Hacker News Reader

Comment by asdfasgasdgasdg | Hacker News Reader

This discussion has been done to death here, but I think the most salient point is that the tracking is hardly covert when private mode says, right on the tin:

Your activity might still be visible to: Websites you visit Your employer or school Your internet service provider

I buy that some consumers don't understand the separation between Chrome the browser and Google the website. But if ignorance is allowed to create liability as would be required for this case . . . I don't know what that means for companies offering products that interact mostly at arms length with one another.

Possibly Google will still lose this lawsuit. We'll see. I kinda doubt it.

View on HN

> I buy that some consumers don't understand the separation between Chrome the browser and Google the website. But if ignorance is allowed...

When you "log into Chrome" with a Google account, is it really ignorant to assume that the scope of the settings in Chrome is the same scope as the Google account? I mean it's wrong, but it's wrong because Google is deliberately blurring distinctions and undermining common-sense assumptions.

As discussed 11 months ago (https://news.ycombinator.com/item?id=23552967), yes it is user ignorance.

You've gone incognito

Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. Learn more...

Chrome won't save the following information:

Your browsing history

Cookies and site data

Information entered in forms

Your activity might still be visible to:

Websites you visit

Your employer or school

Your internet service provider

As discussed 11 months ago (https://news.ycombinator.com/item?id=23552967), yes it is user ignorance. As asdfasgasdgasdg says, that's not a pejorative, it's just a fact. Incognito is very clear about what it is doing:

You've gone incognito

Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. Learn more...

Chrome won't save the following information:

Your browsing history

Cookies and site data

Information entered in forms

Your activity might still be visible to:

Websites you visit

Your employer or school

Your internet service provider

The subject matter here isn't "Websites you visit" in general, it's specifically Google, and whether the settings in Chrome (where users authenticate using Google accounts) should apply across their services.

Feel free to read the complaint, page 22 (Plaintiff-specific factual allegations). This is about Incognito not preventing websites from tracking you.

https://storage.courtlistener.com/recap/gov.uscourts.cand.36...

Worth noting that the lawsuit is also specifically about how Google uses x-client-data. Google claims it doesn't use this header to track users. It seems like the factuality of this claim will be easily determined during discovery. If Google doesn't use x-client-data to track users, the lawsuit as currently formulated is going nowhere.

Paragraphs 77, 78, 81, 82, and 83 specify Google tracking.

> Incognito is very clear about what it is doing

I don't think so. That label was very intentionally chosen to give off a first impression different from reality, to make it more likely the user intuitively makes incorrect assumptions.

You can call it ignorance, I call it a comprehensive dark pattern. Google aimed to give users the wrong impression. And your cited list is neat but many users have no idea Google, Facebook etc. track users across different websites, and for those it's absolutely not clear what actually happens.

'Incognito' implies anonymity. The clear suggestion is that people who already know who you are (your ISP, or your employer/school who is equivalently knowledgeable) can see your browsing, but that websites will see you as an anonymous person unless you choose to identify yourself to them.

There's a reason Google don't mention their own collection/inferential behavior here; people might abandon Chrome is it said 'BTW if we can work out who you are at the server end we'll still be tracking that.'

It may boil down to determinations of what 'a reasonable person' believes, that is someone who is amenable to reasoned argument, and of ordinary knowledge. I think a lot of people here are projecting their technical knowledge into this page and saying 'if you don't consider all these background factors then that's your problem.' It seems like to me that a court will lean towards taking the above at face value absent specific knowledge to the contrary, eg choosing to log into an online service vs not.

A simple example would be doing some Super Secret Stuff in one incognito window and opening up another tab where you go to Youtube (also incognito), don't log in, but play your three favorite and quite unusual songs for background music. Is it OK for Youtube to silently infer that it's you based on that highly individual selection and allow Google to track your Super Secret activity with 99.9% confidence?

