11 ms·

Google faces $5B lawsuit for tracking people in incognito mode

337 points by petercooper 6y ago

burnte 6y ago
The filer is suing because they logged into things like GMail and third party services while in incognito mode. If you wear a mask, but still have your nametag on, that's not the mask makers fault.
- lostmyoldone 6y ago
  If it was only third parties, then maybe. But if google analytics actually tracks data from a logged in incognito session, then it's probably a completely different in the eyes of the law. It becomes more like: The mask maker put the name tag on your shirt. The tag was also put on in the same booth where you bought the mask that promised anonymity, and it was also the mask maker who supplied the record of your tag number to a third party.
  - notatoad 6y ago
    >a logged in incognito session you cannot sign into chrome while incognito, so i'm not sure what you mean by a "logged in incognito session", that's not a thing. The only type of sign in available while in incognito mode is to sign into a website, and the website does not know that you're in incognito mode. And if you've entered your username and password into the google login form, of course they're tracking you, how could they not be?
    - hrktb 6y ago
      Incognito stills works with sessions, keeps cookies. Which means if you login to a google service, your whole session with all its tabs is logged in, and not just that single site. Not arguing this shouldn’t work that way, but the wording of logged in incognito session seems fair to me.
  - burnte 6y ago
    Except that's not what happened. The user put on the name tag. If you use a tool incorrectly, it's not the tool's fault.
jedieaston 6y ago
It'd be impossible for Google Analytics to not collect data from a incognito tab without it knowing that it is incognito somehow (like if Chrome attached a header to all outgoing requests that said incognito=1 or something). But then websites would know you are in incognito, and find some other way to track you without leaving cookies on your box (like logging the IP address for the request and merging all incognito requests into one profile, which would be accurate enough). What do they want Google to do? They warn you specifically of this anyway when you open an incognito tab: " You've gone incognito Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. Learn more... Chrome won't save the following information: Your browsing history Cookies and site data Information entered in forms Your activity might still be visible to: Websites you visit Your employer or school Your internet service provider "
- crescentfresh 6y ago
  > without it knowing that it is incognito somehow It has been a while since I was in js land but I do recall writing a browser extension that needed to know this, and in chrome it was made available to detect whether your script was running in incognito. It was a property of something. So I imagine as a starting point the Google Analytics client js could utilize this to avoid interacting with the analytics server altogether.
  - gene91 6y ago
    The ability by websites to detect incognito cause real usability pains for users. (For example, certain news outlets refuse to show content when it detects that you're in incognito.) The mechanisms to detect incognito were/are unintended holes. Both FireFox and Chrome have been plugging them.
  - ehsankia 6y ago
    Well your information is outdated, because there's been a long game of cat and mouse between chrome and sites likes NYT about detecting incognito, with every alternating version a new method coming up, and it being patched in the following version. [0] https://boingboing.net/2019/07/20/cookie-managers-r-us.html https://boingboing.net/2019/07/20/cookie-managers-r-us.html
brokencode 6y ago
Sure, they tell you websites could be doing it, but they don’t tell you that the one of the biggest websites in the world, from the same company that created the browser, is doing it. The fact that they even point that out means they know it’s an invasion of privacy (bad), but yet they do it anyway.
etaioinshrdlu 6y ago
Also, now that many people's connections are IPv6, the server can identify individual computers behind a router. Though your laptop's IPv6 may not be a permanent address, it lasts long enough to track you. If you're logged in to any web services on your computer, other web requests can then be correlated to non-authenticated requests from the same IP. I feel like IPv4 with NAT was an accidental privacy win. I think the solution for this is for operating systems to allow applications to request a fresh IP address, or something like that. Obviously that would be a highly difficult and disruptive change at multiple levels...
- theonewolf 6y ago
  One could run every tab / sub-process within a container with its own networking stack. It is complex, but doable.
