17 ms·

Google sued for secretly amassing vast trove of user data

383 points by spac 6y ago

hashberry 6y ago
I have a personal gmail and a work gmail (G Suite), each using my full name, but both run in separate browsers using the same IP address. I always wonder if Google keeps a "master record" of people and all their associations, if not for security or to work with law enforcement.
- Romanulus 6y ago
  Probably. I recall Project Veritas showing hidden video of a Twitter dev speaking about databases that link all profiles of someone (using things like IPs, fingerprints, etc. to stitch the relationships together).
  - s3r3nity 6y ago
    You're probably getting downvoted for discussing Project Veritas (which is a silly reason for downvoting IMO) but your point is still accurate: these companies are defnitely running models to create probabilistic identity models in the absence of deterministic associations. Deterministic = I specifically say I'm person X and am logged-in. Probabilistic = I am not logged-in on this browser, but am on the same computer, same IP, and am logged-in on a separate browser at the exact same time under name X. Therefore I'm very likely person X.
    - ehsankia 6y ago
      It's not silly. A source that has been often shown to fabricate evidence and post straight up lies doesn't belong on HN. Many of their videos, including the "undercover interviews" with Twitter and Google have all been shown to have been edited/cut to completely change what the person was talking about or trying to say. Nothing coming from PV can ever again be taken with a single grain of salt.
  - scohesc 6y ago
    I really hate changing the topic here, but I feel it has to be said sometimes. It's _very_ frustrating when people immediately discredit someone or something because they don't agree with them, even if they don't have the full story. Project Veritas does some good work, even if they're blasted in popular culture/mainstream media for being 'biased', 'alt-right', 'etc'. I bet you the downvotes you're getting are just because you mentioned Project Veritas. They have some very out-landish views, but when they actually put people on the street or go undercover, they've revealed dirt on a lot of companies and people. It's shocking to me to see society go from "let's look at ALL sides of the coin, no matter how egregiously offensive they are to me" to "fuck 'em, they're trash media, they suck, they shill and are racist, alt-right losers and I'm not going to look at anything they post because in my mind everything they do is bad!" I don't even go to Project Veritas outside of what I hear in the media, but I still give it a fair look and make my own opinion.
    - pphysch 6y ago
      Come now. The issue isn't that Veritas is "biased", it's that they have been caught time and time again fabricating evidence. We can talk about tech surveillance without playing into the modern fascist agenda.
    - ehsankia 6y ago
      I'm sorry but no. I'm all for looking at all sides, but Project Veritas is not that. They have done extremely shady things such as intentionally sending a fake victim to WP [0], as well as editing/slicing sentences (which they recorded without consent) to create an entirely different narrative, different from what the person was originally trying to convey [1]. Even a single one of these incidents is enough to completely throw every thing you've done and said into doubt, let alone the half a dozen that PV has behind it. There is absolutely no way you can take anything they say or do serious after they've been caught times and times again lying and misleading. It has absolutely nothing to do with how outlanding their views are, and everything to do with the fact that what they say or do cannot be trusted. I used to in the beginning, but they are way past being given a "fair look". [0] https://www.bbc.com/news/world-us-canada-42150322 https://www.bbc.com/news/world-us-canada-42150322 [1] https://www.theverge.com/interface/2019/6/27/18760463/project-veritas-youtube-sting-james-okeefe https://www.theverge.com/interface/2019/6/27/18760463/projec...
- logicslave 6y ago
  Definitely. They have logic that links data sets, all it takes is one slip up for them to know youre the same person, probably with levels of probability about whether you are the same person.
- s3r3nity 6y ago
  >...the same IP address. In my experience in adtech, not only can Google do this pretty accurately, but other third parties as well (e.g. DMPs and the like.) Even if they couldn't make a deterministic association, they have enough data points to make a probabilistic association with high likelihood (ex: "Given all these data points, we're 95% confident that these two people are the same. Therefore we're going to attribute the actions to the same person.") Now, to qualify my response a bit, this isn't necessarily for security / law enforcement, but mainly for better targeting parameters. Example: frequency capping of ads (buyer specifies that you only see an ad X number of times in a given time period) or more relevant targeting (you don't see completely different ads in different browsers as if you're from two non-overlapping demographic groups.)
- caymanjim 6y ago
  Facebook does this to build shadow profiles of everyone, even if they are not Facebook users. I'm sure Google does similar things. They certainly could.
  - junon 6y ago
    The thing is, doing this is actually quite trivial. Graph databases are used in large part for this very usecase.
- summerlight 6y ago
  IMO, that doesn't make a good trade off. The identity problem space is already super complicated due to ITP while the risk is very high. If you make mistakes, you will accidentally leak personal information to others while the benefits... are pretty minimal, probably having 1~2% more revenue from those people with dual accounts. Given that joining signed-in and signed-out identity is explicitly prohibited as a condition of Double Click acquisition, I doubt if there's any incentive to do this kind of joining for Google.
foota 6y ago
This lawsuit is idiotic. They're claiming Google is doing something wrong by tracking users from websites using ad tech when someone uses their browsers private browsing mode.
- Veen 6y ago
  It's not so idiotic. Google collects information that people don't want them to collect. That arguably objectionable, even if it's not strictly illegal. It will be interesting to see whether this case gets a sympathetic judge, but I imagine it will end up being dismissed like previous lawsuits of this variety. Nice bit of publicity for the law firm though.
