Google is tracking you even in incognito mode, new disclaimer is up | Hacker News Reader

Google is tracking you even in incognito mode, new disclaimer is up

news.abplive.com

220 pointsBrajeshwar167 comments

I really do not like Google as a company, but this is one of those cases where I agree with them. It was always clear that websites could track you in incognito mode. Somehow people thinking that Google is not a website that can do that does not make it Google's fault. You still have to accept Google's cookie banner when opening the site in incognito, giving another indication they track you.

My understanding is that Google is tracking you across your browser sessions, even when you switch to incognito.

That’s problematic because Google (and others with such broad internet scope) tracks you regardless of whether you are interacting with Google services or not.

I don't believe this is true. In incognito mode you don't have the same gaia or dblck cookie ids. Your traffic is logged in icognito mode by Google but as a different user under a different identifier.

Now certain websites could use tracking methodologies based on ip address and device signatures to identify you as the same user and set a cookie identifying you as the same user for purposes like remarketing, but Google itself doesn't join this data from their own logs.

This announcement is just clarifying that Google does log data in icognito mode as do other websites. It doesn't say that Google joins your icognito session data with your non-icognito session data.

> don't have the same gaia or dblck cookie ids

Google is incentivized to do “privacy theatre” and make sure your incognito session doesn’t show up as related to you even if the back-end systems have a clear association.

I don’t know the facts of Google’s systems either way, but I do know that absence of a visible join is not conclusive evidence that there is none.

I do know facts about there internal system. Internally, strict separation is taken very seriously and the logs are keyed by cookies with separate access and physical logs for different cookie spaces and no joining is done based on ip addresses and device signatures in these logs.

It would take a determined and malicious employee to subvert these controls and possibly require multiple employees to get by code reviews to do such.

That said, I can appreciate the skepticism an outsider might have about such claims.

But, I also disagree that Google is incentivized to do "privacy theater" as you call it. For one, many already assume the worst of Google and also such theater could open them up to major lawsuits.

One could make the case that a company like Apple has invested a lot more effort in "privacy theater".

Their probabilistic systems appear to use the ip address for anonymous targeting. For example, when you watch YouTube videos using normal browsing mode on one device, it is quite obvious that they influence the Google Ads on other devices in the same household.

That doesn't mean cookies or logs are joined, and the targeting is always anonymous, so it is less precise than when using the cookie ids.

Fear Uncertainty and Doubt springs eternal. People are desperate to believe in inherent badness and abuse.

Here are the facts https://support.google.com/chrome/answer/7440301 Yes they still record your activity under some faceless uuid when you browse incognito. No they don't tie it with your gmail unless you login to gmail. Yes, it doesn't matter, since lawyers and government can access everything Google has, and put the pieces together. Policy will likely change in the future to make your full history of both gmail and anonymous browsing activity freely available to the public too.

> Policy will likely change in the future to make your full history of both gmail and anonymous browsing activity freely available to the public too.

Eh? There is no chance of this. What leads you to this conclusion?

Of course it's going to happen. Read The New Digital Age by Eric Schmidt. He talks a lot about how all the information Google records about you is permanent, can never be deleted, and any generation of lawmakers can decide to do whatever they want with it. Upcoming generations are going to want as much data as possible to train AIs, especially as the GPUs needed to do that become more affordable. You know how historians are always talking about what famous dead people wrote in their diaries and personal letters? Don't think for a moment that future generations won't do this to you.

That is quite the slippery slope you paint there. There would need to be several steps before we even come close to getting there.

Is it possible? Sure. A lot of things are possible. Is it inevitable? Far from it.

If people in a hundred years want to read all my emails, I can assure them in advance that I won't raise any contemporaneous objections.

But that isn't quite the narrow framing you used.

Yup. Absence of evidence is not evidence of absence.

Lol?

Google receives a ton of requests from IP 30.40.50.60 with cookies associated with fromMars@gmail.com.

Suddenly, there are a bunch of requests from:

- the same IP

- the same browser

- the same resolution

- the same OS

- the same WebSocket IP

- the same DNS servers used for resolving

- the same Adobe Fla^W^W well, not that, but I wouldn't be surprised what if you have still have it for whatever reason - it would be noted too

the same fingerprinting bits used by the most pervasive tracking company in the world

The most pervasive Internet tracking company in world: hmm, that's totes not fromMars@gmail.com!

Your understanding is wrong. This is just an updated disclaimer that clarifies how it has always worked. Website owners have always had tricks to track you across sessions but Google is not granting itself any special privileges making this easier.

> My understanding is that Google is tracking you across your browser sessions, even when you switch to incognito.

Source? Also, can you clarify what exactly is mean by "tracking"? I would expect them to "track" me via anonymous cookies, but wouldn't expect them to tie my browsing history to my chrome login.

Yeah just watch your network traffic, browser open, no tabs open on google, amazon, facebook, no search bars set to google... tons of traffic to all 3.

Also, different icognito sessions will be logged as different users since all the cookies are deleted when you close all your incognito browsers.

So the TLDR, is that yes data is being logged for an incognito session by Google, but that data isn't tied together by Google across icognito sessions or icognito and non-icognito sessions.

Are you relatively tech savvy though? This was also obvious to me but I develop web apps for a living. It may likely not have been very obvious to others.

Tech unsavvy users probably don't know what that tracking thing is, that's if they are aware of its existance. In fact, even people who are familiar with computers often get it wrong.

Incognito mode always had a rather clear explanation of what it is about. It is somewhat complicated to those who are completely new to it, so I guess it can be misinterpreted, but I see nothing misleading in the explanation. Also, Chrome is not the only browser with that kind of feature and they are all essentially work and are presented the same way.