If you believe an incorrect thing, you are both wrong in your belief and ignorant of the correct belief. It's not a pejorative to say a user has ignorance of a particular fact. It's just a statement about the condition of the user's understanding of reality. (You can also call someone ignorant as an insult, but that's usually not in the context of particular facts. "You are ignorant," is an insult. "That person is ignorant of the situation," is not an insult.)

I understand that the Chrome UI has blurred the line between “logging into Chrome” and “logging into Google”. But if you log into Chrome and then open an Incognito window, are you still logged into your Google account for Google sites loaded in the Incognito window?

> But if you log into Chrome and then open an Incognito window, are you still logged into your Google account for Google sites loaded in the Incognito window?

No, you are not.

> some consumers don't understand the separation between Chrome the browser and Google the website

Well... I'd say that Google isn't doing too much to put separation in between. When I write in "google" in Chrome, those suggestions that come up... Are they from Chrome or from Google the website?

They're from Google the website. You can change the default search provider, which changes those autosuggestions.

> But if ignorance is allowed to create liability as would be required for this case . . . I don't know what that means for companies offering products that interact mostly at arms length with one another.

There are two separate but related things to consider here. First, for legal purposes, is there actually a difference between the two entities involved? The easiest way to do this is to actually have two different corporations, but it's possible there are ways to effect this without separate incorporation. If that's true, then the second question to ask is whether or not one entity is an "alter-ego" of the other. When that is true, then legally one becomes tied to the actions of the other (e.g., recovering money during bankruptcies, liability in defamation suits, etc.).

I don't know what Google's situation is, but the fact that there is consumer confusion makes me think that the claim of alter-ego would survive summary judgement and progress to discovery to determine if it's true or not. If you want to avoid this situation, your best bet is to ensure that you have really good firewalls between the arm's-length products, including separate legal incorporation, and you don't try to blend the products together (at which point they're not really arm's-length, are they?).

Google gathers data through Google Analytics and Google Ad Manager. Those are not websites you visit, nor are they the user’s employer, school, or Internet Service Provider. Moreover, it is not the case that the user’s web behavior “might” be visible to these services. They are.

Google lied by omission. They could have easily put “right there on the tin” that they were using these products to track users, but they didn’t. That was deliberate.

This sleight of hand is par for the course for Google, et al. “We don’t sell your private information” is the answer to the concern about private tracking, obfuscating the real concern of targeted behavioral advertising behind an altogether different one.

They know what they’re doing. Letting them get away from it would be like letting cigarette companies put a label on their product that says “this product has not been proven to cause Alzheimer’s.”

> obfuscating the real concern of targeted behavioral advertising behind an altogether different one.

I don't think this is accurate. I think for a lot of people the privacy issue really is about concern that their behavioral information would be sold and disseminated, and that it is a genuine attempt to address these concerned that Google and other sites are responding to when they say they don't sell private information. Certainly the laws that politicians are crafting (e.g. GDPR and the California privacy law) center the privacy interpretation of people's concerns. If most people were more concerned about behavioral tracking and targeting, I believe that politicians would be passing laws to ban that instead.

I agree that for many commenters on this site, the concern has morphed into a concern about behavioral tracking, but my recollection is that this has not always been the case. I don't think Google intends to address that concern with its statements about not selling private information. But, to address the behavioral tracking concern, Google does have a setting that disables ad personalization: https://adssettings.google.com/.

> I think for a lot of people the privacy issue really is about concern that their behavioral information would be sold and disseminated.

People are only concerned about the things they can easily conceptualize. Google certainly hasn’t done anything to make it easier to understand behavioral ad targeting, probably because they didn’t want to be in this business to start with (they only moved into it during the dot com crash when they were pressured to get a business model together) and because they maintain relationships with intelligence agencies, allowing those groups to collect information they wouldn’t be able to get legally.

On several levels, Google benefits directly from hiding their real business model from the users whose behavioral information surplus they exploit.

Just because people have been slow to catch on doesn’t mean their Incognito disclosure isn’t inaccurate and downright misleading. Google doesn’t get points for hiding opt-out behind the labyrinthine settings toggles. Until the entire data collection process is opt-in, they’re exploiting user ignorance.