  - lern_too_spel 6y ago
    Every website does.
    - paulryanrogers 6y ago
      Not every website controls: the browser, analytics service across large part of the web, and sometimes the OS (Android/ChromeOS)
      - lern_too_spel 6y ago
        Your proposal is for Google to abuse its monopoly positions to provide a better privacy experience for its properties than for others?
        paulryanrogers 6y ago
        Not my proposal. Regardless, a case is being made that Google is in a position to ensure its analytics services comply with the GDPR when a browser has been put into a mode clearly intended to opt out of tracking. Other websites or services may be able to say they can't control how those browsers in such modes communicate that intent. Google cannot.
simonw 6y ago
"According to the suit, the company collects information, including IP addresses and browsing histories, whenever users visit web pages or use an app tied to common Google services, such as Google Analytics and Google Ad Manager." I'd really appreciate some more technical details here. Does this include web server logs that record incoming IP addresses? Is the expectation here that Chrome would set a DNT header in incognito mode and Google properties would then obey that header?
- t0mas88 6y ago
  Server logs with IP addresses are acceptable to most European privacy regulators if you only use them for a technical purpose such as debugging. And not keep them longer than needed for that. So practically: logs are fine, delete them after a while. If you store the same information in a permanent database and use it for analysis you're in trouble and should have asked permission. The fact that the user uses a private window or other means to indicates they don't want to be tracked probably makes this a more clear case.
  - oefrha 6y ago
    > The fact that the user uses a private window or other means to indicates they don't want to be tracked probably makes this a more clear case. That’s a very confusing statement. My server logs don’t filter incoming log entries based on user agent, and certainly not on whether you’re using a “private window” or not. In addition, the goal of a private/incognito session is to be indistinguishable from regular sessions, otherwise websites can easily discriminate against private sessions (which they’re already trying as hard as they could). Edit: Wow the number of people on this thread claiming websites should be able to opt people out of logging based on whether they’re using a “private window” (which websites should have absolutely no idea about) makes me question if I’m even on Hacker News. Edit 2: Chrome sends an X-Client-Data header (which in a sense includes an installation ID, but allegedly has limited entropy) to certain Google properties, and rightfully got a lot of flak for it. It does not do so for incognito sessions. And now we have people arguing that Google should de-incognito incognito sessions to their analytics properties. Crazy stuff.
Medicalidiot 6y ago
"Secretly" is a misnomer.
dvduval 6y ago
I know that Google is making money through use of my personal data. I wish they would be required boldly state on every page that my personal data is being used, and that they are profiting from it. Finally, there should be some steps offered to remedy some of the above such as requesting that parts of the data that would be convenient for me to have deleted would be deleted. And the parts that are inconvenient such as my ability to login to sites I commonly visit could be preserved since that minimum requirements are met so I can easily access those sites. And while I have no big conspiracy theories at the moment about how Google is doing anything evil, there is certainly no guarantee that something in the future could impact me. For example there could be some bad players working inside Google, Google could be acquired, or the government could take control in some way. these are all things that could be dangerous to me in the future if Google continues to preserve large amounts of my personal information.
- criddell 6y ago
  Would this work for you: WARNING! We use your personal data to improve your experience using Google products. We believe this will lead you using the service more often and, in doing so, see more ads which we profit from.
  - monadic2 6y ago
    Hah as if it did improve the service compared to listening to basic product feedback. YouTube recommendations alone seem to cause people to lose hair, and that’s not even touching ads. But what am I talking about! Google KNOWS scale, I’m sure it’ll come together eventually.
  - mtgx 6y ago
    But that's the thing. Through better tracking, they usually just improve the targeting for advertisers - improving the product itself is almost an afterthought compared to that objective. To "improve the product" you don't need more than a few thousand session recordings of how people use your product.
  - riazrizvi 6y ago
    ... and to help funnel investments into promising web properties giving us an insurmountable competitive edge in search. While we could use this as an unfair advantage in any takeover talk, we have a motto and a friendly logo which clearly signal our benign intentions. Side note, we are spinning out Google into a separate entity, because we are growing so big. The new conglomerate is called Alphabet. It's just a silly accounting action, nothing to see here.
barking 6y ago
They'll be dancing in the streets of Redmond tonight!
ve55 6y ago
“We strongly dispute these claims and we will defend ourselves vigorously against them,” Castaneda said in an email. I wonder what it is they actually dispute, when the claims are so basic? Most popular websites use GA, so of course Google is watching every single user action across the Internet, regardless of if they have tried to 'opt out' via any methods, laws, processed, etc.
- dahfizz 6y ago