That some browsers tie it to some kind of tracker blocker actually make things even more confusing because on one hand you have "private/incognito/whatever" tell you that websites can still track you (because it is not what it is designed to do), and then, just below, you have a tracker blocker. So what is really blocked?

> It was always clear that websites could track you in incognito mode.

Why call it incognito mode, if not to imply you couldn't be tracked? It's absolutely not unreasonable for the average Chrome user to draw this conclusion.

Um isn't it completely obvious that this is about local history?

Let's say that you are using the internet to "buy your wife some jewellery". You want to be sure that she won't see your search history for "jewellery" or visiting "jewellery" websites.

It is perfect for that. Anyone who thought this somehow made them anonymous on the internet is probably the sort of person who thinks that wearing dark glasses or growing a beard is going to let them hide from the police too.

I don't think the average user understands that but for us more tech driven folks we've known this for ages and probably take it further with VPNs and not using Chrome at all for any serious privacy searching where we want to avoid cookies saving, advertiser fingerprinting, DNS and ISP tracking, etc.

If you can sign in accross sites in incognito, there's clearly some tracking going on.

I reckon that the average Incognito user is not even aware of "tracking" in the cookie/advertising way, and it's not why they use the mode. It's merely to not leave traces of their browsing history on their computer, which they may share with others.

To tech-savvy users it was always clear that sites would still be able to track you, whether or not you clear your local history and cookies. Cookies are just one, quite outdated at this point, way of tracking.

Because it made it harder for your family to track what you were doing with the browser on the one desktop computer the whole family shared.

Then usage patterns drifted but the term didn't change.

It’s still unclear whether google is trying to associate the activity in incognito mode with the activity in the logged in account, this ambiguity makes me distrust them as a company

I think the only reasonable thing to do in the face of this ambiguity is to assume the worst. Google have lawyers smart enough to write clear explanations of functionality if that would be to their benefit.

The vast majority of users would have taken Google’s incognito mode at their word.

The kinds of geeks that use HN wouldn’t have been so naive.

It’s really quite a shocking lie they were selling to the uninformed, it morally reeks, even for Google’s standards.

When/where has it been marketed as anything but a "hide history from local users" feature?

All I've seen is the marketing for "buying gifts for your spouse in secret"-feature.

You are saying they have marketed it as a total privacy feature, like the VPN companies do?

I think wording like "browse the web privately", the disguise icon, and the name of "incognito" can very easily suggest that the purpose is hiding your identity from websites.

Reminds me of Tesla full self driving. It’s not really fully autonomous but we will call it that anyway.

I’d go further - people would think it meant that not even Google would be recording their browsing.

Even the “buying gifts for your spouse in secret” case is thwarted, you may end up seeing retargeting ads or YT suggestions for the products you were looking at, in your main account.

What techies really don't seem to get is that this has nothing to do with whether Google can track you in incognito mode due to the technical details, along with every other website. Rather the problem is that Google (the company) is offering a product that is marketed based on protecting your privacy, but then Google (the same company) is continuing to track you despite use of that product! Firefox "private window" suffers from similar technical vulnerabilities (cf the additional lengths Tor Browser goes). But failing to be perfect and/or perfectly inform their users of the vulnerabilities doesn't create the same type of liability for Firefox, because there isn't another division of Firefox actively working to track users despite their use of private window!

I've never seen a cookie banner from Google in incognito, do they only do that for the EU?

I'm from Germany and see it every time in incognito

A definition of the word "Incognito" is to: avoiding being recognized, by changing your name or appearance. So, the name of the mode itself implies you are not being tracked. Yes, those who understand technology recognize this, however those who are not in the know would likely assume it means something different than what it actually is. This is at minimum disingenuous, and at maximum fraudulent.

No. Your second sentence is not in the slightest implied by your first. Try again.

"It was always clear that websites [including Google] could track you in Incognito mode."

These users thought differently.

https://ia801705.us.archive.org/7/items/gov.uscourts.cand.36...

Google was being sued over this surreptitious data collection while in so-called "Incognito Mode". When it tried to have the case dismissed, it failed. (Judge Koh) Then it moved for summary judgment. That failed, too. (Judge Gonzalez-Rogers, who some may recognise form the Epic v Apple case). So just as we were getting ready to let a jury decide whether Google is at fault, Google pays off the plaintiffs' counsel. Why are these so-called "tech" companies willing pay anyone and everyone to prevent precedent from being created. Surely the precedent would work to protect them in the future, right? These meritless lawsuits over privacy would be nipped in the bud.

But Google will almost invariably stop these cases from going to trial by paying out settlements. Will we ever see Google go to trial for alleged wiretapping. No. But that's not because the cases get dismissed or because Google wins on summary judgment. Quite the opposite.

There were seven counts in this case. Google's request for summary judgment was denied on every single one. Even the usual defence of no injury-in-fact, e.g., no user lost money as a result of the surveillance, failed. "Tech" workers want to keep on pretending that every other person using a computer is an easily manipulated, ignorant fool. Good luck.

https://ia601705.us.archive.org/7/items/gov.uscourts.cand.36...

Here is what the court said about consent.

"The analysis starts with the Privacy Policy17 wherein Google advises at the outset and in bold, larger print:

When you use our services, youre trusting us with your information. We understand this is a big responsibility and work hard to protect your information and put you in control. (12/15/22 Google Privacy Policy.)

Immediately after, Google advises:

This Privacy Policy is meant to help you understand what information we collect, why we collect it, and how you can update manage, export, and delete your information.

...

