean it hasn't been deliberately built into the thing that presently exists.

edit: and if that makes certain ad-centric businesses obsolete, good.

Would you consider IP address enough to de-anonymize most people?

Why not?

Definitely not.

Case 1. Fixed home broadband often allocates a single IP that the household might have for weeks, months or years. There might be only one person in the house, and even if not it's easy to build a profile across websites visited on how many live there, what time they're active, etc.

Case 2. Mobile broadband often allocates IP seemingly based on the tower you're connected to (in my country, I can notice this effect). So, looking at the surface of the you'd think it arguable that mobile IP is anonymised... Unfortunately, people are creatures of habit and ping the same towers repeatedly. So it's still possible to track.

In short, if there's value to be had in storing any value (like an IP) for ad related purposes, then there's more than a good chance personal information is leaking.

Right, that's the point. Chrome will send "enough PII to de-anonymize" no matter how careful they try to be, because your IP address is very often enough.

I wouldn’t and I’ve professionally sourced and brokered PII. It may be the case that you could match up IP’s with other fingerprinting and/or PII but I’m not sure how. I’ve never seen a broker with a PII data product that would even accept an IP as an input, and IP geolocation is famously inaccurate. This strikes me as theoretically possible but totally infeasible unless you have access to some very special data. I’ve always assumed it was possible and that someone was likely doing it but I was never able to determine how with data that could be acquired through the usual channels.

1) Log in to your gmail

2) Switch to incognito mode, and go to some website that has Google ads on it

It would now be possible for Google to figure out that the ad was served to someone from the same IP address that recently was logged in with your gmail account.

Any health care website (for instance) that has PII on it probably stores IP addresses at some level, to try to detect DoS attacks, etc. If someone wanted to join that data, IP to PII, they could.

I can't disagree that's it's possible for Google to match up all the stuff it has on people and can get from others. In fact, I made that same assertion in another thread some time ago and got super down-voted over it.

However, there are lots of totally legal scenarios in which two parties match up and combine data on a user containing PII.

I also would like to know if you believe there's something ethically wrong with combining data, provided it's legal and doesn't violate a privacy policy. You haven't said so explicitly but that seems like the implication.

Espressosaurus made the assertion that it would be easy for Google to not collect enough PII to de-anonymize anyone (in Incognito Mode).

I'm pointing out that if you:

1) log in to your gmail

2) Switch to incognito mode and go to a website that has Google ads on it

And if Google has recorded your IP address in both those interactions (of course they have - everyone does), then Google has enough information on most people to de-anonymize them.

Therefore, what Espressosaurus said is absurdly wrong and should not be taken seriously by anyone.

Let's focus our efforts on saying how Google can analyze and use the data, rather than on whether they're allowed to gather it in the first place.

Because it's ridiculous to pretend you can stop Google, or any website for that matter, from collecting IP addresses of logged-in users.

> So how about stopping with the voracious data collection feeding into a permanent profile? You know, like the web used to work?

You're asking Google to stop making most of their money. Their whole business is built around selling advertisers a targeted advertising platform.

    - Advertising revenue of Google for 2019 (in billion U.S. dollars): 134.81 [1]
    - Annual revenue of Google for 2019 (in billion U.S. dollars): 160.74 [2]

Sure, they should stop, people should not get fingerprinted across sites, these companies should not track us, but good luck getting them to comply with just asking.

    [1] https://www.statista.com/statistics/266249/advertising-revenue-of-google/
    [2] https://www.statista.com/statistics/266206/googles-annual-global-revenue/

> It would be easy

Why do these idealistic comments get voted to the top? As if Google could just simply change their entire business model if only they were enlightened how "easy" it would be.

> The web worked fine in the days before

The web is the way it is today because there wasn't anything to stop it from becoming this way. There still isn't anything stopping it.

If you want to see change to some historical point in time, start working on solutions to get there.

I see these type of comments so often on HN but I really don't believe it reflects the majority opinion. I don't honestly think most people care about how the web used to be. It is the way it is because people don't know or care about the consequences of trading their privacy with a big company for free stuff.