- bradfitz 6y ago
  Speaking of which, you might be interested in this thread: https://twitter.com/bradfitz/status/1263643749592166400 https://twitter.com/bradfitz/status/1263643749592166400 Which resulted in this Chrome bug: https://bugs.chromium.org/p/chromium/issues/detail?id=1085662 https://bugs.chromium.org/p/chromium/issues/detail?id=108566...
- CarelessExpert 6y ago
  NAT only anonymizes folks behind that one router, and in a typical household that's down to just a couple of individuals. Combined with other hints (including browser fingerprinting), NAT provides very little privacy protection, especially given how long-lived the average IPv4 DHCP lease lasts. > I think the solution for this is for operating systems to allow applications to request a fresh IP address, or something like that. Obviously that would be a highly difficult and disruptive change at multiple levels... IPv6 already has this capability: https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad... That randomization occurs on a higher frequency than a typical DHCP lease expiration. For a home that has a /48, this is no better or worse than NAT, since you can still only track devices to the home. If your individual devices have their own IPs within the ISP address space, then the best an outsider could do is track devices to a given ISP subnet. Of course, again, the real threat is browser fingerprinting and similar technologies, which are entirely independent of the underlying network.
joeblow9999 6y ago
dont use chrome. anyone even marginally concerned about privacy should be using firfox or brave or tor browser.
- ehsankia 6y ago
  Is this not an issue with any private browsing mode? How is Chrome Incognito different from Firefox Private? If you login into Gmail on Firefox Private, you still get tracked, no?
  - shirshak55 6y ago
    from what i have heard they insert some headers or something like that. So this should be non issue for firefox private user.
    - kyazawa 6y ago
      The "X-Client-Data" Chrome header that I think you are referring to is not sent in Incognito mode according to this article: https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...
- monsieurgaufre 6y ago
  Firefox has demons of its own on this subject. Evangelism for it which basically is "it's not google" is getting more and more tired.
  - svachalek 6y ago
    This is false equivalence. The size and number of demons are relevant.
ikeyany 6y ago
The term "incognito" doesn't always mean "I can't be identified", but it looks like those are the grounds. I wouldn't be surprised if they get an inconsequential slap on the wrist.
- ehsankia 6y ago
  I'm curious, every other browser has a similar mode. Is the same thing not an issue in other browsers? Do analytics packages not track you in Firefox Private browsing? Do other non-Google analytics not track you in Chrome? What's specific to Google/Chrome here that's not true with every other browser/analytics platform?
  - a3n 6y ago
    Incentive.
  - ikeyany 6y ago
    I imagine anyone who tries to brand it as "I can't be identified" might be sued too. Who knows how successful they will be. I doubt it would be worth the effort for browsers that don't have a huge market share. For example, a suit against Opera would be ineffective in the grand scheme...as most aren't aware of its existence.
    - ehsankia 6y ago
      Where is the "can't be identified" line come from? The branding is, word for word: > Now you can browse privately, and other people who use this device won't see your activity and > Your activity might still be visible to: Websites you visit Where does that piece of branding you mention come from? I don't see it anywhere? Did Google remove it recently? Or is it just what people, through the telephone game, have come to think it means?
mseidl 6y ago
I use chrome and I notice things that, for example I'll watch a youtube video in incognito mode then, shortly thereafter like, like some minutes. Those things I searched for in incognito mode show up as recommendations in regular browsing.
- jjtheblunt 6y ago
  Might that be based on the common IP address seen (yours) being remembered on the server side (Google's)?
- andor 6y ago
  Cookies are still stored and shared among other Incognito tabs. This makes Incognito more usable: you can login to an online store, open a few product pages in new tabs, add items to your cart from all these tabs and check out in the end. If each tab had its own cookie store, they'd have separate carts as well. AFAIK, you need to close all Incognito tabs for the session to end.
random3 6y ago