> People are only concerned about the things they can easily conceptualize.

My take is that people aren't concerned with things that don't pose significant risk to them.

> and because they maintain relationships with intelligence agencies, allowing those groups to collect information they wouldn’t be able to get legally.

This is not true, and you will not be able to cite evidence that it is.

> Google doesn’t get points for hiding opt-out behind the labyrinthine settings toggles

The first search result for [google disable ad targeting] is a support page linking directly to that toggle. "Labyrinthine" is not the word I would use to describe this state of affairs.

>This is not true, and you will not be able to cite evidence that it is.

https://www.salon.com/2014/11/16/googles_secret_nsa_alliance...

https://surveillancevalley.com (review: https://www.theguardian.com/books/2019/jan/06/surveillance-v...)

>The first search result for [google disable ad targeting] is a support page linking directly to that toggle. "Labyrinthine" is not the word I would use to describe this state of affairs.

Interesting, because the first result I get when I search those exact terms is a support article about how to make sure ad targeting is turned on:

https://support.google.com/ads/answer/2662856?co=GENIE.Platf...

"Control the ads you see You can make the ads you see more useful or get ads that are specific to you. You'll see Google ads on:

Google services, like Search or YouTube. Websites and apps that partner with Google to show ads."

The review you cited of Surveillance Valley says that the book is overwrought and the evidence does not support its conclusions. The other article was long on implication but short on evidence.

On that support page, scroll down. https://imgur.com/zKvpRyl This part of the page is also highlighted in the quick answer: https://imgur.com/5WT23Ki

Note that the author of the review criticizes Levine's characterizations, not the facts contained. The same information can be found in The Age of Surveillance Capitalism. Or in this NBC News article: https://www.nbcnews.com/tech/tech-news/thousands-contracts-h.... Here's the data on techinquiry: https://techinquiry.org/SiliconValley-Military/

I found myself nodding along with your comment, having worked in a massive company myself.

A company the size of Google is simply not a single entity, so it isn’t surprising for one division to make a “private mode” that another division doesn’t respect.

But isn’t that an awfully big loophole for the corporate leadership? “Well, we’re doing so many things that our left hand can’t possibly know what the right hand is doing.” When really, the teams themselves know exactly what the score is, even if they didn’t hear it from the CEO. It’s plausible deniability by being too big to understand.

And it isn’t unreasonable for a consumer to believe that when “Google” offers them a private mode that Google products might become more private in some way.

> make a “private mode” that another division doesn’t respect.

It is not a "private mode," it is a "don't save browser history to my local machine, and that's it." It clearly says that when one opens it.

Incognito mode does not indicate to websites that the client is supposed to "not be tracked" or whatever these plaintiffs want. That would in fact allow for even more tracking and user-hostile ("please visit this website not in incognito mode") behavior.

It is that, but it's not called that. It's called incognito mode. "With one's identity disguised or concealed". With the icon of a spy in trenchcoat and hat and shades. Going out into the world incognito does not imply "everyone knows who I am as usual, I just don't keep a diary entry of where I go", it implies some attempt to disguise and hide and obscure.

FireFox's "Private Browsing" mode is similarly misnamed. "Private" does not imply: everyone knows what I'm doing, except my personal diary log has no record of it. Private implies other people don't know.

Would it not be a bit daft for Ford to release a "silent car" when all it means is a loud V8 engine but they give you a pair of earplugs so that you can't hear it?

To me, incognito means, "I'm out in the world, and possibly identifiable, but I am not broadcasting as much information about myself as I typically would." For example, I'm not sending my typical logged in cookies. That's exactly what I expect incognito mode to do and, I believe, exactly what it does.

If I'm out in the world incognito, that doesn't mean I can't possibly be identified. A close look at my face might still let someone figure out who I am, despite my Dick Tracy hat. It just means I'm putting in some effort not to allow my identity to be known.

This seems like a great metaphor for what incognito mode does.

Reply on news.ycombinator.com