We build a range of services that help millions of people daily to explore and interact with the world in new ways. Our services include:

Google apps, sites, and devices, like Search, YouTube, and Google Home Platforms like the Chrome browser and Android operating system Products that are integrated into third-party apps and sites, like ads and embedded Google Maps (Id.)

Notably, Incognito mode is not mentioned in this list of services. (Id.) Rather, Google shifts and in the next paragraph advises users: You can use our services in a variety of ways to manage your privacy. . . You can also choose to browse the web in a private mode, like Chrome Incognito mode. And across our services, you can adjust your privacy settings to control what we collect and how your information is used.18 (Id.) That is the only mention made of the privacy mode. The Privacy Policy is silent as to any data collection specific to private browsing mode. The Court rejects Googles argument that the Privacy Policy unambiguously discloses the at-issue data collection. The silence noted above combined with Googles surrounding statements regarding what it means to browse privately, means that a material dispute of fact remains regarding the scope of users consent. For instance, the way Google presents Incognito mode could be read to contradict its suggested interpretation of the Privacy Policy. When users first open Chrome, they are greeted by a bright, white screen and the colorful Google logo. When users navigate to Incognito mode, the screen goes from white to black, all text is rendered in gray, and users are met with a spy guy icon. (PAF 9.) They are told they have now gone Incognito, which, Google explains on the next line, means that they can browse privately, and other people who use this device wont see your activity. (PAF 30.) Plaintiffs have evidence to show that, internally, Google understood that the framing of the feature as Incognito (or, for other browsers, Private) made users overestimate privacy mode protections, including that Incognito hides browsing activity from Google. (Dkt. No. 924-36, Ex. 80; Dkt. No. 924-48, Ex. 44.)

Googles arguments otherwise do not change the result. Its reliance on this Courts finding in Calhoun is misplaced. That case did not involve Incognito mode. See Calhoun, 2022 WL 18107184, at *10. The reasoning therefore does not extend here. Next, Google argues that to obtain consent effectively, companies should not have to enumerate every mode, setting, or circumstance impactingor not impactingthat data collection. See Smith v. Facebook, Inc., 745 Fed. Appx 8, 9 (9th Cir. Dec. 6, 2018) (holding that Facebooks tracking of publicly available health data fell within the scope of users general consent to its data tracking and collection practices). It is true that such enumeration is not always necessary. The fundamental issue, however, returns to actual consent. Google chose both to use a general disclosure and yet promote the privacy afforded by Incognito over regular mode. Having made that distinction, Google itself created a situation where there is a dispute as to whether users consent of Googles data collection generally is substantially the same as their consent to the collection of their private browsing data in particular. See Restatement (Second) of Torts 892A (1979) 2(b), 4.

For those reasons, the Court DENIES Googles motion for summary judgment on the grounds of express consent."

I feel like commenters in this thread are talking past each other.

Some are saying "of course sites are still tracking you in incognito!", but is is unclear to me what they mean by this. I see the following interpretations:

1. Sites can still use local storage so they can track you for the duration of your incognito session, but they cannot connect this tracking to your regular session or other incognito sessions as incognito sessions start with empty local storage and discard it at the end of the session.

2. Sites do not rely on local storage, instead using fingerprinting via a combination of IP, HTTP headers, information they can query via JS, etc., so incognito has no effect on sites' ability to track you.

3. Google has special privileges in Chrome to track you when you are incognito.

> I feel like commenters in this thread are talking past each other.

Agree.

The point for me is that Google could track you anyway which is beyond the scope of their message to the (average) user.

I thought it was well understood that "private" mode in browsers relates to what your local machine records about where you visit.

I didn't even think that a web site could know you were in that mode, let alone honour it.

Incognito mode is supposed to not send your regular cookies so sites shouldn't be able to track you unless they use dubious stealthy tricks rather than the explicit well-known and documented method (i.e. a cookie). While I know that it's possible, I think it's morally despicable and I expect better from established (and ostensibly honorable) companies like Google.

The fact that they now basically say "cookies or not, we're gonna track you anyway" sounds to me like another step in the downfall of Google.

> Incognito mode is supposed to not send your regular cookies so sites shouldn't be able to track you unless they use dubious stealthy tricks rather than the explicit well-known and documented method (i.e. a cookie). While I know that it's possible, I think it's morally despicable and I expect better from established (and ostensibly honorable) companies like Google.

Yeah, that's what it does. Instead you get a new set of tracking cookies, because to Google and any other random website you look like a new browser they haven't seen before. By design, they have no idea that you're using "incognito mode".

With that in mind, what do you think Google and others should do differently?

> With that in mind, what do you think Google and others should do differently?

I think the parent is suggesting that they reassociate the incognito tracking cookies with the users' other data from their logged in session by using other fingerprinting techniques.

I don't know whether Google actually does this. Clearly they are capable of doing so, and anybody who cares about privacy should assume it happens, but it's not obvious to me that this kind of data association would be worth it for advertisers.

In the actual case that got this change in messaging put in, the guy signed in to his Google account from incognito & is mad that Google kept the data from his incognito session.

There's nothing in the court case Google is responding to about them using other tracking systems. People seem to want to believe very much there's lots of backchannel tracking & special privilege & self dealing going on at Google. But theres no evidence, there's people vehemently swearing Google does have strong internal information firewalling to prevent this abuse, and it's not what this court case is about.

The court case is about users expecting incognito to be a magic cloaking shield where anything you do on the web in incognito magically doesn't stuck around after the fact.

> to Google and any other random website you look like a new browser they haven't seen before

Unless Google Chrome is still associating your incognito activity to your main account, and who knows which of their products feed off your browsing history…

Your browser is doing that to the extent that it carries over information about downloads and bookmarks. That's not the same as Google associating those with the cookies used to track your Google account.