https://www.google.com/chrome/privacy https://www.google.com/chrome/privacy Incognito mode and guest mode You can limit the information Chrome stores on your system by using incognito mode or guest mode. In these modes, Chrome won't store certain information, such as: * Basic browsing history information like URLs, cached page text, or IP addresses of pages linked from the websites you visit * Snap shots of pages that you visit * Records of your downloads, although the files you download will still be stored elsewhere on your computer or device
- ping_pong 6y ago
  Does Chrome really take snap shots of the pages that I visit?
  - jedieaston 6y ago
    I think it does to put them on the new tab page, at least.
a3n 6y ago
> "As we clearly state each time you open a new incognito tab, websites might be able to collect information about your browsing activity during your session." And we're happy to facilitate that.
parhamn 6y ago
Can any lawyer comment on the fact that this is the same group from the Uber v Waymo trials? I’m curious how this sort of thing works. Grudges? An Achilies heel you found? Is it common for a firm to hit again with something unrelated? I’m fine with it either way, just curious.
williesleg 6y ago
Nice! Can't wait to get my $2 coupon for the Google play store!
dehrmann 6y ago
With how the web works, the degree of privacy the plaintiffs are asking for isn't technically feasible without also advertising that you're in incognito mode.
- jackcosgrove 6y ago
  I'm willing to trade paywalls for privacy. And paywalls are easy to get around, too, in this context. Just use a non-incognito tab to browse those sites.
cfitz 6y ago
According to their history of Terms of Service changes, it appears that they made changes to the language surrounding information collected while "private browsing" between September 1, 2015 and June 21, 2016. Just do a Cmd+F or Ctrl+F for "snap" (part of snapshot/snap shots; they do not spell it consistently). In that case, it's been in their terms since 2016. I do not agree with this practice nor do I condone it, but who is ultimately "in the wrong here"? Is it Google or is it the users, the latter of whom are supposed to read these Terms prior to agreeing to them? Are "Terms" too long these days? I can't imagine most people have the time to read through all - if not any - of the Terms of Service (etc.) for all products and services they're utilizing in their life.
- grawprog 6y ago
  The idea that companies can dictate terms that can be arbitrarily changed at whim where the only consent users need to give is the continued use of their product is pretty ludicrous as far as I'm concerned. I realize people should read terms and I do tend to, but often companies will make their policy changes obscure, they intentionally downplay when the make changes to terms. If i enter into a contract with someone, specific permission is required from both parties on any changes. I personally don't understand how these terms of services, which are effectively contracts, get out of following contract law. If I agree to a terms of service, I an agreeing to a contract set out by that business at that time. Refusing to allow service for not agreeing to later changes put out by the service provider is illegal in any other form of business contract. I can't write a contract for some consulting work, get a customer to sign it, change the terms then refuse to hand over my completed work until they agree. I'd be taken to court.
  - deleted 6y ago
    [deleted]
  - korethr 6y ago
    IIRC, Terms of Service usually have a clause with language that states that the provider of the service may change the terms of the contract at any time without prior notice. If the user doesn't like the new terms, they can quit using the service. Take-it-or-leave-it changes contracts are a thing in negotiated contracts between businesses as well. But rather than taking effect immediately, they'll happen when the contract is up for renewal. As an example, an employer of mine used to have a software product offered for on-prem self-hosted use, or as a hosted service. Then, they decided to stop offering the self-hosted option and to only offer the software as a hosted service to reduce development and support costs of having to support the myriad configurations that come of a number of customers running their own on-prem setups. Customers had the option of converting to the hosted service option, or taking their business elsewhere. And so, when their existing on-prem contracts were up for renewal, those customers made the choice to find another solution, or convert to the hosted service. So, IMO, these ToSes are following contract law. It just sucks that the contracts are so one-sided and the consumers of services offered really don't have an easy means of negotiating the terms to something better for themselves.
treebornfrog 6y ago
As far as I know FB also does this. They create 'shadow profiles' around users who are not signed up to FB too. https://www.cnet.com/news/shadow-profiles-facebook-has-information-you-didnt-hand-over/ https://www.cnet.com/news/shadow-profiles-facebook-has-infor...
