The 'Incognito Mode' lawsuit: a legal blow to Google's privacy-washing tactics(proton.me)
proton.me
The 'Incognito Mode' lawsuit: a legal blow to Google's privacy-washing tactics
https://proton.me/blog/google-incognito-lawsuit
18 comments
I'm pretty sure those disclaimers were not there when the lawsuit started a few years back. People generally thought privacy mode had a lot more capabilities than it really had, at least most layman people I talked with about it. Now it seems that has changed, probably because of the disclaimers.
They've been there in some form for a very long time (see the ancient screenshot here):
https://www.chromium.org/user-experience/incognito/
[deleted]
> Your activity might still be visible to:
> * Websites you visit
"might" is not "is". Deception.
> * Websites you visit
"might" is not "is". Deception.
For me, a.big surprise about Incognito mode after using it was finding, by chance, that opening new Incognito windows did not create separate, new private browsing sessions.
I was very surprised to open an Incognito window and visit a site to find it knew who I was and I was logged in there already.
My mental model didn't match what I'd assumed Incognito mode to mean. Unfortunately this meant a few years of using Incognito to avoid basic tracking had not actually avoided tracking.
After this discovery I switched to Firefox Temporary Containers, which do what I expected and wanted from Incognito mode all along.
I was very surprised to open an Incognito window and visit a site to find it knew who I was and I was logged in there already.
My mental model didn't match what I'd assumed Incognito mode to mean. Unfortunately this meant a few years of using Incognito to avoid basic tracking had not actually avoided tracking.
After this discovery I switched to Firefox Temporary Containers, which do what I expected and wanted from Incognito mode all along.
Who thought that? Surely everyone knows incognito mode is about privacy on your local computer ie watch porn without leaving evidence. weird.
From the article:
>The plaintiffs further claim that Google still collects data during private Chrome sessions that the company can de-anonymize and use to target you with ads. They say the company stores people’s browsing data in the same logs, whether they’re in regular or private mode. When combined, “Google can use them to ‘uniquely identify a user with a high probability of success.’”
>The plaintiffs further claim that Google still collects data during private Chrome sessions that the company can de-anonymize and use to target you with ads. They say the company stores people’s browsing data in the same logs, whether they’re in regular or private mode. When combined, “Google can use them to ‘uniquely identify a user with a high probability of success.’”
That data is the same data any website receives: user agent, IP address, and anything allowed via Javascript APIs. How specifically do the plaintiffs want Incognito to work?
They don't have a way to detect whether you are using Incognito or not, so they can't treat those people's browsing data differently.
When there is a way, they patch it:
https://blog.google/outreach-initiatives/google-news-initiat...
https://bugs.chromium.org/p/chromium/issues/detail?id=990592
When there is a way, they patch it:
https://blog.google/outreach-initiatives/google-news-initiat...
https://bugs.chromium.org/p/chromium/issues/detail?id=990592
Incognito literally means to have your real identity hidden. It seems deceptive for a company to name/market a product as 'incognito' when it is literally funnneling data to them that identifies you and links to you real identity.
Especially when the text warnings do not explicitly state that browsing data is being sent to Google and added to their tracking and marketing database about yourself.
Especially when the text warnings do not explicitly state that browsing data is being sent to Google and added to their tracking and marketing database about yourself.
As far as the browser is concerned, it is not doing anything to "reveal" your identity. It won't send pre-existing cookies, won't indicate you are using Incognito Mode, and won't persist site storage outside Incognito Mode. Are you saying Incognito Mode should also send your traffic through a VPN?
I've always liked the internal name better, "off-the-record mode".
I've always liked the internal name better, "off-the-record mode".
The browser isn't (aside from Chrome being much easier to fingerprint than some other browsers) but the browser vendor is doing something to reveal my identify.
I don't expect Google to control what others do, but I do expect them to control what Google does. If Google tells me I am incognito, then I should be incognito as far as Google is concerned.
I don't expect Google to control what others do, but I do expect them to control what Google does. If Google tells me I am incognito, then I should be incognito as far as Google is concerned.
But that would mean Google would have to send some kind of signal to Google's servers that you're using Incognito.
Imagine the headline:
Chrome tells Google (and only Google) when you're using Incognito mode
I'd imagine people would be even more pissed that Google is making it detectable for themselves and not others and would accuse them of being anticompetitive, even if they used it to turn off tracking for those users. They certainly wouldn't be able to turn off tracking like that for users of Private/InPrivate browsing on other browsers.
Imagine the headline:
Chrome tells Google (and only Google) when you're using Incognito mode
I'd imagine people would be even more pissed that Google is making it detectable for themselves and not others and would accuse them of being anticompetitive, even if they used it to turn off tracking for those users. They certainly wouldn't be able to turn off tracking like that for users of Private/InPrivate browsing on other browsers.
They don't have to call the feature "Incognito". If they can't deliver on what they're promising, then they should call it something that they can.
I'm with Google on this one.
> Your activity might still be visible to:
> * Websites you visit
> * Your employer or school
> * Your internet service provider
Which to me, at least, makes clear that Incognito Mode is not a catch-all privacy-preserving mode.
Additionally, the "Block third-party cookies" toggle implies that websites can/will use third-party cookies when the toggle isn't selected.
(I have mixed feelings on some of these anti-Google suits... considering how many rock-solid cases there are to bring against Google, chasing the ones that are founded on shaky premises feels like a waste of time at best and actively detrimental to the other cases at worst.)