I've yet to see anything so much as suggesting that Google is using that kind of Chrome user local data to track people. Did I miss that?

> Google is still associating your incognito activity to your main account

Er, no…

Google should 1) Set the Do Not Track header in incognito mode. 2) Respect it.

Bonus 3) Lobby congress to make it illegal to disrespect the DNT header.

On odd-numbered days, the EU tries to ban encryption. On even-numbered days, they do good things for privacy - like ruling that LinkedIn must respect the DNT header.

Do Not Track is a suggestion at best. In the best of all possible worlds where Google does exactly as you suggest in forcing it on and respecting it, every other server out there is perfectly capable of ignoring a polite suggestion.

Your other idea is interesting. Google should lobby for regulations that would hurt their competitors far more than them. You wouldn't regard this as a big company engaging in regulatory capture?

> Do Not Track is a suggestion at best

No, it’s an explicit instruction. It’s treated as a suggestion, at best. It’s not “It’d be real nice if you didn’t track”, it’s “Do not track.”

There’s nothing ambiguous about it.

The defence of Google is “well everyone else is doing it”, which isn’t a particularly strong defence, for Google, nor all the other shady businesses engaging in this practice.

What's the practical difference between an unenforceable and unobservable explicit instruction and a polite suggestion?

My point is not that Google is good or bad or that all the other kids are doing it. My point is that DNT is at current fundamentally incapable of delivering what we're asking it to do.

> unobservable explicit instruction

It’s absolutely observable between the two parties that are engaged in the conversation, as it’s part of the HTTP header:

DNT: 1

The effects are, if any, are not observable.

Let's go with a change of phrase, then. What's the practical difference between suggestion and a clear and explicit instruction that is unenforceable and where the user offering the instruction cannot tell if it is being executed faithfully?

So you object that clients requesting not to be tracked isn't something servers are required to respect, but also object to the idea of servers facing legal penalties for not respecting it.

It sounds like you've already decided that the tracking free-for-all status quo is the best we can do.

If I go to maps.google.com in incognito mode, it opens directly on my hometown, presumably from my IP address.

Google can use _at least_ the combination of this and my browser UA to track me should they so desire. (There may be other persistent cookie-like things, who knows.)

This new prompt is them admitting that they do. I would rather that they chose not to.

Disclaimer: Google employee who doesn't work on this.

My understanding is that incognito mode is a temporary and blank profile that is cleared when you exit. If it actually prohibited cookies a large number of websites wouldn't work as session information is used in all kinds of contexts (not just advertising). AFAIK there's no special treatment for incognito as the site owner shouldn't be able to tell an incognito user from a new never-seen-before user. Each time you exit and relaunch incognito you will get the same behavior as a new user.

There have been tricks over the years for website owners to try and deduce the browser is incognito (e.g. testing available scratch space in the JS file API). In general this is a cat and mouse game where gaps are closed and new fingerprinting methods are developed.

In terms of location tracking, websites are still getting your IP address which can be geo mapped. If they want the location from your browser, you should be getting prompted to allow/block.

According to the article the new text is:

"Others who use this device won’t see your activity, so you can browse more privately. This won’t change how data is collected by websites you visit and the services they use, including Google."

It's pretty clear that the text is not "admitting" what you claim it is, you've just made that all up.

“Downfall” seems a bit dubious of a term here, Google is doing just fine…

Google is far from doing just fine.

Rome wasn't built in a day, and neither was it destroyed by a single incident or individual.

The downfall of empires gradually happens over years... decades...

But make no mistake: the sign of the first derivative is negative.

Sorry but this seems like wishcasting to me; Alphabet’s stock is up 46% yoy, beating the market by 30%+. I think it’s at an all-time high, even.

Any day now though, right?

The first derivative of what exactly? Certainly not their stock price. And not their quarterly revenue either, nor even YoY growth.

> I thought it was well understood that "private" mode in browsers relates to what your local machine records about where you visit.

I bet 99% of the people who use Chrome don't even really understand what a browser is or the difference between remote and local.

> I didn't even think that a web site could know you were in that mode, let alone honour it.

Well, except if you're Google and you own both the website the user visits and the browser used for the visit.

> I didn't even think that a web site could know you were in that mode,

wanna bet?

https://fingerprint.com/blog/incognito-mode-detection/

Many people stayed in the old mental model where a site not getting your cookies meant it probably couldn't identify you (other meta data like IP, user agent etc. where usually less unique and/or exploitable)

They never revisited that assumption and might have passed it down to newer users as well.

>other meta data like IP, user agent etc. where usually less unique and/or exploitable) They never revisited that assumption

They never revisited that assumption because they never had any beliefs at all regarding user agents. You're significantly overestimating how much the general public knows about this topic.

It should have been called “porn mode”, to prevent any confusion among the less tech-savvy.

It was informally called that from the very beginning; see e.g. https://www.theregister.com/2008/11/05/firefox_market_share_...

(I think the usual term among the people developing the feature was actually "pr0n mode", but I may be wrong and/or misremembering. For the avoidance of doubt, I was not one of those people, I'm just describing what I think I remember seeing on the interwebs at the time.)

I bet a lot of people do look at it like that and believe it provides some VPN like protections as well.

This is the fundamental disconnect in understanding of the feature.

Those who don't know how the internet works could be easily confused by the term.

Those who know anything about the internet's workings wouldn't even think to ask if the feature cloaked your online activity from sites you were visiting, because that's not even a thing a client can do.

How representative do you think your knowledge is of the web browsing public?

Oh I'm a lot better informed about technology than most, no doubt.