  Obviously this article is written for the general public and not in legalese. But this line gives a hint: > The suit includes claims for invasion of privacy and violations of federal wiretapping law. The claims Google disputes is that they are breaking the law. > I wonder what it is they actually dispute, when the claims are so basic. The claims can be summarized basically, but proving that someone has broken the law in court is not basic. This basic overview of federal wiretapping laws is over 70 pages[1]. Laws are filled with specific minutia. Here is another good overview of privacy law[2]. Even though the statement "Google violated my privacy" seems simple and self evident, to prove it in a court of law there are tons of very specific criteria you have to prove. [1] https://epic.org/privacy/wiretap/98-326.pdf https://epic.org/privacy/wiretap/98-326.pdf [2] https://www.stimmel-law.com/en/articles/legal-right-privacy https://www.stimmel-law.com/en/articles/legal-right-privacy
  - ve55 6y ago
    Great response, thanks. The US is definitely a more difficult environment to prove that their privacy violations are not just violations of privacy, but also of law. I wonder if these wiretapping laws are really the best route to go about attempting to prove this.
- kinkrtyavimoodh 6y ago
  The claims are basic, the conclusions are ridiculous. The lawsuit is on the conclusions, which probably won't even fly, but some trolls managed to get their course-project-level PDF read by millions.
bryanmgreen 6y ago
Here's a non-paywall article about the matter: https://www.reuters.com/article/us-alphabet-google-privacy-lawsuit/google-faces-5-billion-lawsuit-in-us-for-tracking-private-internet-use-idUSKBN23933H https://www.reuters.com/article/us-alphabet-google-privacy-l... I think it's worth noting the class-action lawsuit is asking for at least $5 Billion I'll also encourage the use of DuckDuckGo.com for your search and [1] uBlock Origin, [2] Searchonymous (it prevents google from tracking your searches if you're logged in to an account), and [3] Google Search Link fixer (removes link tracking from Google Search links) in Firefox, but would happily update if anyone has better recommendations. [1] https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... [2] https://addons.mozilla.org/en-US/firefox/addon/searchonymous/ https://addons.mozilla.org/en-US/firefox/addon/searchonymous... [3] https://addons.mozilla.org/en-US/firefox/addon/google-search-link-fix/ https://addons.mozilla.org/en-US/firefox/addon/google-search...
dr_kiszonka 6y ago
(Disclaimer: I have a big personal gripe with Google, but I don't hate the company in general) Something has been on mind for a while. I see lawsuits against Google collecting / selling personal data and ideas to combat its monopoly in search. What I don't see is a discussion about regulating companies that have data on the majority of the population. I know for a fact that Google used search insights to inform strategy. By knowing what people search for and modeling our behavior, they have an unprecedented ability to forecast future events. I expect that Facebook and other, lesser-known companies do the same. I believe it is dangerous for a company to have this ability. I am not an expert in public policy and politics. Would it make sense to have regulatory oversight over all companies that have data on, e.g., over 50% of a country's population?
- ErikAugust 6y ago
  "By knowing what people search for and modeling our behavior, they have unprecedented ability to forecast future events. I expect Facebook and other, lesser known companies do the same. I believe it is dangerous for a company to have this ability." I have thought of this as "search-based front-running". How much of it goes on, I would like to know.
  - itsspring 6y ago
    > they have unprecedented ability to forecast future events. Per Matt Levine's "anything can be securities fraud if you don't tell your shareholders about it", then having the "unprecedented ability to forecast future events" and not informing your shareholders about it could be argued as securities fraud in court. Something to think about.
  - caseysoftware 6y ago
    One of my favorite articles on that front is where two Capital One fraud analysts used internal purchase data to invest in consumer-oriented brands. Yes, it became insider trading: https://www.reuters.com/article/us-sec-capitalone-insidertrading-idUSKCN0UR2KR20160114 https://www.reuters.com/article/us-sec-capitalone-insidertra... Key quote: The Huangs, who are not related, began with a $147,000 investment and together made more than $2.8 million from the trades, a three-year return of 1,819 percent, the SEC said.
deleted 6y ago
[deleted]
nojito 6y ago
This not from incognito that’s just one piece. It’s against the practice of fingerprinting users across products and services.
- summerlight 6y ago
  I don't think Google is doing fingerprint (at least for Ads AFAIK, but there's not much reasons to do so in other products) and Chrome blocks fingerprinting in order to make Facebook and other competitors' life harder.
ipython 6y ago
How poetic. This lawsuit brought to you by Boies Schiller, the law firm that aggressively intimidated Theranos whistleblowers. I would argue that their actions contributed to the suicide of Ian Gibbons, as well as threatening his widow with legal action after his death.
- ciarannolan 6y ago
  >I would argue that their actions contributed to the suicide of Ian Gibbons [...] Anyone who has read Bad Blood [1] should have no doubt about this fact. They destroyed this man and lead him to suicide in order to try to save their house of cards. [1] https://www.amazon.com/Bad-Blood-Secrets-Silicon-Startup/dp/152473165X https://www.amazon.com/Bad-Blood-Secrets-Silicon-Startup/dp/...
  - qchris 6y ago
    I finally got around to reading it recently, and I think that aspect of the entire saga was the most startling. Not the fraud, not Holmes' ability to spin to the public and her board, not the work culture that she and Sunny Balwani created for their employees, but the severity and frequency of the real and implied legal threats Theranos employed through Boies Schiller and associates on literally everyone that touched the company.
    - ciarannolan 6y ago
      The way they tried to bully Tyler Shultz [1] was also fascinating. I was impressed by his ability to resist them. I think his parents mortgaged their home to aid in his legal defense. He tried to warn his grandfather, a member of the board, that something was wrong at Theranos. His grandfather said "Tyler, they can't convince me that you're stupid, but they _can_ convince me that you're wrong." His grandson turned out to be right. [1] https://en.wikipedia.org/wiki/George_P._Shultz#Theranos_scandal https://en.wikipedia.org/wiki/George_P._Shultz#Theranos_scan...