jka 6y ago
Bloomberg Law has a copy of the docket filing here: https://www.bloomberglaw.com/public/desktop/document/BrownetalvGoogleLLCetalDocketNo520cv03664NDCalJun022020CourtDocke?1591132864# https://www.bloomberglaw.com/public/desktop/document/Brownet...
rogerdickey 6y ago
Google faces $5B shakedown for allowing JS to work in incognito mode
- akersten 6y ago
  For real. Many of the anti-Google comments here are injecting their own fantasies for what this lawsuit could be about, celebrating it as some kind of victory towards user privacy - which, to be fair, is a discussion that needs to be had - but this lawsuit isn't that. This lawsuit is literally "I think incognito mode should specifically stop Google Analytics, a website feature, from tracking me" even though the first thing you see when you open an incognito window is that "this doesn't stop websites from tracking you." What do they want Google to do, lean in further towards monopolistic abuse and give Chrome Incognito special treatment when its users are on a site using Google Analytics?
  - deleted 6y ago
    [deleted]
- Apes 6y ago
  What is with this consistent gas lighting? These articles mention Chrome Incognito, and the laser focus gas lighting is consistently that "of course you can be tracked in Chrome Incognito, why are these people SO STUPID?" This has nothing to do with the fact that you can theoretically track users in Incognito mode. You could be using Firefox Privacy mode, and the problem would be exactly the same. It's that Google's services are tracking users who are clearly indicating they don't want to be tracked. If Google built their whole company around relying on bad faith encounters with their customers, and it's going to be painful for them to unwind, then boo-fucking-hoo. Do dumb shit, get dumb rewards.
  - judge2020 6y ago
    This is a problem with the article. "for tracking people in incognito mode" would almost certainly indicate that they claim incognito mode is an end-all for GA/Ads tracking, yet the actual case complains about (in broader terms of course): > To prevent information from being shared with Google, Google recommends that its consumers need only launch a browser such as Google Chrome, Safari, Microsoft Edge, or Firefox in “private browsing mode. Both statements are untrue. ” This type of comment is prevalent in this thread because neither this article nor the original article makes this distinction or goes into depth about what the lawsuit really targets. The average HN user doesn't have a pacer account or the patience to go searching through pacer, so we can only rely on news sites to provide good information (especially when they don't even upload the complaint to document cloud). complaint: https://i.judge.sh/specific/Sia/520-cv-03664-LHK-1-main.pdf https://i.judge.sh/specific/Sia/520-cv-03664-LHK-1-main.pdf
jedimastert 6y ago
I've seen several people mention the Do Not Track header, but it comes with a downside: it paints a giant target on your back. If, say, 5% of user agents have DNT enabled, then it's becomes extremely effective as a fingerprinting vector on the people who specifically don't want to be fingerprinted. If, on the other hand, a majority of people use it, then most people will simply ignore it or perish. This is mostly why people ignore it nowadays, because IE turned it on by default. No one uses it anymore because there's no reason to trust that it'll do anything and no reason to actually follow it.
- thelean12 6y ago
  To be clear, you can already detect if people are in incognito with JS (you can google it and find plenty of articles). So DNT doesn't seem to add much if someone cares enough about this variable.
deleted 6y ago
[deleted]
gcbw3 6y ago
The legislators will be delighted to learn how google's * reCaptcha * 8.8.8.8 et al DNS * google fonts hotlink * google JS cdn hotlink * etc etc store data and how that data is "anonymized" by random teams' arbitrary definitions, and used all over their ecosystem. I guarantee you at the very minimum reCatpcha contributes to some "isBot" or "hasGoogleAccount" attribute that is then used by Advertising systems. And that is assuming the best of the best of the best case scenario.
estebarb 6y ago
This lawsuit is absurd, and it should be rejected with a "please learn to use a computer before owning one". So, what is next? lawsuits against car companies because emergency lights didn't invoke emergency responders?
nova22033 6y ago
Boies Schiller & Flexner The law firm that help Harvey Weinstein smear his victims is going after a target with deep pockets... This is news?
dang 6y ago
https://news.ycombinator.com/item?id=23405022 https://news.ycombinator.com/item?id=23405022 https://news.ycombinator.com/item?id=23397045 https://news.ycombinator.com/item?id=23397045