I was surprised that Google settled a $5 billion lawsuit accusing it of illegally tracking users while in that mode.

The only thing I can think of is that they might have misled users about the degree of privacy they could expect in that mode. Like, if they said "you won't be tracked" and then they did.

Still, the technology of private mode browsing is not unique to Google and it all does the same thing: not record locally what you do.

Just imagine a trial where Google is trying to explain to a jury of less-than-tech-literate-folk that they claim they don’t track you, and they don’t track you, but they do track you.

You mean like when they asked mark zuckerberg how they make money?

I thought there was already a message along those lines when opening a new private window

Incognito was never about [avoiding] tracking. Its goal was to have an ephemeral session which is discarded at the end, no local history saved. Trackers work the same as usual.

What happened was that people mistook it for being a “private” form of browsing with no tracking and Google never corrected them.

No wonder people misunderstand when browsers call it "Incognito mode" or "private window", which implies there's some kind of anonymity and privacy.

Perhaps it could be renamed to "temporary window" or "ephemeral mode" to communicate its purpose better.

I know a ton of people who have no idea what ephemeral means along with a large overlap with those who don't know what incognito does, so temporary mode would be much better.

> What happened was that people mistook it for being a “private” form of browsing with no tracking and Google never corrected them

Every time you open an incognito window in Chrome there's an explanation of what can and can't track you. It's been there for years.

You make it sounds like users were just making assumptions based on nothing.

Google meanwhile tells users “Now you can browse privately, and other people who use this device won’t see your activity. However, downloads, bookmarks and reading list items will be saved.”

This creates an expectation, and expectation that might differ from person to person based on what they consider “privately” but an expectation nonetheless.

Silence is consent.

Edit: meaning, Google’s silent lack of correction shows (to me) that they consented to that interpretation.

Open an incognito tab and read what it says.

Incognito mode is not for preventing anyone from remotely tracking you, it is for preventing someone that is using the same computer from looking at your history (at least that's how I understand it).

Of course it has other purposes like letting you read articles where they apply limits, temporarily logging out, etc...

Just use the Tor browser if you want to be in "incognito" mode (it brings a bunch of other problems though, like cloudflare)

The new language is still unclear. Sure, technical users were aware that Incognito mode doesn't stop websites from "collecting data". What's unclear is if this data is then used to associate the activity in Incognito mode with the logged in profile outside of Incognito.

We can safely assume that this is the case, but Google would likely never admit it unless prodded by the government. And governments are barely now realizing what cookies are.

Google is pushing their "privacy-friendly" narrative with their FLoC initiative and intentions to kill cookies. The reality is that they haven't had a need for cookies to track users for many years. FLoC is a red herring so that they can signal to regulators and users that they're a privacy-conscious company, while behind closed doors it's business as usual. And business is booming.

Close your Google account. De-Google your phone. Use ungoogled-chromium or Mullvad Browser. Urge others to do the same. And for the HN crowd: stop working for companies that exploit humanity.

Disclaimer: Googler but I don't work on this and have no special knowledge. Opinions are my own.

I don't believe Google itself is intentionally associating incognito profile data with non-incognito profile data. That does not prevent other websites from creating a simple map of (IP, user agent) -> Profile.

I'm not sure how this could even be imagined to work otherwise, with a default VPN? Even then there are other browser fingerprinting techniques (e.g. window size) that can't really be stopped short of breaking browsing experience across many sites. Do any of the major web browsers do differently?

> I don't believe Google itself is intentionally associating incognito profile data with non-incognito profile data.

Why not? Google makes more money on targeted ads. It's in their best interest to use an established user profile to show targeted ads in Incognito mode, and to augment that profile with data collected in Incognito mode, so that they can improve their overall targeting. It would be naive to think they're not doing this, especially when there's no clear public knowledge about what data is collected and how the targeting works. They're using cookies as a scapegoat because they don't actually need them for tracking at all.

> That does not prevent other websites from creating a simple map of (IP, user agent) -> Profile.

Individual websites rely on adtech to deliver ads, and often for analytics as well, no? Why would they implement the tracking themselves, when adtech does a much better job at it? Even if Google doesn't offer it explicitly as a feature, it would be trivial to match the analytics data to a user profile.

> I'm not sure how this could even be imagined to work otherwise

You mean, how it can be prevented? It's difficult since we don't know how sophisticated the tracking actually is. Using a VPN, random resolution and window size, disabling JS and browser features, etc., _probably_ helps. Some privacy-focused browsers like Mullvad and LibreWolf do some of this. I don't fool myself into thinking any of this is a silver bullet, and at some point, I have to prioritize my experience over privacy.

But Google pioneered(?) "zero trust" access to their infrastructure for their employees with BeyondCorp, so they know a thing or two about securely identifying individual users regardless of the device they're using. I would think they're using behavior and network tracking in addition to just browser fingerprinting, but you would know more about this than me.

In any case, this is a futile fight for privacy-minded individuals, and nothing will actually change until governments don't make it change. Considering they only caught up with cookies a few years ago, it's going to take many more years for them to catch up to the state of the art innerworkings of adtech. Assuming there are politicians who understand these technical aspects and haven't been bought yet, and users actually start caring about this. I'm not holding my breath.

Well, look at the other side: Incognito was born because Google does not allow you to turn off browser history in Chrome whatsoever.

> And governments are barely now realizing what cookies are.

This is why policy should be written in terms of the effects, not the methods employed.

Really? Since day one the message was absolutely clear, and it was obvious that incognito only deletes local history and cookies.

Ask your parents if the message was absolutely clear.

We're nerds, of course it was clear to us.

They usually ask when they don't know. Also, they take responsibility of the errors they make because their lack of skill (or skipping the instructions).