deleted 6y ago
[deleted]
thoraway1010 6y ago
This is a secret?
fred_is_fred 6y ago
Secretly? Isn't this effectively the entire point of their business?
diablo1 6y ago
Google is just a digital Eye-of-Sauron[0] and very difficult to avoid if you do any meaningful surfing of the open web. They have their fingers in many different pies. There is even small subcultures on the web dedicated to avoiding Google by doing things like running 'degoogled chromium' and blacklisting various Google domains in their /etc/hosts file. Sadly all these mitigations don't work because Google already has a dossier on many people and even if you don't have a Google account, Google keeps tabs on you via fingerprinting or other means and knows who 'you' really are (using simple correlation and heuristics). Then this raises the issue of: what can be done? I prefer to just be nihilistic about it and accept that Google already has dirt on me, despite my mitigations (I have a bit of history blindly handing over personal data to Google for a number of years). I think young people these days in 2020 have a great opportunity to implement mitigations and are better suited than me to browse privately, since I'm already contaminated by Google. (I still mitigate however, but it's not enough). [0] https://lotr.fandom.com/wiki/Eye_of_Sauron https://lotr.fandom.com/wiki/Eye_of_Sauron
noncoml 6y ago
And yet these guys can't figure out that I don't have babies so they keep showing me ads for diapers. I guess it doesn't make a difference to them, as long as they get the ad revenue from Pampers
- v7p1Qbt1im 6y ago
  My profile is also ridiculously inaccurate. Though I do use ublock origin, privacy badger, etc and disabled most tracking features in my google account. Also on VPN pretty much all the time. I‘d really like to see the ad profile of someone who is completely transparent and doesn‘t spend any effort to obfuscate at all. I‘d imagine it would be much more accurate. Interestingly my instagram ads are incredibly on point a lot of the time. You cant really hide your behavior in the app so the get a really good picture, probably.
dang 6y ago
This was discussed yesterday here: https://news.ycombinator.com/item?id=23397045 https://news.ycombinator.com/item?id=23397045.
neonate 6y ago
https://archive.md/fsE8w https://archive.md/fsE8w
metroholografix 6y ago
Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private https://github.com/atomontage/chrome-private
- chubot 6y ago
  That's pretty cool ... I'm left wondering what a visualization of the state accumulated by visiting different websites would look like, e.g. google, twitter, nytimes, etc.
- tantalor 6y ago
  So you're the one messing up my sessions analysis :p
- thinkloop 6y ago
  Interesting. Why disable gpu? > Disables 3D APIs / WebGL, GPU acceleration by default while allowing them to be re-enabled through command-line switches.
  - StrangeDoctor 6y ago
    Not OP, WebGL is a fast path to direct hardware execution and kernel space execution. It’s difficult to patch when things go wrong often requiring driver or kernel coordination. There might be issues with cross site memory leaking, but I’ve only seen white papers on how this might be an issue.
    - nitrogen 6y ago
      It's also used for fingerprinting, because there are a lot of different GPU configurations with slightly different reported features and slightly different e.g. rounding, dithering, antialiasing, and other rendering behaviors.
  - rasz 6y ago
shock 6y ago
> “We strongly dispute these claims and we will defend ourselves vigorously against them,” Castaneda said in an email. I've seen this _exact_ phrasing so many times in responses to lawsuits that I'm now starting to wonder if future lawyers receive this template as a graduation fair well package.
- judge2020 6y ago
  Saying anything else would hurt their case.
- wegs 6y ago
  Lawyers generally copy each other. There is standard text which has gone through hundreds or thousands of litigations and hasn't done harm, and that's almost always used going forward. A lot of oddball conventions, such as THE USE OF ALL-CAPS in specific places, which have no reason to be legally meaningful, but are always done. Some of them do turn out to be important. Standard clauses build up over time. I think plaintiffs are right in this case. Google is openly breaking a number of laws, including CFAA. This constitutes unauthorized access. CFAA is a broken law with an overly-broad definition of unauthorized access, which the tech industry abuses all the time. It will be nice to see them get abused back. Perhaps they'll have incentive to fix it.
bawolff 6y ago
"Secretly"
neil_s 6y ago
Unless Google associates your anonymous browsing data from incognito mode, with your regular browsing data from regular mode, I don't see a case here. And I really doubt they do that, it would be such a clear and egregious violation of the reasonable expectation of privacy. The other possible complaint could be that websites still can collect information on user behavior on the website, even if it is more anonymous in incognito mode. This is expressly what incognito mode says on the tin. You can use it to avoid saving your weird porn history locally, but not prevent websites from knowing what anonymous visitors are doing on their website. If the average consumer isn't tech-savvy enough to get this distinction, I'm not sure what Google could do besides putting this explicit warning in every new tab. Summary: seems like this case will go nowhere, but still makes for soundbitey headlines and gives people an excuse to rehash their usual gripes that "my data is the next oil" (IIUC, most ad targeting is still based on you explicitly searching for something you want to buy and ads matching those keywords, or retargeting from a website you've already visited but abandoned your shopping cart at, not some all-knowing profile of your deepest wants and desires). Disclaimer: I work at Google but nowhere near the Analytics or Ads teams.
smithza 6y ago
What are people's opinions on Brave Browser[0]? 0. https://brave.com/ https://brave.com/
user00012-ab 6y ago
> Google surreptitiously amasses billions of bits of information --every day -- about internet users even if they opt out of sharing their information, three consumers alleged in a proposed class action lawsuit. a billion bits is only like 130Meg a day, seems like google is doing pretty good.

