That’s problematic because Google (and others with such broad internet scope) tracks you regardless of whether you are interacting with Google services or not.
Source? Also, can you clarify what exactly is mean by "tracking"? I would expect them to "track" me via anonymous cookies, but wouldn't expect them to tie my browsing history to my chrome login.
Now certain websites could use tracking methodologies based on ip address and device signatures to identify you as the same user and set a cookie identifying you as the same user for purposes like remarketing, but Google itself doesn't join this data from their own logs.
This announcement is just clarifying that Google does log data in icognito mode as do other websites. It doesn't say that Google joins your icognito session data with your non-icognito session data.
Google is incentivized to do “privacy theatre” and make sure your incognito session doesn’t show up as related to you even if the back-end systems have a clear association.
I don’t know the facts of Google’s systems either way, but I do know that absence of a visible join is not conclusive evidence that there is none.
It would take a determined and malicious employee to subvert these controls and possibly require multiple employees to get by code reviews to do such.
That said, I can appreciate the skepticism an outsider might have about such claims.
But, I also disagree that Google is incentivized to do "privacy theater" as you call it. For one, many already assume the worst of Google and also such theater could open them up to major lawsuits.
One could make the case that a company like Apple has invested a lot more effort in "privacy theater".
That doesn't mean cookies or logs are joined, and the targeting is always anonymous, so it is less precise than when using the cookie ids.
Eh? There is no chance of this. What leads you to this conclusion?
Is it possible? Sure. A lot of things are possible. Is it inevitable? Far from it.
But that isn't quite the narrow framing you used.
Google receives a ton of requests from IP 30.40.50.60 with cookies associated with fromMars@gmail.com.
Suddenly, there are a bunch of requests from:
- the same IP
- the same browser
- the same resolution
- the same OS
- the same WebSocket IP
- the same DNS servers used for resolving
- the same Adobe Fla^W^W well, not that, but I wouldn't be surprised what if you have still have it for whatever reason - it would be noted too
the same fingerprinting bits used by the most pervasive tracking company in the world
The most pervasive Internet tracking company in world: hmm, that's totes not fromMars@gmail.com!
So the TLDR, is that yes data is being logged for an incognito session by Google, but that data isn't tied together by Google across icognito sessions or icognito and non-icognito sessions.
Incognito mode always had a rather clear explanation of what it is about. It is somewhat complicated to those who are completely new to it, so I guess it can be misinterpreted, but I see nothing misleading in the explanation. Also, Chrome is not the only browser with that kind of feature and they are all essentially work and are presented the same way.
That some browsers tie it to some kind of tracker blocker actually make things even more confusing because on one hand you have "private/incognito/whatever" tell you that websites can still track you (because it is not what it is designed to do), and then, just below, you have a tracker blocker. So what is really blocked?
Why call it incognito mode, if not to imply you couldn't be tracked? It's absolutely not unreasonable for the average Chrome user to draw this conclusion.
Then usage patterns drifted but the term didn't change.
To tech-savvy users it was always clear that sites would still be able to track you, whether or not you clear your local history and cookies. Cookies are just one, quite outdated at this point, way of tracking.
Let's say that you are using the internet to "buy your wife some jewellery". You want to be sure that she won't see your search history for "jewellery" or visiting "jewellery" websites.
It is perfect for that. Anyone who thought this somehow made them anonymous on the internet is probably the sort of person who thinks that wearing dark glasses or growing a beard is going to let them hide from the police too.
The kinds of geeks that use HN wouldn’t have been so naive.
It’s really quite a shocking lie they were selling to the uninformed, it morally reeks, even for Google’s standards.
All I've seen is the marketing for "buying gifts for your spouse in secret"-feature.
You are saying they have marketed it as a total privacy feature, like the VPN companies do?
These users thought differently.
https://ia801705.us.archive.org/7/items/gov.uscourts.cand.36...