This is similar to suing Samsung because their microwave doesn't say that you must add water when cooking rice. People should be aware and responsible of their own ignorance and limitations.

> People should be aware and responsible of their own ignorance and limitations.

To a point. You take it for granted that certain things are 'safe' - like food and drink. Most users think that google is the internet and that gmail is email.

Those users were sold out by us techies drinking the google koolaid (google analytics, chrome, assorted goodies, etc). I don't think that they would have cared anyway. It's not been that long that the consensus has swung around to google being a pile of canine feces.

And yet chrome is still #1, these guys are smarter than all of us.

People can only be aware of so much. And 'incognito' alone communicates something regular folks can easily misinterpret.

> People should be aware and responsible of their own ignorance and limitations.

By definition, people are _not_ aware of their own ignorance...

Firefox has shown something similar for some time now: https://support.mozilla.org/en-US/kb/common-myths-about-priv...

Private mode being in some way "anonymous" seems to be a common misconception, and I find it a welcome development that browser makers are at last working on clearing it up.

I wish they also linked to the Tor Browser for those who need real anonymity.

At least google is finally admitting that incognito mode is useless for privacy online. It protects local data only, they might as well call it "porn mode" as the only real value is to avoid having history and cookies stored along side your everyday browsing history.

>At least google is finally admitting that incognito mode is useless for privacy online

That was abundantly clear at the start. I dug up a chromium build from 2017 and this was the incognito message:

>You’ve gone incognito

>Now you can browse privately, and other people who use this device won’t see your activity. However, downloads and bookmarks will be saved. Learn more

>Chrome won’t save the following information:

>* Your browsing history

>* Cookies and site data

>* Information entered in forms

>Your activity might still be visible to:

>* Websites you visit

>* Your employer or school

>* Your internet service provider

Sure, this doesn't explicitly say "this is useless for privacy", and figuring out what incognito mode does requires some reading comprehension, but they're not exactly trying to hide it either. Therefore the claim that google is "finally admitting" doesn't make much sense.

Um what?

> Now you can browse privately

So consumers are insane for thinking they can browse privately.

Is it “private” if you’re being tracked?

What "privately" means is fuzzy. Clearly it can't be entirely private, because there's several ways that information can get leaked out and is outside of the browser/computers control (eg. someone looking behind you, or the various middleboxes in between your computer and the web server). If you read the notice in its entirety, you'd know what the notice meant by "privately". Likewise, if you read my comment in its entirety, you'd see that I explicitly acknowledged that the notice wasn't super obvious and required some reading comprehension, and my objection was with the "google finally admitting" characterization.

>Sure, this doesn't explicitly say "this is useless for privacy", and figuring out what incognito mode does requires some reading comprehension

If you were “not being tracked” to the degree you seem to be assuming, then you couldn’t even log into a website, as you have to be “tracked” for it to know you’re the same person who logged in a second ago.

They went so far as to put in the tautological warning that your activity “might” be visible to the websites you visit. Really, you think?

>avoid having history ...

Except that's what this is about, no, Google do record the history of your access.

You can pause history recording on a Google account. Presumably they also lied about that and just set a "dontShowToUser" flag and continue to record the history?

Google has always tracked me incognito. That’s never been what incognito is about.

> Google has always tracked me

I can be outraged at Google for tracking me regardless of what mode the browser is in.

Or maybe that is what you are saying.

>I can be outraged at Google for tracking me regardless of what mode the browser is in.

Your browser, their server. It's like being upset amazon can track your orders even though you're using firefox.

If I'm using their server it is incidental. I'm not using Google search or Google maps.

But all those other pesky web sites use Google analytics, etc....

It's not a prefect analogy but UPS/Fedex knows your package delivery history (number of parcels, weight of each parcel, the senders, whether you answered the door, etc.) yet you did not explicitly consent to them. Sure, there are some sites that proudly list what courier they use, but most sites I've seen don't.

These are data essential for them to perform the offered services. And maybe some law obliges them to retain this data. But why does google feel entitled to track me? So that they can show me ads? I’m actively against showing ads.

>But why does google feel entitled to track me? So that they can show me ads? I’m actively against showing ads.

Sounds like hating on tracking is only incidental. In other words if google announced tomorrow that they won't do any sort of tracking, you'd still oppose them because they're still serving ads.

I’m just responding to the headline. “Google is tracking you even in incognito mode”.

This has always been true. You’re welcome to whatever outrage you feel like. I’m just pointing out that nothing has changed. They were just forced to put up a disclaimer about it.

Netflix have an option to turn off history for users -- it's more like if that doesn't turn off the recording of history but only the display of history.

It's absolutely the expectation of users that Google's Incognito mode makes you incognito to Google; of course normal users don't differentiate between the browser and the search engine accessed through the browser. Google themselves blur this line with the "Google" app, for example. Users think IE/Edge is "the internet", Google seemed to capitalist that thinking with the way they positioned themselves, on Android at least.

Netflix has to comply with VPPA. One of the few data protection laws in the US.

This has always been the case. Seems like they're just clarifying things for people who didn't understand what Incognito mode was.

Or their lawyers are trying to "clarify" it (for a very different audience).

This is probably ralated to the settlement of the parties reached in Brown v Google right before the close of 2023. Brown made it past the motion to dismiss stage, and, as usual, Google settled rather than try to prove the plaintiffs allegations are false.

https://ia801705.us.archive.org/7/items/gov.uscourts.cand.36...

This would have been a fun trial.

https://news.ycombinator.com/item?id=38005801 <-- Submitted wrong PDF by accident

Here is the correct one

https://ia801705.us.archive.org/7/items/gov.uscourts.cand.36...

