Imagine that the only thing that is reported to the Chrome backend is a client ID and a URL, which would be the only thing needed to render this app: https://my

Imagine that the only thing that is reported to the Chrome backend is a client ID and a URL, which would be the only thing needed to render this app: https://myactivity.google.com https://myactivity.google.com Would you think of Google as trustworthy because they only gave their backend two pieces of data? I myself would not, because I'm pretty sure the actual request and response messages are looked up by client ID (in their Google Analytics data store).