Google was being sued over this surreptitious data collection while in so-called "Incognito Mode". When it tried to have the case dismissed, it failed. (Judge Koh) Then it moved for summary judgment. That failed, too. (Judge Gonzalez-Rogers, who some may recognise form the Epic v Apple case). So just as we were getting ready to let a jury decide whether Google is at fault, Google pays off the plaintiffs' counsel. Why are these so-called "tech" companies willing pay anyone and everyone to prevent precedent from being created. Surely the precedent would work to protect them in the future, right? These meritless lawsuits over privacy would be nipped in the bud.
But Google will almost invariably stop these cases from going to trial by paying out settlements. Will we ever see Google go to trial for alleged wiretapping. No. But that's not because the cases get dismissed or because Google wins on summary judgment. Quite the opposite.
There were seven counts in this case. Google's request for summary judgment was denied on every single one. Even the usual defence of no injury-in-fact, e.g., no user lost money as a result of the surveillance, failed. "Tech" workers want to keep on pretending that every other person using a computer is an easily manipulated, ignorant fool. Good luck.
https://ia601705.us.archive.org/7/items/gov.uscourts.cand.36...
Here is what the court said about consent.
"The analysis starts with the Privacy Policy17 wherein Google advises at the outset and in bold, larger print:
When you use our services, youre trusting us with your information. We understand this is a big responsibility and work hard to protect your information and put you in control. (12/15/22 Google Privacy Policy.)
Immediately after, Google advises:
This Privacy Policy is meant to help you understand what information we collect, why we collect it, and how you can update manage, export, and delete your information.
...
We build a range of services that help millions of people daily to explore and interact with the world in new ways. Our services include:
Google apps, sites, and devices, like Search, YouTube, and Google Home Platforms like the Chrome browser and Android operating system Products that are integrated into third-party apps and sites, like ads and embedded Google Maps (Id.)
Notably, Incognito mode is not mentioned in this list of services. (Id.) Rather, Google shifts and in the next paragraph advises users: You can use our services in a variety of ways to manage your privacy. . . You can also choose to browse the web in a private mode, like Chrome Incognito mode. And across our services, you can adjust your privacy settings to control what we collect and how your information is used.18 (Id.) That is the only mention made of the privacy mode. The Privacy Policy is silent as to any data collection specific to private browsing mode. The Court rejects Googles argument that the Privacy Policy unambiguously discloses the at-issue data collection. The silence noted above combined with Googles surrounding statements regarding what it means to browse privately, means that a material dispute of fact remains regarding the scope of users consent. For instance, the way Google presents Incognito mode could be read to contradict its suggested interpretation of the Privacy Policy. When users first open Chrome, they are greeted by a bright, white screen and the colorful Google logo. When users navigate to Incognito mode, the screen goes from white to black, all text is rendered in gray, and users are met with a spy guy icon. (PAF 9.) They are told they have now gone Incognito, which, Google explains on the next line, means that they can browse privately, and other people who use this device wont see your activity. (PAF 30.) Plaintiffs have evidence to show that, internally, Google understood that the framing of the feature as Incognito (or, for other browsers, Private) made users overestimate privacy mode protections, including that Incognito hides browsing activity from Google. (Dkt. No. 924-36, Ex. 80; Dkt. No. 924-48, Ex. 44.)
Googles arguments otherwise do not change the result. Its reliance on this Courts finding in Calhoun is misplaced. That case did not involve Incognito mode. See Calhoun, 2022 WL 18107184, at *10. The reasoning therefore does not extend here. Next, Google argues that to obtain consent effectively, companies should not have to enumerate every mode, setting, or circumstance impactingor not impactingthat data collection. See Smith v. Facebook, Inc., 745 Fed. Appx 8, 9 (9th Cir. Dec. 6, 2018) (holding that Facebooks tracking of publicly available health data fell within the scope of users general consent to its data tracking and collection practices). It is true that such enumeration is not always necessary. The fundamental issue, however, returns to actual consent. Google chose both to use a general disclosure and yet promote the privacy afforded by Incognito over regular mode. Having made that distinction, Google itself created a situation where there is a dispute as to whether users consent of Googles data collection generally is substantially the same as their consent to the collection of their private browsing data in particular. See Restatement (Second) of Torts 892A (1979) 2(b), 4.
For those reasons, the Court DENIES Googles motion for summary judgment on the grounds of express consent."