337 points by petercooper 6y ago

The filer is suing because they logged into things like GMail and third party services while in incognito mode. If you wear a mask, but still have your nametag on, that's not the mask makers fault.

lostmyoldone 6y ago
If it was only third parties, then maybe. But if google analytics actually tracks data from a logged in incognito session, then it's probably a completely different in the eyes of the law. It becomes more like: The mask maker put the name tag on your shirt. The tag was also put on in the same booth where you bought the mask that promised anonymity, and it was also the mask maker who supplied the record of your tag number to a third party.
- notatoad 6y ago
  >a logged in incognito session you cannot sign into chrome while incognito, so i'm not sure what you mean by a "logged in incognito session", that's not a thing. The only type of sign in available while in incognito mode is to sign into a website, and the website does not know that you're in incognito mode. And if you've entered your username and password into the google login form, of course they're tracking you, how could they not be?
  - hrktb 6y ago
    Incognito stills works with sessions, keeps cookies. Which means if you login to a google service, your whole session with all its tabs is logged in, and not just that single site. Not arguing this shouldn’t work that way, but the wording of logged in incognito session seems fair to me.
- burnte 6y ago
  Except that's not what happened. The user put on the name tag. If you use a tool incorrectly, it's not the tool's fault.

jedieaston 6y ago

It'd be impossible for Google Analytics to not collect data from a incognito tab without it knowing that it is incognito somehow (like if Chrome attached a header to all outgoing requests that said incognito=1 or something). But then websites would know you are in incognito, and find some other way to track you without leaving cookies on your box (like logging the IP address for the request and merging all incognito requests into one profile, which would be accurate enough). What do they want Google to do? They warn you specifically of this anyway when you open an incognito tab: " You've gone incognito Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. Learn more... Chrome won't save the following information: Your browsing history Cookies and site data Information entered in forms Your activity might still be visible to: Websites you visit Your employer or school Your internet service provider "

crescentfresh 6y ago
> without it knowing that it is incognito somehow It has been a while since I was in js land but I do recall writing a browser extension that needed to know this, and in chrome it was made available to detect whether your script was running in incognito. It was a property of something. So I imagine as a starting point the Google Analytics client js could utilize this to avoid interacting with the analytics server altogether.
- gene91 6y ago
  The ability by websites to detect incognito cause real usability pains for users. (For example, certain news outlets refuse to show content when it detects that you're in incognito.) The mechanisms to detect incognito were/are unintended holes. Both FireFox and Chrome have been plugging them.
- ehsankia 6y ago
  Well your information is outdated, because there's been a long game of cat and mouse between chrome and sites likes NYT about detecting incognito, with every alternating version a new method coming up, and it being patched in the following version. [0] https://boingboing.net/2019/07/20/cookie-managers-r-us.html https://boingboing.net/2019/07/20/cookie-managers-r-us.html

brokencode 6y ago

Sure, they tell you websites could be doing it, but they don’t tell you that the one of the biggest websites in the world, from the same company that created the browser, is doing it. The fact that they even point that out means they know it’s an invasion of privacy (bad), but yet they do it anyway.

etaioinshrdlu 6y ago

Also, now that many people's connections are IPv6, the server can identify individual computers behind a router. Though your laptop's IPv6 may not be a permanent address, it lasts long enough to track you. If you're logged in to any web services on your computer, other web requests can then be correlated to non-authenticated requests from the same IP. I feel like IPv4 with NAT was an accidental privacy win. I think the solution for this is for operating systems to allow applications to request a fresh IP address, or something like that. Obviously that would be a highly difficult and disruptive change at multiple levels...