383 points by spac 6y ago

I have a personal gmail and a work gmail (G Suite), each using my full name, but both run in separate browsers using the same IP address. I always wonder if Google keeps a "master record" of people and all their associations, if not for security or to work with law enforcement.

Romanulus 6y ago
Probably. I recall Project Veritas showing hidden video of a Twitter dev speaking about databases that link all profiles of someone (using things like IPs, fingerprints, etc. to stitch the relationships together).
- s3r3nity 6y ago
  You're probably getting downvoted for discussing Project Veritas (which is a silly reason for downvoting IMO) but your point is still accurate: these companies are defnitely running models to create probabilistic identity models in the absence of deterministic associations. Deterministic = I specifically say I'm person X and am logged-in. Probabilistic = I am not logged-in on this browser, but am on the same computer, same IP, and am logged-in on a separate browser at the exact same time under name X. Therefore I'm very likely person X.
  - ehsankia 6y ago
    It's not silly. A source that has been often shown to fabricate evidence and post straight up lies doesn't belong on HN. Many of their videos, including the "undercover interviews" with Twitter and Google have all been shown to have been edited/cut to completely change what the person was talking about or trying to say. Nothing coming from PV can ever again be taken with a single grain of salt.
- scohesc 6y ago
  I really hate changing the topic here, but I feel it has to be said sometimes. It's _very_ frustrating when people immediately discredit someone or something because they don't agree with them, even if they don't have the full story. Project Veritas does some good work, even if they're blasted in popular culture/mainstream media for being 'biased', 'alt-right', 'etc'. I bet you the downvotes you're getting are just because you mentioned Project Veritas. They have some very out-landish views, but when they actually put people on the street or go undercover, they've revealed dirt on a lot of companies and people. It's shocking to me to see society go from "let's look at ALL sides of the coin, no matter how egregiously offensive they are to me" to "fuck 'em, they're trash media, they suck, they shill and are racist, alt-right losers and I'm not going to look at anything they post because in my mind everything they do is bad!" I don't even go to Project Veritas outside of what I hear in the media, but I still give it a fair look and make my own opinion.
  - pphysch 6y ago
    Come now. The issue isn't that Veritas is "biased", it's that they have been caught time and time again fabricating evidence. We can talk about tech surveillance without playing into the modern fascist agenda.
  - ehsankia 6y ago
    I'm sorry but no. I'm all for looking at all sides, but Project Veritas is not that. They have done extremely shady things such as intentionally sending a fake victim to WP [0], as well as editing/slicing sentences (which they recorded without consent) to create an entirely different narrative, different from what the person was originally trying to convey [1]. Even a single one of these incidents is enough to completely throw every thing you've done and said into doubt, let alone the half a dozen that PV has behind it. There is absolutely no way you can take anything they say or do serious after they've been caught times and times again lying and misleading. It has absolutely nothing to do with how outlanding their views are, and everything to do with the fact that what they say or do cannot be trusted. I used to in the beginning, but they are way past being given a "fair look". [0] https://www.bbc.com/news/world-us-canada-42150322 https://www.bbc.com/news/world-us-canada-42150322 [1] https://www.theverge.com/interface/2019/6/27/18760463/project-veritas-youtube-sting-james-okeefe https://www.theverge.com/interface/2019/6/27/18760463/projec...
logicslave 6y ago
Definitely. They have logic that links data sets, all it takes is one slip up for them to know youre the same person, probably with levels of probability about whether you are the same person.
s3r3nity 6y ago
>...the same IP address. In my experience in adtech, not only can Google do this pretty accurately, but other third parties as well (e.g. DMPs and the like.) Even if they couldn't make a deterministic association, they have enough data points to make a probabilistic association with high likelihood (ex: "Given all these data points, we're 95% confident that these two people are the same. Therefore we're going to attribute the actions to the same person.") Now, to qualify my response a bit, this isn't necessarily for security / law enforcement, but mainly for better targeting parameters. Example: frequency capping of ads (buyer specifies that you only see an ad X number of times in a given time period) or more relevant targeting (you don't see completely different ads in different browsers as if you're from two non-overlapping demographic groups.)
caymanjim 6y ago
Facebook does this to build shadow profiles of everyone, even if they are not Facebook users. I'm sure Google does similar things. They certainly could.
- junon 6y ago
  The thing is, doing this is actually quite trivial. Graph databases are used in large part for this very usecase.
summerlight 6y ago
IMO, that doesn't make a good trade off. The identity problem space is already super complicated due to ITP while the risk is very high. If you make mistakes, you will accidentally leak personal information to others while the benefits... are pretty minimal, probably having 1~2% more revenue from those people with dual accounts. Given that joining signed-in and signed-out identity is explicitly prohibited as a condition of Double Click acquisition, I doubt if there's any incentive to do this kind of joining for Google.

foota 6y ago

This lawsuit is idiotic. They're claiming Google is doing something wrong by tracking users from websites using ad tech when someone uses their browsers private browsing mode.

