To settle a years-long lawsuit, Google has agreed to delete “billions of data records” collected from users of “Incognito mode,” illuminating the pitfalls of relying on Chrome to protect your privacy.
Firefox Mobile, Ublock Origin and Disabled JavaScript yield:
Bell Cameron and Andrew Couts
Security
Apr 1, 2024 5:22 PM
The Incognito Mode Myth Has Fully Unraveled
To settle a years-long lawsuit, Google has agreed to delete “billions of data records” collected from users of “Incognito mode,” illuminating the pitfalls of relying on Chrome to protect your privacy.
‘Google Chrome Incognito Mode’ is displayed on computer screen
Illustration: Yasin Baturhan Ergin/Getty Images
If you still hold any notion that Google Chrome’s “Incognito mode” is a good way to protect your privacy online, now’s a good time to stop.
Google has agreed to delete “billions of data records” the company collected while users browsed the web using Incognito mode, according to documents filed in federal court in San Francisco on Monday. The agreement, part of a settlement in a class action lawsuit filed in 2020, caps off years of disclosures about Google’s practices that shed light on how much data the tech giant siphons from its users—even when they’re in private-browsing mode.
Under the terms of the settlement, Google must further update the Incognito mode “splash page” that appears anytime you open an Incognito mode Chrome window after previously updating it in January. The Incognito splash page will explicitly state that Google collects data from third-party websites “regardless of which browsing or browser mode you use,” and stipulate that “third-party sites and apps that integrate our services may still share information with Google,” among other changes. Details about Google’s private-browsing data collection must also appear in the company’s privacy policy.
Additionally, some of the data that Google previously collected on Incognito users will be deleted. This includes “private-browsing data” that is “older than nine months” from the date that Google signed the term sheet of the settlement last December, as well as private-browsing data collected throughout December 2023. All told, this amounts to “billions of data records,” according to court documents. Certain documents in the case referring to Google’s data collection methods remain sealed, however, making it difficult to assess how thorough the deletion process will be.
Google spokesperson Jose Castaneda says in a statement that the company “is happy to delete old technical data that was never associated with an individual and was never used for any form of personalization.” Castaneda also noted that the company will now pay “zero” dollars as part of the settlement after earlier facing a $5 billion penalty.
Other steps Google must take will include continuing to “block third-party cookies within Incognito mode for five years,” partially redacting IP addresses to prevent re-identification of anonymized user data, and removing certain header information that can currently be used to identify users with Incognito mode active.
The data-deletion portion of the settlement agreement follows preemptive changes to Google’s Incognito mode data collection and the ways it describes what Incognito mode does. For nearly four years, Google has been phasing out third-party cookies, which the company says it plans to completely block by the end of 2024. Google also updated Chrome’s Incognito mode “splash page” in January with weaker language to signify that using Incognito is not “private,” but merely “more private” than not using it.
The settlement’s relief is strictly “injunctive,” meaning its central purpose is to put an end to Google activities that the plaintiffs claim are unlawful. The settlement does not rule out any future claims—The Wall Street Journal reports that the plaintiffs’ attorneys had filed at least 50 such lawsuits in California on Monday—though the plaintiffs note that monetary relief in privacy cases is far more difficult to obtain. The important thing, the plaintiffs’ lawyers argue, is effecting changes at Google now that will provide the greatest, immediate benefit to the largest number of users.
Critics of Incognito, a staple of the Chrome browser since 2008, say that, at best, the protections it offers fall flat in the face of the sophisticated commercial surveillance bearing down on most users today; at worst, they say, the feature fills people with a false sense of security, helping companies like Google passively monitor millions of users who’ve been duped into thinking they’re browsing alone.
Yeah I’ve always assumed incognito mode is just for when you don’t want to have it save to your browser history or if you want to be able to log into a second account on a website.
Nah it’s basically the button cops press when they want to kill someone that turns off their body cam except it’s for when you don’t want the CIA to see you crank it to clown fart porn
Pretty sure it’s always been upfront with that it still tracks you? I always thought of it as a “don’t store history and cookies locally” thing and nothing more. Maybe I read that disclaimer with more cynicism than most?
“If you’re concerned, for whatever reason, you do not wish to be tracked by federal and state authorities, my strong recommendation is to use [Google Chrome’s] incognito mode.”
This result has so many loop holes it’s incredible. You can’t read a single sentence without exceptions, unknowns or generosity. Horrible, but Google probably can blackmail the world.
You can use a VPN but then that VPN will track you. People need to let “internet privacy” go. That’s a fairly tale for Toddlers. There’s no legislation that will come to save privacy ever not even in the eu, the government tracking is enough to make all the tech companies turn green with envy.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@lemmy.world
This is a most excellent place for technology news and articles.
Anyone have the article? I haven’t paid my Guardian, Wired, WSJ, Wikipedia, Politico, and Vox bills this month. I only paid WaPo and NYT.
Firefox Mobile, Ublock Origin and Disabled JavaScript yield:
Thanks for taking the time to do that for us
Am I the only one who knew Incognito mode simply didn’t keep history or cookies on the local machine?
I always assumed nothing changed on Google’s end.
Yeah I’ve always assumed incognito mode is just for when you don’t want to have it save to your browser history or if you want to be able to log into a second account on a website.
You’re not the only one. But it might as well be a magic box for many people.
Nah it’s basically the button cops press when they want to kill someone that turns off their body cam except it’s for when you don’t want the CIA to see you crank it to clown fart porn
Pretty sure it’s always been upfront with that it still tracks you? I always thought of it as a “don’t store history and cookies locally” thing and nothing more. Maybe I read that disclaimer with more cynicism than most?
“Always”? Nope.
“If you’re concerned, for whatever reason, you do not wish to be tracked by federal and state authorities, my strong recommendation is to use [Google Chrome’s] incognito mode.”
Source: https://www.forbes.com/sites/thomasbrewster/2015/01/05/super-cookies-can-track-you-over-google-incognito/
The language it uses/used to use was rather ambiguous, especially for less tech savvy people.
Perhaps it wasn’t false, but it definitely wasn’t upfront.
This result has so many loop holes it’s incredible. You can’t read a single sentence without exceptions, unknowns or generosity. Horrible, but Google probably can blackmail the world.
I’m just using it to prevent my depraved, shameful porn searches from entering my browser’s autocomplete corpus. Learned that one fairly early on.
typing: 'p…
Autocomplete: “YOU WANTED PORNHUB.COM, RIGHT?”
even worse, my university website’s page starts with portal.*
This is why we visit porkbun every few weeks. We’re not actually registering domains that frequently ;)
A man who never eats pork buns, is never a whole man!
Thank you merciful Google immeasurably for agreeing to delete data that you shouldn’t have collected anyway!
You can use a VPN but then that VPN will track you. People need to let “internet privacy” go. That’s a fairly tale for Toddlers. There’s no legislation that will come to save privacy ever not even in the eu, the government tracking is enough to make all the tech companies turn green with envy.
I hate it, but I tend to agree with your take. If you don’t want someone to be able to find out about it, don’t do it on the internet.
The op link hit a paywall for me, this one is working:
https://web.archive.org/web/20240401221646/https://www.wired.com/story/google-chrome-incognito-mode-data-deletion-settlement/
I guess they would call that a win
And they’re allowed to start doing it again in 5 years