> If you want to see change to some historical point in time, start working on solutions to get there.

The only solution I see is enforced regulation to respect DNT, or something like it. Do you have something else in mind?

If you mean respect for privacy in general by companies, I think this comes down to people needing to first want it more. Like a lot more. We only started seeing things such as GDPR and CCPA after Cambridge Analytica caused people to understand a bit more why privacy matters. But it wasn't enough to see drastic change since there isn't a clear problem and that's the crux of the issue: nobody really understands why it's a such a big deal. There isn't an easy to grasp response to "what is so bad if others know what I'm doing online." Start with justifications and education of why privacy matters, and if it's compelling, change will be demanded.

Regulation is the only thing that can work. The goodness of their heart is not something that can be relied on. Asking Google (and other advertisers) to just back off their biggest money-maker is a non-starter. The only solution is regulation. Insufficient regulation is what brought us to this point. The harm here is too distributed, too abstract, and not obvious to the people it's harming. The people it's harming are the product, the people buying the data are the customers. There is no way Google voluntarily makes those changes. It will have to be forced to via regulation, enforcement, imposition of fines or potentially even jailtime in order to get it to comply. Its business model demands nothing less.

They dont need to invent their own header. They just need to obey existing ones: https://en.wikipedia.org/wiki/Do_Not_Track

I would expect that no script would be loaded from google analytics/tag manager domains once I turn it on. But this is obviously not the case.

The article is too vague to actually understand more about what this lawsuit is but regarding:

Google tracks and collects consumer browsing history and other web activity data no matter what safeguards consumers undertake to protect their data privacy," reads the complaint. The search giant surreptitiously collects data through Google Analytics, Google Ad Manager, website plug-ins and other applications, including mobile apps, according to the complaint.

They are right. Google is doing that.

I think that incognito mode was mentioned due to this statement: safeguards consumers undertake to protect their data privacy.

They will probably build the case that they tried to protect themselfs but google was still tracking them.

And if chrome is sending to google servers flag that user has turned on incognito mode (which I bet they are/did), then they are having a serious problem.

"Poor user, this little girl with cute blue eyes, tried to protect itself from invasion of her privacy, they knew that but were still tracking her"

If this is the case they will have to pay or bribe the judge.

The law firm that is behind it is specialized into class action lawsuits with crew of around 300 lawyers so I expect a good show. I hope google wont settle outside the court.

Does Google Chrome set DoNotTrack by default in incognito mode? If not, why not?

I'm not sure if they do, but one potential reason not to do it is that setting DNT literally gives the server 1 additional bit of information about your configuration. This could be used to track you more effectively.

1 extra bit is the last of my concerns, there's plenty of bits to uniquely fingerprint a browser anyways. I'd gladly trade one inconsequential bit, which requires malicious intent to misuse, to keep my privacy safe when dealing with honorable entities like, I presume, Google.

https://blog.mozilla.org/internetcitizen/2018/07/26/this-is-...

What goes into one's fingerprint:

1. navigator.userAgent, 2. navigator.language, 3. navigator.doNotTrack, 4. screen.width, 5. screen.height, 6. screen.colorDepth, 7. Intl.DateTimeFormat().resolvedOptions().timeZone, 8. navigator.platform, 9. navigator.hardwareConcurrency, 10. GPU vendor and renderer, 11. isTouch, 12. storage types, 13. font-list, 14. canvas-hash

Oh, there is so much more that can go into a browser fingerprint. There is no one, single "browser fingerprint." Basically any API your browser exposes can leak information that can be used for fingerprinting. See: https://panopticlick.eff.org/

I don't understand. There are dozens, if not hundreds, or even thousands of bits to use to identify any given browser, but providing one extra such bit that politely asks 'Do Not Track' is now a problem because it makes tracking slightly easier?

DNT is broken for the exact reason stated earlier, it adds one more signal to use to track users.

The lawsuit is ridiculous. Incognito mode is extremely clear about what it does and does not protect against.

The irony brought up is that for Google to respect incognito they would have to then break it even more.