Veen 6y ago
It's not so idiotic. Google collects information that people don't want them to collect. That arguably objectionable, even if it's not strictly illegal. It will be interesting to see whether this case gets a sympathetic judge, but I imagine it will end up being dismissed like previous lawsuits of this variety. Nice bit of publicity for the law firm though.
- lern_too_spel 6y ago
  Every website does.
  - paulryanrogers 6y ago
    Not every website controls: the browser, analytics service across large part of the web, and sometimes the OS (Android/ChromeOS)
    - lern_too_spel 6y ago
      Your proposal is for Google to abuse its monopoly positions to provide a better privacy experience for its properties than for others?
      - paulryanrogers 6y ago
        Not my proposal. Regardless, a case is being made that Google is in a position to ensure its analytics services comply with the GDPR when a browser has been put into a mode clearly intended to opt out of tracking. Other websites or services may be able to say they can't control how those browsers in such modes communicate that intent. Google cannot.

simonw 6y ago

"According to the suit, the company collects information, including IP addresses and browsing histories, whenever users visit web pages or use an app tied to common Google services, such as Google Analytics and Google Ad Manager." I'd really appreciate some more technical details here. Does this include web server logs that record incoming IP addresses? Is the expectation here that Chrome would set a DNT header in incognito mode and Google properties would then obey that header?

t0mas88 6y ago
Server logs with IP addresses are acceptable to most European privacy regulators if you only use them for a technical purpose such as debugging. And not keep them longer than needed for that. So practically: logs are fine, delete them after a while. If you store the same information in a permanent database and use it for analysis you're in trouble and should have asked permission. The fact that the user uses a private window or other means to indicates they don't want to be tracked probably makes this a more clear case.
- oefrha 6y ago
  > The fact that the user uses a private window or other means to indicates they don't want to be tracked probably makes this a more clear case. That’s a very confusing statement. My server logs don’t filter incoming log entries based on user agent, and certainly not on whether you’re using a “private window” or not. In addition, the goal of a private/incognito session is to be indistinguishable from regular sessions, otherwise websites can easily discriminate against private sessions (which they’re already trying as hard as they could). Edit: Wow the number of people on this thread claiming websites should be able to opt people out of logging based on whether they’re using a “private window” (which websites should have absolutely no idea about) makes me question if I’m even on Hacker News. Edit 2: Chrome sends an X-Client-Data header (which in a sense includes an installation ID, but allegedly has limited entropy) to certain Google properties, and rightfully got a lot of flak for it. It does not do so for incognito sessions. And now we have people arguing that Google should de-incognito incognito sessions to their analytics properties. Crazy stuff.

Medicalidiot 6y ago

"Secretly" is a misnomer.

dvduval 6y ago

I know that Google is making money through use of my personal data. I wish they would be required boldly state on every page that my personal data is being used, and that they are profiting from it. Finally, there should be some steps offered to remedy some of the above such as requesting that parts of the data that would be convenient for me to have deleted would be deleted. And the parts that are inconvenient such as my ability to login to sites I commonly visit could be preserved since that minimum requirements are met so I can easily access those sites. And while I have no big conspiracy theories at the moment about how Google is doing anything evil, there is certainly no guarantee that something in the future could impact me. For example there could be some bad players working inside Google, Google could be acquired, or the government could take control in some way. these are all things that could be dangerous to me in the future if Google continues to preserve large amounts of my personal information.

criddell 6y ago
Would this work for you: WARNING! We use your personal data to improve your experience using Google products. We believe this will lead you using the service more often and, in doing so, see more ads which we profit from.
- monadic2 6y ago
  Hah as if it did improve the service compared to listening to basic product feedback. YouTube recommendations alone seem to cause people to lose hair, and that’s not even touching ads. But what am I talking about! Google KNOWS scale, I’m sure it’ll come together eventually.
- mtgx 6y ago
  But that's the thing. Through better tracking, they usually just improve the targeting for advertisers - improving the product itself is almost an afterthought compared to that objective. To "improve the product" you don't need more than a few thousand session recordings of how people use your product.
- riazrizvi 6y ago
  ... and to help funnel investments into promising web properties giving us an insurmountable competitive edge in search. While we could use this as an unfair advantage in any takeover talk, we have a motto and a friendly logo which clearly signal our benign intentions. Side note, we are spinning out Google into a separate entity, because we are growing so big. The new conglomerate is called Alphabet. It's just a silly accounting action, nothing to see here.

barking 6y ago

They'll be dancing in the streets of Redmond tonight!

ve55 6y ago

“We strongly dispute these claims and we will defend ourselves vigorously against them,” Castaneda said in an email. I wonder what it is they actually dispute, when the claims are so basic? Most popular websites use GA, so of course Google is watching every single user action across the Internet, regardless of if they have tried to 'opt out' via any methods, laws, processed, etc.

dahfizz 6y ago
Obviously this article is written for the general public and not in legalese. But this line gives a hint: > The suit includes claims for invasion of privacy and violations of federal wiretapping law. The claims Google disputes is that they are breaking the law. > I wonder what it is they actually dispute, when the claims are so basic. The claims can be summarized basically, but proving that someone has broken the law in court is not basic. This basic overview of federal wiretapping laws is over 70 pages[1]. Laws are filled with specific minutia. Here is another good overview of privacy law[2]. Even though the statement "Google violated my privacy" seems simple and self evident, to prove it in a court of law there are tons of very specific criteria you have to prove. [1] https://epic.org/privacy/wiretap/98-326.pdf https://epic.org/privacy/wiretap/98-326.pdf [2] https://www.stimmel-law.com/en/articles/legal-right-privacy https://www.stimmel-law.com/en/articles/legal-right-privacy
- ve55 6y ago
  Great response, thanks. The US is definitely a more difficult environment to prove that their privacy violations are not just violations of privacy, but also of law. I wonder if these wiretapping laws are really the best route to go about attempting to prove this.
kinkrtyavimoodh 6y ago
The claims are basic, the conclusions are ridiculous. The lawsuit is on the conclusions, which probably won't even fly, but some trolls managed to get their course-project-level PDF read by millions.