theonewolf 6y ago
One could run every tab / sub-process within a container with its own networking stack. It is complex, but doable.
bradfitz 6y ago
Speaking of which, you might be interested in this thread: https://twitter.com/bradfitz/status/1263643749592166400 https://twitter.com/bradfitz/status/1263643749592166400 Which resulted in this Chrome bug: https://bugs.chromium.org/p/chromium/issues/detail?id=1085662 https://bugs.chromium.org/p/chromium/issues/detail?id=108566...
CarelessExpert 6y ago
NAT only anonymizes folks behind that one router, and in a typical household that's down to just a couple of individuals. Combined with other hints (including browser fingerprinting), NAT provides very little privacy protection, especially given how long-lived the average IPv4 DHCP lease lasts. > I think the solution for this is for operating systems to allow applications to request a fresh IP address, or something like that. Obviously that would be a highly difficult and disruptive change at multiple levels... IPv6 already has this capability: https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad... That randomization occurs on a higher frequency than a typical DHCP lease expiration. For a home that has a /48, this is no better or worse than NAT, since you can still only track devices to the home. If your individual devices have their own IPs within the ISP address space, then the best an outsider could do is track devices to a given ISP subnet. Of course, again, the real threat is browser fingerprinting and similar technologies, which are entirely independent of the underlying network.

joeblow9999 6y ago

dont use chrome. anyone even marginally concerned about privacy should be using firfox or brave or tor browser.

ehsankia 6y ago
Is this not an issue with any private browsing mode? How is Chrome Incognito different from Firefox Private? If you login into Gmail on Firefox Private, you still get tracked, no?
- shirshak55 6y ago
  from what i have heard they insert some headers or something like that. So this should be non issue for firefox private user.
  - kyazawa 6y ago
    The "X-Client-Data" Chrome header that I think you are referring to is not sent in Incognito mode according to this article: https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...
monsieurgaufre 6y ago
Firefox has demons of its own on this subject. Evangelism for it which basically is "it's not google" is getting more and more tired.
- svachalek 6y ago
  This is false equivalence. The size and number of demons are relevant.

ikeyany 6y ago

The term "incognito" doesn't always mean "I can't be identified", but it looks like those are the grounds. I wouldn't be surprised if they get an inconsequential slap on the wrist.

ehsankia 6y ago
I'm curious, every other browser has a similar mode. Is the same thing not an issue in other browsers? Do analytics packages not track you in Firefox Private browsing? Do other non-Google analytics not track you in Chrome? What's specific to Google/Chrome here that's not true with every other browser/analytics platform?
- a3n 6y ago
  Incentive.
- ikeyany 6y ago
  I imagine anyone who tries to brand it as "I can't be identified" might be sued too. Who knows how successful they will be. I doubt it would be worth the effort for browsers that don't have a huge market share. For example, a suit against Opera would be ineffective in the grand scheme...as most aren't aware of its existence.
  - ehsankia 6y ago
    Where is the "can't be identified" line come from? The branding is, word for word: > Now you can browse privately, and other people who use this device won't see your activity and > Your activity might still be visible to: Websites you visit Where does that piece of branding you mention come from? I don't see it anywhere? Did Google remove it recently? Or is it just what people, through the telephone game, have come to think it means?

mseidl 6y ago

I use chrome and I notice things that, for example I'll watch a youtube video in incognito mode then, shortly thereafter like, like some minutes. Those things I searched for in incognito mode show up as recommendations in regular browsing.

jjtheblunt 6y ago
Might that be based on the common IP address seen (yours) being remembered on the server side (Google's)?
andor 6y ago
Cookies are still stored and shared among other Incognito tabs. This makes Incognito more usable: you can login to an online store, open a few product pages in new tabs, add items to your cart from all these tabs and check out in the end. If each tab had its own cookie store, they'd have separate carts as well. AFAIK, you need to close all Incognito tabs for the session to end.

random3 6y ago

https://www.google.com/chrome/privacy https://www.google.com/chrome/privacy Incognito mode and guest mode You can limit the information Chrome stores on your system by using incognito mode or guest mode. In these modes, Chrome won't store certain information, such as: * Basic browsing history information like URLs, cached page text, or IP addresses of pages linked from the websites you visit * Snap shots of pages that you visit * Records of your downloads, although the files you download will still be stored elsewhere on your computer or device

ping_pong 6y ago
Does Chrome really take snap shots of the pages that I visit?
- jedieaston 6y ago
  I think it does to put them on the new tab page, at least.