Because it would be a trivial indicator that you're in incognito mode.

I don't think it does. One possible explanation is that they don't want the "Edge Effect". If the header is set by everyone than people will just ignore it. Since Edge started setting it for everyone the header is basically useless already.

It would also provide an interesting way to identify incognito users which chrome has been trying to prevent websites from doing it. Of course it won't be perfect, but probably more than 99% of DNT headers would be incognito if they did this because I would bet that very few people enable it manually.

If everyone has a lock on their door, then people will just ignore it and break into the house anyways.

> If everyone has a "Under video surveillance" sticker on their door...

Ftfy.

It takes active effort to break into a house. It takes zero effort to ignore a header. It's more akin to everyone having a sign on their yard that says "Please don't break into this house."

Great point. There are 'No Soliciting' signs and laws.

https://banneradviser.com/no-soliciting-signs

> In a nutshell, no, door to door solicitation isn’t illegal. But if you have a no soliciting sign posted on your property, and the salesperson is refusing to vacate the property, they can be assessed trespassing fines and possible legal charges.

> But if you have a no soliciting sign posted on your property, and the salesperson is refusing to vacate the property, they can be assessed trespassing fines and possible legal charges.

How is this different from when you don't have the sign? Do they get to refuse vacating the property without trespassing in that case?

It's not a black/white situation. It's a 'argue in front of a judge' situation.

With sign: Unassailable evidence that tresspassers are informed they are not welcome.

Without sign. Owner word vs tresspasser word.

The latter is a weaker stance.

I am not a Google employee but Chrome does not send the dnt header in incognito mode. It only sends it when you have it turned on, in which case it will send it in both regular and incognito mode.

> If this is the case they will have to pay or bribe the judge.

Or blackmail him, because obviously they have his profile too.

The article is very light on details, but am I understanding correctly that the problem is google analytics not honoring settings in chrome? If so, I can't think of a solution that doesn't involve a tighter integration between websites and chrome, and if anything I think we should be moving away from that.

They could set the do not track flag in incognito mode and honor the do not track flag on their web properties.

Wow, I didn't realize google analytics doesn't respect the do not track flag. But I just independently verified that is correct. It sounds like this is a simple and elegant solution to the problem (and the moral solution too).

I used a google analytics plugin for Gatsby, and it had a respectDoNotTrack configuration option when you set it up, which does respect it - but I presume that just doesn't send the data to google in the first place.

Incognito isn't a setting, per se, it's a policy. It scopes the cache, cookies, etc. to a sandbox that's deleted once all incognito windows are closed. Google Analytics doesn't even know this policy is in place. The only websites that "honor" incognito are media outlets with paywalls using tricks (tricks Google's always trying to fix) to detect that you're in incognito mode.

The problem isn't a technical one per se, but rather a legal one. Google the company is offering a browser that purports to make someone "incognito" while simultaneously working to track people who are using it - the exact opposite of what one would expect.

Mozilla isn't getting sued for the failings of Firefox's private mode because Mozilla doesn't operate a surveillance system that exploits those failings, and Facebook isn't getting sued for their exploitative surveillance because they aren't offering a product that claims to protect you.

I hate to be defending Google on this, but their Incognito Mode repeatedly states that the only thing it does is hide your activity from users on your computer, and explicitly points out that web sites can still see your activity.

We're all familiar with "the large print giveth and the small print taketh away", but when a company uses the fine print to do the exact opposite of what the large print advertises, they are heading towards fraudulent behavior.

The current result only makes sense if you appreciate how the technical details work together, and view Chrome and Analytics as independent entities - like if you're involved in tech. Take a step back and look at the high level combination of the two as one offering - Google offers to make you "incognito" and then actually does the exact opposite behind the scenes.

Don't know why you're being downvoted. Whenever I've successfully explained how Google works as a company, with even the most favorable tilt while still being honest most non,techies see it as you describe.

And like it or not the non jargonated users outnumber the jargon filled by many orders of magnitude, and they don't tend to react favorably when people talk out both sides of their mouth unless there id's something even more dire at stake.

