Comment by tlibert | Hacker News Reader

Comment by tlibert | Hacker News Reader

Hi, I'm Dr Tim Libert, founder of webXray who did this audit. Happy to answer questions from YC'ers. [Note, stepping away for some mental health exercise, stressful day!]

I also want to push back on Google telling the press our California Privacy Audit is "is based on a fundamental misunderstanding of how [Google's] products work".

I'm the former head of Cookie Compliance at Google and I have the federal court filings that show their statements are not simply true, and Google knows it isn't true.

For the record, here are direct quotes from a federal court filing made by Google's "Data Protection Officer and Senior Director of Privacy", who stated that "If called to testify as a witness, [they] could and would testify competently to such facts under oath."

Here are those facts:

* "Due to Dr. Libert’s academic background focusing on cookies, he became one of the primary members of the team assisting with Google’s cookie compliance and governance efforts..."

* "Dr. Libert quickly assumed responsibility for aiding our in-house regulatory lawyers in addressing governmental investigations into cookies..."

* "Dr. Libert often worked under the guidance of in-house counsel to develop technical solutions to issues raised by privacy regulators..."

* "Dr. Libert was also responsible for the development of internal policies on cookies and web storage. He drafted Google’s internal cookie guidelines in 2021 and early 2022, which applies to all cookies or cookies-like objects, and outlines processes on managing cookies, storing cookies, logging data associated with cookies, server protocols, policies on data collection, and data linkage..."

* "By developing the policy and conducting the audit, Dr. Libert gained insight into every Google-owned cookie deployed across Google’s web properties..."

* "Dr. Libert also proposed changes to how Google interprets specific definitions across its products’ various privacy policies. This included work on policies relating to analytics and advertising services used by third-party apps and websites..."

--

TLDR: Google can say what they want about me in public, but when they are under oath in a federal court of law, this is what they really say.

The GPC spec does not say "no cookies will be set" [1], and does not mention cookies at all. It merely provides a way for the user to indicate their preference that their information not be shared or tracked. The spec even says:

> In the absence of regulatory, legal, or other requirements, websites can interpret an expressed Global Privacy Control preference as they find most appropriate for the given person, particularly as considered in light of the person's privacy expectations, context, and cultural circumstances.

The CCPA [2] also never explicitly mentions cookies or forbids them from being set. The relevant passages about opting out on the sale of personal information are:

> a) A business shall provide two or more designated methods for submitting requests to opt-out, including an interactive form accessible via a clear and conspicuous link titled “Do Not Sell My Personal Information,” on the business’s website or mobile application. Other acceptable methods for submitting these requests include, but are not limited to, a toll-free phone number, a designated email address, a form submitted in person, a form submitted through the mail, and user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information

How would you respond to their claim that you are fundamentally misunderstanding GPC, and that the spec and the law do not mean you never set cookies, they mean that you must honor the preferences expressed by the header in backend processes that involve tracking or sale of personal information?

[1] https://w3c.github.io/gpc/

[2] https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oa...?

To quote our report: At webXray we are experts in tracking technologies, and we work closely with in-house counsel, defense, plaintiff firms, and regulators. However, we are not lawyers ourselves, thus nothing in this report represents a legal conclusion. webXray was not founded to supplant the role of lawyers, courts, or judges. We were founded to provide clear, accurate, forensic data, without fear or favor. We believe that by filling this gap we can enhance outcomes for all consumers, businesses, and regulators.

---

We are filing the gap related to reliable facts not existing. We did a scientifically controlled test with GPC on and off. We presented the results as technical findings along with general background.

We are not lawyers, and we are happy to help others perform their own audits: https://webxray.ai - we have no desire to be lawyers.

We are a hard-tech engineering outfit, we deliver scientific clarity on complex topics.

So you agree that you have no way to confirm whether those websites honor or do not honor the do-not-sell-my-info choice. You are simply checking whether they set cookies or not, without knowing whether the data is sold or not on the backend.

We run scientific audits that provide evidence of specific data transfers under specific network conditions.