bryanmgreen 6y ago

Here's a non-paywall article about the matter: https://www.reuters.com/article/us-alphabet-google-privacy-lawsuit/google-faces-5-billion-lawsuit-in-us-for-tracking-private-internet-use-idUSKBN23933H https://www.reuters.com/article/us-alphabet-google-privacy-l... I think it's worth noting the class-action lawsuit is asking for at least $5 Billion I'll also encourage the use of DuckDuckGo.com for your search and [1] uBlock Origin, [2] Searchonymous (it prevents google from tracking your searches if you're logged in to an account), and [3] Google Search Link fixer (removes link tracking from Google Search links) in Firefox, but would happily update if anyone has better recommendations. [1] https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... [2] https://addons.mozilla.org/en-US/firefox/addon/searchonymous/ https://addons.mozilla.org/en-US/firefox/addon/searchonymous... [3] https://addons.mozilla.org/en-US/firefox/addon/google-search-link-fix/ https://addons.mozilla.org/en-US/firefox/addon/google-search...

dr_kiszonka 6y ago

(Disclaimer: I have a big personal gripe with Google, but I don't hate the company in general) Something has been on mind for a while. I see lawsuits against Google collecting / selling personal data and ideas to combat its monopoly in search. What I don't see is a discussion about regulating companies that have data on the majority of the population. I know for a fact that Google used search insights to inform strategy. By knowing what people search for and modeling our behavior, they have an unprecedented ability to forecast future events. I expect that Facebook and other, lesser-known companies do the same. I believe it is dangerous for a company to have this ability. I am not an expert in public policy and politics. Would it make sense to have regulatory oversight over all companies that have data on, e.g., over 50% of a country's population?

ErikAugust 6y ago
"By knowing what people search for and modeling our behavior, they have unprecedented ability to forecast future events. I expect Facebook and other, lesser known companies do the same. I believe it is dangerous for a company to have this ability." I have thought of this as "search-based front-running". How much of it goes on, I would like to know.
- itsspring 6y ago
  > they have unprecedented ability to forecast future events. Per Matt Levine's "anything can be securities fraud if you don't tell your shareholders about it", then having the "unprecedented ability to forecast future events" and not informing your shareholders about it could be argued as securities fraud in court. Something to think about.
- caseysoftware 6y ago
  One of my favorite articles on that front is where two Capital One fraud analysts used internal purchase data to invest in consumer-oriented brands. Yes, it became insider trading: https://www.reuters.com/article/us-sec-capitalone-insidertrading-idUSKCN0UR2KR20160114 https://www.reuters.com/article/us-sec-capitalone-insidertra... Key quote: The Huangs, who are not related, began with a $147,000 investment and together made more than $2.8 million from the trades, a three-year return of 1,819 percent, the SEC said.

deleted 6y ago

[deleted]

nojito 6y ago

This not from incognito that’s just one piece. It’s against the practice of fingerprinting users across products and services.

summerlight 6y ago
I don't think Google is doing fingerprint (at least for Ads AFAIK, but there's not much reasons to do so in other products) and Chrome blocks fingerprinting in order to make Facebook and other competitors' life harder.

ipython 6y ago

How poetic. This lawsuit brought to you by Boies Schiller, the law firm that aggressively intimidated Theranos whistleblowers. I would argue that their actions contributed to the suicide of Ian Gibbons, as well as threatening his widow with legal action after his death.

ciarannolan 6y ago
>I would argue that their actions contributed to the suicide of Ian Gibbons [...] Anyone who has read Bad Blood [1] should have no doubt about this fact. They destroyed this man and lead him to suicide in order to try to save their house of cards. [1] https://www.amazon.com/Bad-Blood-Secrets-Silicon-Startup/dp/152473165X https://www.amazon.com/Bad-Blood-Secrets-Silicon-Startup/dp/...
- qchris 6y ago
  I finally got around to reading it recently, and I think that aspect of the entire saga was the most startling. Not the fraud, not Holmes' ability to spin to the public and her board, not the work culture that she and Sunny Balwani created for their employees, but the severity and frequency of the real and implied legal threats Theranos employed through Boies Schiller and associates on literally everyone that touched the company.
  - ciarannolan 6y ago
    The way they tried to bully Tyler Shultz [1] was also fascinating. I was impressed by his ability to resist them. I think his parents mortgaged their home to aid in his legal defense. He tried to warn his grandfather, a member of the board, that something was wrong at Theranos. His grandfather said "Tyler, they can't convince me that you're stupid, but they _can_ convince me that you're wrong." His grandson turned out to be right. [1] https://en.wikipedia.org/wiki/George_P._Shultz#Theranos_scandal https://en.wikipedia.org/wiki/George_P._Shultz#Theranos_scan...

deleted 6y ago

[deleted]

thoraway1010 6y ago

This is a secret?

fred_is_fred 6y ago

Secretly? Isn't this effectively the entire point of their business?