a3n 6y ago

> "As we clearly state each time you open a new incognito tab, websites might be able to collect information about your browsing activity during your session." And we're happy to facilitate that.

parhamn 6y ago

Can any lawyer comment on the fact that this is the same group from the Uber v Waymo trials? I’m curious how this sort of thing works. Grudges? An Achilies heel you found? Is it common for a firm to hit again with something unrelated? I’m fine with it either way, just curious.

williesleg 6y ago

Nice! Can't wait to get my $2 coupon for the Google play store!

dehrmann 6y ago

With how the web works, the degree of privacy the plaintiffs are asking for isn't technically feasible without also advertising that you're in incognito mode.

jackcosgrove 6y ago
I'm willing to trade paywalls for privacy. And paywalls are easy to get around, too, in this context. Just use a non-incognito tab to browse those sites.

cfitz 6y ago

According to their history of Terms of Service changes, it appears that they made changes to the language surrounding information collected while "private browsing" between September 1, 2015 and June 21, 2016. Just do a Cmd+F or Ctrl+F for "snap" (part of snapshot/snap shots; they do not spell it consistently). In that case, it's been in their terms since 2016. I do not agree with this practice nor do I condone it, but who is ultimately "in the wrong here"? Is it Google or is it the users, the latter of whom are supposed to read these Terms prior to agreeing to them? Are "Terms" too long these days? I can't imagine most people have the time to read through all - if not any - of the Terms of Service (etc.) for all products and services they're utilizing in their life.

grawprog 6y ago
The idea that companies can dictate terms that can be arbitrarily changed at whim where the only consent users need to give is the continued use of their product is pretty ludicrous as far as I'm concerned. I realize people should read terms and I do tend to, but often companies will make their policy changes obscure, they intentionally downplay when the make changes to terms. If i enter into a contract with someone, specific permission is required from both parties on any changes. I personally don't understand how these terms of services, which are effectively contracts, get out of following contract law. If I agree to a terms of service, I an agreeing to a contract set out by that business at that time. Refusing to allow service for not agreeing to later changes put out by the service provider is illegal in any other form of business contract. I can't write a contract for some consulting work, get a customer to sign it, change the terms then refuse to hand over my completed work until they agree. I'd be taken to court.
- deleted 6y ago
  [deleted]
- korethr 6y ago
  IIRC, Terms of Service usually have a clause with language that states that the provider of the service may change the terms of the contract at any time without prior notice. If the user doesn't like the new terms, they can quit using the service. Take-it-or-leave-it changes contracts are a thing in negotiated contracts between businesses as well. But rather than taking effect immediately, they'll happen when the contract is up for renewal. As an example, an employer of mine used to have a software product offered for on-prem self-hosted use, or as a hosted service. Then, they decided to stop offering the self-hosted option and to only offer the software as a hosted service to reduce development and support costs of having to support the myriad configurations that come of a number of customers running their own on-prem setups. Customers had the option of converting to the hosted service option, or taking their business elsewhere. And so, when their existing on-prem contracts were up for renewal, those customers made the choice to find another solution, or convert to the hosted service. So, IMO, these ToSes are following contract law. It just sucks that the contracts are so one-sided and the consumers of services offered really don't have an easy means of negotiating the terms to something better for themselves.

treebornfrog 6y ago

As far as I know FB also does this. They create 'shadow profiles' around users who are not signed up to FB too. https://www.cnet.com/news/shadow-profiles-facebook-has-information-you-didnt-hand-over/ https://www.cnet.com/news/shadow-profiles-facebook-has-infor...

jka 6y ago

Bloomberg Law has a copy of the docket filing here: https://www.bloomberglaw.com/public/desktop/document/BrownetalvGoogleLLCetalDocketNo520cv03664NDCalJun022020CourtDocke?1591132864# https://www.bloomberglaw.com/public/desktop/document/Brownet...