Your marketing should specifically say "We track cookies" (or if you wanna get punchy about it, "We track cookies so cookies don't track you") so potential customers know exactly what they're getting. For the purposes of legal compliance, this is pretty irrelevant. There may be people that want to know that the existing laws and company's compliance to them doesn't actually stop the cookies from being sent, but your privacy report says the companies are "Our findings reveal major technology companies simply ignore globally defined opt-out signals, raising the spectre of industrial-scale non-compliance with California requirements", which is untrue and potentially opens you up to libel claims. They are not ignoring the laws, they are complying with the laws in a way that may or may not be what the consumer actually cares about.

Do you have any legal experience, evidence, or case history to support your perspective? You assert that the statement "Our findings reveal major technology companies simply ignore globally defined opt-out signals, raising the spectre of industrial-scale non-compliance with California requirements" is untrue -- how do you know? Do you think everything found in the discovery process would agree? Do you think a company with a history of privacy violations would actually go through with a lawsuit where they'd have to definitively prove they don't? What about proving malice, that webXray knew their statements were false or acted with reckless disregard for their truth? What about the risk of filing a suit where California's anti-SLAPP statue would probably apply?

> I'm the former head of Cookie Compliance

If the Internet didn't turn out the way it turned out, this could have been the greatest job ever.

Being the best in the world at what you do and not being allowed to do it is...not the greatest job. ;-)

Thank you for doing it anyways. The state of things seriously depresses me. We used to leave platforms just for putting up banner ads.

Thanks for speaking out publicly - especially as an Ex-Big Tech employee who knows the internal workings of these companies - and actually trying to do something about this.

I personally felt many times being tracked by Google or other big tech companies showing me something relevant to previous search queries even though they were made on different platforms and using adblock extensions (ublock origin). So their active tracking is definitely very elaborate.

I won't lie, I miss the Staff/L6 paycheck and lack of stress. This is way less money for way more stress, but I chart my own path. I'm proud of what my company https://webxray.ai is doing.

Apologies in advance an excuse my ignorance as I am going on a hunch here and don't have much rather than perhaps frustration driving my comment, but it feels like this isn't the first and nor will be the last we find stuff like this.

I can't help but think they will pay the fines and go on continuing doing this, which makes it seem like it just evolved into a scheme where the government now takes their cut.

I've been at this 15 years now, and it's neither the first nor last thing I'll do. We call the site "Global Privacy Audit" because California is first. The laws in California are weaker than elsewhere in the world. This is a warm up for the main dish.

Sadly this isn’t even that bad compared to what’s in their own app binaries. If you’ve got an old iPhone you can jb and some claude usage to spare I highly recommend hooking up a ghidra mcp so you can see for yourself.

I don’t have any of their apps on my phone. And there is no known method to get rid of the trackers in your iCloud keychain.

No questions to ask, just wanted to say thank you for your work. I'm sure it's not easy and definitely less stressful to just leave things be. Thank you.

This is a phenomenally stressful day, I pissed of Google, Microsoft, and Meta in one shot, and they will come after me again. We do it because we believe in our product, and we'll stand the test anybody - even BigTech - puts us to: https://webxray.ai/

Not sure why you're being downvoted. Thank you for what you do.

Appreciated, means a lot.

I'm not surprised at the downvotes, but someday we all have to look in the mirror and decide if we like what we see, but it's easier to downvote in the meantime.

If I may... I suspect quite a few of your comments have been downvoted for being a little—frenetic. In many ways, your work here (together with your previous work experience) speaks for itself, at least to those of us who get it.

Unfortunately, awareness-raising and solution-building are probably two entirely separate stages for this issue.

I’m used to a quick fire response format for legal questioning. My words are carefully chosen, but I do reply quickly because I played every question in my head in advance.

The dig on downvotes however was intentionally cheeky. I’m well respected by many engineers who worked with me, no hard feelings, just a little teasing.

There are a lot of Google and Meta engineers who are convinced that they're not the bad guys.

Reply on news.ycombinator.com