diablo1 6y ago

Google is just a digital Eye-of-Sauron[0] and very difficult to avoid if you do any meaningful surfing of the open web. They have their fingers in many different pies. There is even small subcultures on the web dedicated to avoiding Google by doing things like running 'degoogled chromium' and blacklisting various Google domains in their /etc/hosts file. Sadly all these mitigations don't work because Google already has a dossier on many people and even if you don't have a Google account, Google keeps tabs on you via fingerprinting or other means and knows who 'you' really are (using simple correlation and heuristics). Then this raises the issue of: what can be done? I prefer to just be nihilistic about it and accept that Google already has dirt on me, despite my mitigations (I have a bit of history blindly handing over personal data to Google for a number of years). I think young people these days in 2020 have a great opportunity to implement mitigations and are better suited than me to browse privately, since I'm already contaminated by Google. (I still mitigate however, but it's not enough). [0] https://lotr.fandom.com/wiki/Eye_of_Sauron https://lotr.fandom.com/wiki/Eye_of_Sauron

noncoml 6y ago

And yet these guys can't figure out that I don't have babies so they keep showing me ads for diapers. I guess it doesn't make a difference to them, as long as they get the ad revenue from Pampers

v7p1Qbt1im 6y ago
My profile is also ridiculously inaccurate. Though I do use ublock origin, privacy badger, etc and disabled most tracking features in my google account. Also on VPN pretty much all the time. I‘d really like to see the ad profile of someone who is completely transparent and doesn‘t spend any effort to obfuscate at all. I‘d imagine it would be much more accurate. Interestingly my instagram ads are incredibly on point a lot of the time. You cant really hide your behavior in the app so the get a really good picture, probably.

dang 6y ago

This was discussed yesterday here: https://news.ycombinator.com/item?id=23397045 https://news.ycombinator.com/item?id=23397045.

neonate 6y ago

https://archive.md/fsE8w https://archive.md/fsE8w

metroholografix 6y ago

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private https://github.com/atomontage/chrome-private

chubot 6y ago
That's pretty cool ... I'm left wondering what a visualization of the state accumulated by visiting different websites would look like, e.g. google, twitter, nytimes, etc.
tantalor 6y ago
So you're the one messing up my sessions analysis :p
thinkloop 6y ago
Interesting. Why disable gpu? > Disables 3D APIs / WebGL, GPU acceleration by default while allowing them to be re-enabled through command-line switches.
- StrangeDoctor 6y ago
  Not OP, WebGL is a fast path to direct hardware execution and kernel space execution. It’s difficult to patch when things go wrong often requiring driver or kernel coordination. There might be issues with cross site memory leaking, but I’ve only seen white papers on how this might be an issue.
  - nitrogen 6y ago
    It's also used for fingerprinting, because there are a lot of different GPU configurations with slightly different reported features and slightly different e.g. rounding, dithering, antialiasing, and other rendering behaviors.
- rasz 6y ago

shock 6y ago

> “We strongly dispute these claims and we will defend ourselves vigorously against them,” Castaneda said in an email. I've seen this _exact_ phrasing so many times in responses to lawsuits that I'm now starting to wonder if future lawyers receive this template as a graduation fair well package.

judge2020 6y ago
Saying anything else would hurt their case.
wegs 6y ago
Lawyers generally copy each other. There is standard text which has gone through hundreds or thousands of litigations and hasn't done harm, and that's almost always used going forward. A lot of oddball conventions, such as THE USE OF ALL-CAPS in specific places, which have no reason to be legally meaningful, but are always done. Some of them do turn out to be important. Standard clauses build up over time. I think plaintiffs are right in this case. Google is openly breaking a number of laws, including CFAA. This constitutes unauthorized access. CFAA is a broken law with an overly-broad definition of unauthorized access, which the tech industry abuses all the time. It will be nice to see them get abused back. Perhaps they'll have incentive to fix it.

bawolff 6y ago

"Secretly"

neil_s 6y ago

Unless Google associates your anonymous browsing data from incognito mode, with your regular browsing data from regular mode, I don't see a case here. And I really doubt they do that, it would be such a clear and egregious violation of the reasonable expectation of privacy. The other possible complaint could be that websites still can collect information on user behavior on the website, even if it is more anonymous in incognito mode. This is expressly what incognito mode says on the tin. You can use it to avoid saving your weird porn history locally, but not prevent websites from knowing what anonymous visitors are doing on their website. If the average consumer isn't tech-savvy enough to get this distinction, I'm not sure what Google could do besides putting this explicit warning in every new tab. Summary: seems like this case will go nowhere, but still makes for soundbitey headlines and gives people an excuse to rehash their usual gripes that "my data is the next oil" (IIUC, most ad targeting is still based on you explicitly searching for something you want to buy and ads matching those keywords, or retargeting from a website you've already visited but abandoned your shopping cart at, not some all-knowing profile of your deepest wants and desires). Disclaimer: I work at Google but nowhere near the Analytics or Ads teams.

smithza 6y ago

What are people's opinions on Brave Browser[0]? 0. https://brave.com/ https://brave.com/

user00012-ab 6y ago

> Google surreptitiously amasses billions of bits of information --every day -- about internet users even if they opt out of sharing their information, three consumers alleged in a proposed class action lawsuit. a billion bits is only like 130Meg a day, seems like google is doing pretty good.