> This won’t change how data is collected by websites you visit and the services they use, including Google.

Imagine that you don't know that Google can also track you across half the websites you visit via Google Analytics. This wording is clever - you still won't know.

It's things like these that make one lose faith in humanity.

You can explain something perfectly clearly, put it in front of people, and get punished because people don't read something that is put right in front of them. You wonder if people really are any better than lemmings.

Meanwhile there are endless examples of fine print abuse, and yet this is the one that is singled out because the people in power are not mentally capable of understanding new concepts.

I bet they're not tracking me in either normal or private browsing mode... On Firefox! I've absolutely no idea this would come as a shock to anyone using Google's own browser.

> I bet they're not tracking me in either normal or private browsing mode... On Firefox!

How much do you want to bet? Because they are if you visit any Google property or any page that loads Google cookies or assets or fonts or...

I tend to make use of uBlock origin's advanced mode which is set to block everything by default and I white list what I want each site to run. Most of Google's assets are red-listed. But I take your point.

The only relevant question is if they track you in any different way than Facebook tracks you in incognito mode, that is, if the browser gives Google more information than Facebook could get. Like some non-fingerprinted but browser- and/or system-specific ID or some kind of pings with metadata unrelated to normal tracking/ads about which pages you visit and possibly which data you submit to pages.

If not, then all is ok. Else they are higly misleading and possibly invading your privacy in an illegal way.

> You might encounter that surge now as both Google as well as the ticket-selling website will be tracking your activity.

Why does the article make it sound like website owners now have some new special abilities? Nothing has changed except the disclaimer.

I just bought a new phone. I havent migrated over yet. Do i install graphineOS or wimp out and stick with google's evil? Things like this are a weight on the scale.

Installing GrapheneOS is straightforward, and now is the perfect time to do it before you get used to a different environment and then have real changing pains.

GrapheneOS.

Other than dumb phone, it’s your best bet. However, your phone’s ISP will still collect your location data and sell it to Google and everyone else.

Google assets and ways of tracking are almost ever present. Chrome, Android, Google Analytics, Google fonts.

Using a non-obfucated IP I'm sure with inference they can predict individuals to decimal places of 99% accuracy. No cookies required, just a person viewing a good number of random pages on the web.

Isn't "traffic sources beyond Google" one of the ranking methods for Google organic search? Sort of explains how they have to overlook their massive presence to determine quality.

Their wording wrt incognito IMO doesn't even come close to how easy it is for them to track people.

Any downsides to Firefox? Seems like an obvious switch.

Doesn't firefox have the exact same issue? The intersection of people that are tech savvy enough to care about this but haven't switched yet, and the people who are genuinely fooled by this (as opposed to kneejerk-hating on google) is approximately zero.

Firefox's private browsing mode has for a long time had a great disclaimer that makes it obvious what the limitations are:

> Private window: Firefox Developer Edition clears your search and browsing history when you close all private windows. This doesn’t make you anonymous.

Emphasis mine. It's a better, simpler disclaimer than even the modified version that Google has started shipping post-settlement.

Firefox then includes a "learn more" link to https://support.mozilla.org/en-US/kb/common-myths-about-priv... which (imo) does a better job than Chrome's link at breaking down the myths. So Firefox takes really tangible steps to make sure that people understand what "incognito" browsing actually means.

The other difference is that Firefox actually does beef up anti-fingerpriting and anti-tracking protections by default to a greater degree than Chrome does if you're in a private browsing tab. The browser becomes stricter about blocking common tracking scripts and isolating data between domains. Firefox can't make you impossible to track during private browsing, but it does what it can, which is more than Chrome is willing to do, and most importantly, it makes sure that even if you're not tech-savvy you understand what the risks are. Firefox is not trying to be ambiguous or give you a false sense of security, but within its means it does try to make you as private as possible in those windows.

There was a maintained Firefox containers extension that worked well for me. Even logged into sites would be fooled that it was not me logging in with my username/password and 2nd factor. It is no longer maintained.

Their solution was to use Chrome.

Someone mentioned yesterday using the extension which clicks all advertisements. There is a long list of anti fingerprinting extensions.

Firefox's private browsing disclaimer is more honest/easy to understand as well:

> Private window: Firefox clears your search and browsing history when you close all private windows. This doesn’t make you anonymous.

It has no bearing on this issue which will be identical for either Chrome of FF (or Safari, or others). Private browsing has nothing to do with server side tracking, so there's no "obvious" reason to respond by switching a browser over this.

Strange comment considering the exact same problem applies to Firefox and all other browsers out there (unless there's some kind of VPN or proxy built-in), but maybe you're asking in general.

Desktop UX is okay (a little slow and brittle on KDE Plasma, both X and Wayland), not a fan of the mobile UX still around Q3 2021

It’s been indistinguishable from chrome for me for at least 4 years. Ymmv

I switched to arc.net recently and it’s been pretty great.

It's too preachy.

Big misunderstanding in what incognito/private mode is actually for I think...it's really only about not saving any local data.

When companies start forcing their services on to you, you know they are in trouble. This wont end well. I hope the EU is noticing.

tbh, I'm surprised it's taken this long for a) Google to publicly admit it, and b) for people to understand that it doesn't hide or erase your digital footprints online so Google, your ISP and every agent in between is well aware of what you're doing online. In fact, I believe most people still don't understand (b).

The incognito warning has always said that websites can still track you.* Point (b) won't be helped much by letting people know that Google is also a website.