It's the main text of any new window or tab opened in Incognito Mode. 14px to be exact. That's not small print!

Yep, I'm pretty sure for the majority of users it's for watching porn or logging in with a different account to something, rather than any expectation of privacy at the other end

I also use it on the rare occasions where I need to log in on someone else's computer. This way, I know all my logins will be ended when I close the browser.

Haha same. When using the printer in my apartment's "tenant office", I can at least know that a sandboxed incognito window will offer some protection.

Assuming someone hasn't installed a key logger or OS tracker :(

I also wonder what makes Google unique here?

Is it the browser? Firefox has an equivalent mode.

Is it the web app? Virtually every single web app sets cookies even when you are in incognito mode.

> I also wonder what makes Google unique here?

They have tons of money and they are politically popular to hate on. There is no reason not to fine them.

On a certain level fines and other punishments exist because they are politically popular.

They have also a ton of already existing information on you from platforms such as Android and gmail, can track you on multiple levels including your location, and serve you micro targeted ads.

Saying they are politically popular to hate on sounds as if the criticism is not warranted.

Hating on FAANG is a popular political stance these days. Some of it's justified, but a lot of it is also just posturing.

> Saying they are politically popular to hate on sounds as if the criticism is not warranted.

The criticism is definitely warranted, but that is a very shallow take on things.

Privacy issues with incognito mode have been known about for years[1]. But all of a sudden, suing Google (and making a spectacle of it) is a big priority. I think it is pretty likely that the government is trying to make some easy money and publicity points after current events have left them hurting for both.

Maybe the government is full of altruists, doing what is warranted when it is warranted, but I think starting from that assumption is pretty naive.

[1] https://nypost.com/2018/08/22/googles-incognito-mode-isnt-as...

> I also wonder what makes Google unique here?

Maybe because they are the creator of the most popular browser and the creator of a giant network of websites and services aimed at tracking you for their own profit.

> Is it the browser? Firefox has an equivalent mode.

I let you figure out which of the things above Firefox is not

> Is it the web app? Virtually every single web app sets cookies even when you are in incognito mode.

Firefox goes beyond incognito mode, by providing enhanced tracking protection on by default.

https://blog.mozilla.org/blog/2019/09/03/todays-firefox-bloc...

Why would Google be unique in that respect? You're not assuming you can only file a lawsuit against a company if they are the only ones who break the law, do you?

> if Chrome attached a header to all outgoing requests that said incognito=1 or something

The "DNT" header already exists for this purpose, it's just that Chrome does not actually set in when incognito.

> without it knowing that it is incognito somehow

It has been a while since I was in js land but I do recall writing a browser extension that needed to know this, and in chrome it was made available to detect whether your script was running in incognito. It was a property of something.

So I imagine as a starting point the Google Analytics client js could utilize this to avoid interacting with the analytics server altogether.

The ability by websites to detect incognito cause real usability pains for users. (For example, certain news outlets refuse to show content when it detects that you're in incognito.) The mechanisms to detect incognito were/are unintended holes. Both FireFox and Chrome have been plugging them.

Well your information is outdated, because there's been a long game of cat and mouse between chrome and sites likes NYT about detecting incognito, with every alternating version a new method coming up, and it being patched in the following version.

[0] https://boingboing.net/2019/07/20/cookie-managers-r-us.html

Regular js is not able to distinguish incognito mode from some browser API. Extensions get access to a much broader API.

https://en.wikipedia.org/wiki/Do_Not_Track

`DNT=1` would have done the job. Unfortunately, the standard was not widely adopted and subsequently abandoned.

They could spin off Analytics or Chrome into a separate company, so they don't have this inherent conflict of interest.

They could also modify the warning text:

Google won't save the following information locally:

Your browsing history

Cookies and site data

Information entered in forms

Your activity might still be visible to:

Google

Websites you visit

Your employer or school

Your internet service provider

> like if Chrome attached a header to all outgoing requests that said incognito=1 or something

Which, by the way, would be a disaster. There's already enough otherwise-legitimate sites that exploit browser bugs to detect incognito mode and replace all of their content with a paywall.