rogerdickey 6y ago

Google faces $5B shakedown for allowing JS to work in incognito mode

akersten 6y ago
For real. Many of the anti-Google comments here are injecting their own fantasies for what this lawsuit could be about, celebrating it as some kind of victory towards user privacy - which, to be fair, is a discussion that needs to be had - but this lawsuit isn't that. This lawsuit is literally "I think incognito mode should specifically stop Google Analytics, a website feature, from tracking me" even though the first thing you see when you open an incognito window is that "this doesn't stop websites from tracking you." What do they want Google to do, lean in further towards monopolistic abuse and give Chrome Incognito special treatment when its users are on a site using Google Analytics?
- deleted 6y ago
  [deleted]
Apes 6y ago
What is with this consistent gas lighting? These articles mention Chrome Incognito, and the laser focus gas lighting is consistently that "of course you can be tracked in Chrome Incognito, why are these people SO STUPID?" This has nothing to do with the fact that you can theoretically track users in Incognito mode. You could be using Firefox Privacy mode, and the problem would be exactly the same. It's that Google's services are tracking users who are clearly indicating they don't want to be tracked. If Google built their whole company around relying on bad faith encounters with their customers, and it's going to be painful for them to unwind, then boo-fucking-hoo. Do dumb shit, get dumb rewards.
- judge2020 6y ago
  This is a problem with the article. "for tracking people in incognito mode" would almost certainly indicate that they claim incognito mode is an end-all for GA/Ads tracking, yet the actual case complains about (in broader terms of course): > To prevent information from being shared with Google, Google recommends that its consumers need only launch a browser such as Google Chrome, Safari, Microsoft Edge, or Firefox in “private browsing mode. Both statements are untrue. ” This type of comment is prevalent in this thread because neither this article nor the original article makes this distinction or goes into depth about what the lawsuit really targets. The average HN user doesn't have a pacer account or the patience to go searching through pacer, so we can only rely on news sites to provide good information (especially when they don't even upload the complaint to document cloud). complaint: https://i.judge.sh/specific/Sia/520-cv-03664-LHK-1-main.pdf https://i.judge.sh/specific/Sia/520-cv-03664-LHK-1-main.pdf

jedimastert 6y ago

I've seen several people mention the Do Not Track header, but it comes with a downside: it paints a giant target on your back. If, say, 5% of user agents have DNT enabled, then it's becomes extremely effective as a fingerprinting vector on the people who specifically don't want to be fingerprinted. If, on the other hand, a majority of people use it, then most people will simply ignore it or perish. This is mostly why people ignore it nowadays, because IE turned it on by default. No one uses it anymore because there's no reason to trust that it'll do anything and no reason to actually follow it.

thelean12 6y ago
To be clear, you can already detect if people are in incognito with JS (you can google it and find plenty of articles). So DNT doesn't seem to add much if someone cares enough about this variable.

deleted 6y ago

[deleted]

gcbw3 6y ago

The legislators will be delighted to learn how google's * reCaptcha * 8.8.8.8 et al DNS * google fonts hotlink * google JS cdn hotlink * etc etc store data and how that data is "anonymized" by random teams' arbitrary definitions, and used all over their ecosystem. I guarantee you at the very minimum reCatpcha contributes to some "isBot" or "hasGoogleAccount" attribute that is then used by Advertising systems. And that is assuming the best of the best of the best case scenario.

estebarb 6y ago

This lawsuit is absurd, and it should be rejected with a "please learn to use a computer before owning one". So, what is next? lawsuits against car companies because emergency lights didn't invoke emergency responders?

nova22033 6y ago

Boies Schiller & Flexner The law firm that help Harvey Weinstein smear his victims is going after a target with deep pockets... This is news?

dang 6y ago

https://news.ycombinator.com/item?id=23405022 https://news.ycombinator.com/item?id=23405022 https://news.ycombinator.com/item?id=23397045 https://news.ycombinator.com/item?id=23397045