*https://chromium.googlesource.com/chromium/src/+/09911bf300f... (find IDS_NEW_TAB_OTR_MESSAGE)

For the sake of completeness, I've traced the evolution of the notice over time:

From 2008-07-26 [0]: "Going incognito doesn't affect the behavior of other people, servers, or software. Be wary of: / • Websites that collect or share information about you / • Internet service providers or employers that track the pages you visit / • Malicious software that tracks your keystrokes in exchange for free smileys / • Surveillance by secret agents / • People standing behind you"

From 2013-12-07 [1]: "Going incognito doesn't affect the behavior of other people, servers, software, or people standing behind you."

From 2013-12-13 [2]: "However, you aren't invisible. Going incognito doesn't hide your browsing from your employer, your internet service provider, or the websites you visit."

From 2014-02-27 [3]: "However, you aren't invisible. Going incognito doesn't hide your browsing from your employer, your internet service provider, governments and other sophisticated attackers, or the websites you visit."

From 2014-04-29 [4]: "Going incognito doesn't hide your browsing from your employer, your internet service provider, or the websites you visit."

From 2016-01-15 [5]: "However, you aren't invisible. Going incognito doesn't hide your browsing from your employer, your internet service provider, or the websites you visit."

From 2017-02-27 [6]: "Your activity might still be visible to: / • Websites you visit / • Your employer / • Your internet service provider"

From 2017-03-29 [7]: "Your activity might still be visible to: / • Websites you visit / • Your employer or school / • Your internet service provider"

Note that some of these were behind a feature flag for a few months. Also, it looks like they've been intending to elaborate on the Incognito new-tab page for some time, as part of the "Revamped Incognito NTP" project. You can view the modified text with 'chromium --enable-features=IncognitoNtpRevamp':

From 2021-08-13 [8]: "What Incognito doesn't do / Incognito does not make you invisible online: / • Sites know when you visit them / • Employers or schools can track browsing activity / • Internet service providers may monitor web traffic"

From 2022-01-25 [9]: "What Incognito doesn't do / Incognito does not make you invisible online: / • Sites and the services they use can see visits / • Employers or schools can track browsing activity / • Internet service providers can monitor web traffic"

Thanks for doing this! Interesting to watch the change in tone as well as content over time.

Given that IIRC cookies are not included in private mode nor saved, what are your footprints made of? I guess firefox at least erases obvious ones like user agent, resolution or other fingerprints from incognito mode ?

Visit EFF's Panopticlick to learn more. https://coveryourtracks.eff.org/

Yikes. Is there a better-privacy extension for firefox ? (that sets you UA as chrome, your resolution as standard, unsets js sensitive api/canvas fingerprint...)?

Ip address and user agent + whatever unique information about the browser you can pull via Java script (fonts, timezone, screen size/shape….)

I agree but I'm not going to point fingers at the public. For most people, this stuff is complicated and I can't expect them to understand it.

It would be cool if instead browsers could somehow give them what they are expecting. Like "Private Mode" automatically flips their internet traffic through some kind of reputable and open VPN (not that those currently exist to my knowledge).

> "Private Mode" automatically flips their internet traffic through some kind of reputable and open VPN

I figured out how to do this a couple years ago:

https://github.com/pmarks-net/incognito-proxy

If you have a VPN service that provides a SOCKS proxy server, the chrome.proxy API can tell Incognito tabs to use the VPN, while leaving normal tabs unaffected.

Admit what? There's no big secret being unfolded here. They're just clarifying how it works. There's no way for a browser to hide your identity unless you're also using a VPN, proxy and other tricks. All they can do is separate and wipe the session locally, which is what all private modes in browser are doing.

I wonder if the original intent of the feature was to lull people into a false sense of security so the data could be collected on activity people wouldn't otherwise share.

Everyone knows that the original intent is "porn mode", but it would have escandalized the delicate ears of some politicians.

Not disagreeing but also 20+ years ago we, the general public, were more likely to be on a shared desktop machine at home rather than each having their own laptop/phone.

Funny how browsers adding browsing history as a feature sort of necessitated private mode.

> Not disagreeing but also 20+ years ago we, the general public, were more likely to be on a shared desktop machine at home rather than each having their own laptop/phone.

Even if you're not on a shared computer, you don't want "pornhub.com" to show up on your autocomplete when you're screensharing (online or in-person).

Sure, but was "porn mode" for the benefit of the user or the data collectors? I don't feel like that's a controversial thing to suggest given everything we know about the extent of online tracking and the players involved.

It never occurred to me that google would stop tracking me just because of some local browser setting. What a silly lawsuit.

Is the tracking also active for browser that are just based on chromium?

Any website can track any browser, even wget and curl. That's just how it works.

Think of the Men in Black mind-eraser. You're in a mirrored room with someone and have a conversation with them. You flash the eraser. And now you can't remember what the conversation was about.

All good? No, because the other person left the room before you flashed the mind eraser.

That's how the web works.

Good thing I use Firefox

Is that an ironic joke?

https://miloslav.website/blog/2020/10/26/firefox-privacy/

https://www.bloomberg.com/news/newsletters/2023-05-05/why-go...

I use Firefox. I would recommend it to others as well.

Google is tracking you with Firefox too! Thanks to “google safe browsing” feature turned on by default.

Not really a surprise with all the "free" stuff Google is providing on a daily basis to so many people.

Kagi costs a few $/month for search only and they're not building a "free" browser, "free" office competitor, "free" phone os, "free" video sharing platform, "free" storage of all their research work...

Someone said it better before I was even born. "If something is free, you’re the product" - Richard Serra, 1973

>and they're not building a "free" browser

https://kagi.com/orion/

Sort of but they do offer a paid tier for it but I would say it does not really buy you much. I do wonder if they will ever close it off.

Reply on news.ycombinator.com