>What do they want Google to do?

I don't know about "them" but I want Google to stop tracking me and building a secret profile of intimate and politically sensitive information on my person. Full God damn stop. I take as many steps as I can but even not using Google's services is no guarantee of protection and leaving the internet behind completely is not practical if you wish to succeed in modern society.

Adtech is the cancer that is forming the foundation for unprecedented human rights abuses. Look at the state of the country, imagine what either political extreme would do with access to even a fraction of the data that platforms like Google and Facebook collect. A wet dream shared by every dictator in history, from Stalin to Hitler to Mao.

I did not consent.

OK but that isn't what the lawsuit is about.

"It'd be impossible for Google Analytics to not collect data from a incognito tab without it knowing that it is incognito somehow (like if Chrome attached a header to all outgoing requests that said incognito=1 or something)."

Developer Tools allows users to block specific requests, e.g., to google-analytics.com, either by URL or by domain. It is possible (but not implemented by Google) to automatically activate such request blocking when an incognito tab is opened. This is one way to stop GA tracking when in incognito mode.

The quoted warning "Your activity might be visible to:" lists a few third parties, e.g., "websites you visit", "Your employer or school", "Your internet servive provider".

However it does not list Google, LLC or Alphabet, Inc. The complaint is against Google and Alphabet, not the other other third parties.

Here is a copy of the complaint:

https://www.classaction.org/media/brown-et-al-v-google-llc-e...

For those who will not read the complaint:

In addition to GA, the complaint alleges Google tracks users without consent via Google Ad Manager, the "Sign in with Google" button, including Google Approved Pixels, despite incognito mode or privacy settings.

It further alleges tracking without consent via Android, despite igcognito mode or privacy settings, as described in the following paper

Douglas C. Schmidt, Google Data Collection, DIGITAL CONTENT NEXT 1 (Aug. 15, 2018), https://digitalcontentnext.org/blog/2018/08/21/google-data-c...

Finally, it alleges Google conducts tracking without consent, despite incognito mode or privacy settings, via the "X-client-data" header in Chrome (formerly "X-chrome-variations") as described in the article

Thomas Claburn, Is Chrome Really Secretly Stalking You Across Google Sites Using Per-Install ID Numbers? We Reveal the Truth, THE REGISTER (Feb. 5, 2020), https://www.theregister.co.uk/2020/02/05/google_chrome_id_nu...

The complaint argues Google is representing to users that "You are in control" via Google's incognito mode and privacy settings however Google is nonethless tracking users via all of the above methods without user consent. This arguably constitutes misrepresentation.

To recover damages, the wiretapping laws require that there must be some injury. If users' privacy is violated, what pecuniary loss do they suffer? This is usually why these lawsuits always fail.

This complaint uses this source to try to estimate damages

Tim Morey, What s Your Personal Data Worth?, DESIGN MIND (Jan. 18, 2011), https://web.archive.org/web/20140703174004/http://designmind...

Contact info: $4.20/yr

Demographics info: $3.00/yr

Web browsing histories: $52.00/yr

The complaint also cites the "Google Screenwise Trends" program where Google pays users $3/week to be tracked.

The complaint mentions the websites Latome and Killi where users can voluntarily sell their personal data, noting that Google OTOH takes such personal data without asking for permission and without providing compensation.

The complaint also appears to suggest that the user's ability to obtain the maximum value from granting permission to collect and sell her personal data, e.g., via Latome or Killi, is decreased as a result of Google's unauthorised collection and sale of it without the user's consent.

Google could send the incognito flag to only their own websites to honor this setting while also preventing shady third parties from knowing you’re incognito. The point is that Google knows that you don’t want to be tracked, and has full control of both the server and browser, yet tracks you anyway.

It's not clear to me whether you're being sarcastic here. People often complain that Chrome gives Google special treatment. Here on HN, people (incl me) will definitely be outraged if Google does what you're proposing.

Reply on news.ycombinator.com