11 ms·
Google is facing a lawsuit for tracking people even when they opt out
- ForHackernews 6y agoCan any googlers comment on whether "turning off" activity on your user page actually does anything? My understanding has always been that it just hides that data from the end-user.
- toxicFork 6y agoThis too is my assumption. Even if someone says "no it means the data is not collected", I would not be satisfied with an answer here, though. It's something very hard to prove one way or another.
- londons_explore 6y agoGoogle could release a statement saying "it means the data isn't collected", and then ask a reputable auditing company to come in and inspect its systems to verify the claim and then publically say so.
- gowld 6y agohttps://support.google.com/analytics/answer/7105316?hl=en https://support.google.com/analytics/answer/7105316?hl=en https://www.privacyshield.gov/article?id=7-RECOURSE-ENFORCEMENT-AND-LIABILITY https://www.privacyshield.gov/article?id=7-RECOURSE-ENFORCEM...
- hedora 6y agoI used those controls to disable all data collection, but doubleclick still targets ads at me. The controls do not work.
- throwaway53453 6y agoAre you sure you're just not predictable? If HN had Ads, you could be blocking all the cookies and analytics you want, but those Ads can "look" targeted.
- falcolas 6y agoIf the ads are targeted at "Hacker News Viewers", that's one thing. But if a baby crib shows up on HN that's well beyond just "looking" targeted.
- shadowgovt 6y agoDoubleclick ad targeting is based on the data collected by the sites you visit, not data Google is collecting about you. DCLK works by the site asking Google for an ad shaped like their idea of you and Google sends them an ad, not by Google knowing what ads you like. If you're seeing targeted DLCK ads while visiting some site, it's because the site has semantic information on you and has told Google "This user looks like they like puppies; I know this because they read a lot of puppy articles or I have a social media arm and they joined a puppy message group that I manage accounts for. Get that user a puppy ad." Now, how individual sites track you and unify their concept of your session with their concept of your ad targeting is up to them, but it's worth noting they're allowed to use basically anything (including first-party cookies, browser thumb-printing, and local store API) to do that. They can also share information with other sites (using mechanisms like image bugs to let an affiliated site know you visited their site and what your userID is on their site, so they can compare notes later and build a comprehensive ad profile for you). None of this requires Google's involvement.
- throwaway53453 6y agoThese controls are not a trick, they really do what they say.
- sixothree 6y agoI just cannot bring myself to believe that. Related to google specifically, it would take an enormous effort to make me believe otherwise. I uploaded a picture to google maps as part of a review. About a month later I get an actual notification on my phone - hey do you want to share this picture you took in City Park last weekend? It creeped me out beyond belief. Google had been rifling through my personal pictures in the background while I was going about my life. It was an enormous breach of my personal space and it is just one example of many related to google.
- xnyan 6y agoI think I may misunderstand what you are saying: >I uploaded a picture to google maps as part of a review You uploaded a photo to a public service, cool: >Google had been rifling through my personal pictures Not sure how that follows. Did google take a different photo from your phone and I'm misunderstanding you?
- Kbelicius 6y agoOP is pretty clear. > About a month later I get an actual notification on my phone - hey do you want to share this picture you took in City Park last weekend? He took a picture and put it on a public service. A month later that service asks him if he wants to share a picture that he took last weekend. Since last weekend cannot be as far away as a month ago one can not conclude anything else then that we are talking about a different photo.
- shadowgovt 6y agoOh, now I understand. I'm pretty sure that's the local Google Maps client app rifling through the locally-stored photos (because it has permission to see the metadata for photos on the device). I can see how one could find that creepy, though I think it's relatively harmless. Is the specific issue that one doesn't want Maps to be able to infer you took a photo at location Y just because you once uploaded a photo at location X? Is the issue server-side Maps making the inference or client-side Maps (b/c client-side knows where you are and can see your photo metadata, so it doesn't actually need a server in the loop to ask that question)?
- lrem 6y agoIt does exactly what it says on the tin - Google stops collecting data you tell it to stop. This lawsuit, from a quick glance, is about Google not preventing "hundreds of thousands" of third parties from collecting, including third parties building with Google tech.
- CobrastanJorji 6y agoIs the "Google tech" argument the equivalent of saying "Toyota promised not to track me, but a stalker followed me around town in a Corolla?"
- shadowgovt 6y agoBasically. Firebase and Google Analytics can be used to build user behavior tracking in an app. That doesn't imply turning off web & app activity tracking the Android OS itself does turns off behaviors in apps running on that OS.
- surround 6y agoWhy does HN insist on downvoting genuine questions like this?
- altgoogler 6y agoUnofficial Googler here. I have no non-public information on this topic and my opinions here are my own. The Web & App activity is described a help page article [1]. There are different settings for Android, Desktop and iOS. If you follow the dialog for the Desktop version you'll see another dialog that displays: "Include Chrome history and activity from sites, apps, and devices that use Google services" It's not clear what's being claimed in the lawsuit, but they mention Firebase, which is an app and web site framework. I would expect those opting in or our of the Web & App activity would cover signals from Android and Chrome, but not server-side components like Firebase and Analytics. I would expect those Android and Chrome signals aren't just hidden from the user and that they actually aren't transmitted or stored. From what I have seen Google tries to be transparent with everything in the My Activity portal [3]. It's not clear what they claim is being collected via Firebase. [1] https://support.google.com/websearch/answer/54068?co=GENIE.Platform%3DDesktop&hl=en&oco=0 https://support.google.com/websearch/answer/54068?co=GENIE.P... [2] https://myactivity.google.com/activitycontrols?pli=1&authuser=0 https://myactivity.google.com/activitycontrols?pli=1&authuse... [3] https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity
- ForHackernews 6y agoThe text on the "privacy checkup" page says: > Web & App Activity > (Paused) > Used by Assistant, Google Maps, and others > If you turn this setting on, Google will save your activity on Google sites and apps in your Google Account, including searches and associated info like location. You can also choose to save which apps you use, your Chrome history, and which sites you visit on the web. (emphasis mine) To me, that reads like a careful lawyerly declaration that they are already saving all my activity, but if I turn this on, it will also be saved in my Google Account where I can see it.
- altgoogler 6y ago"When you delete data in your Google account, we immediately start the process of removing it from the product and our systems." https://policies.google.com/technologies/retention https://policies.google.com/technologies/retention See also: https://policies.google.com/privacy#infocollect https://policies.google.com/privacy#infocollect
- notRobot 6y agoThis is Google we're talking about. I'm sure they've run the numbers and come to the conclusion that a lawsuit and a fine costs less than the amount of money that they earn by tracking users even after saying that they won't. Is anyone surprised at this point?
- shadowgovt 6y agoHonestly, I doubt they've run any numbers on this because I think this lawsuit hasn't occurred to Google. Web & App Activity tracking collects data on usage of apps and browsing and sends them to the Android project (for improving the OS). Firebase is a framework and service for third parties to build tracking like that into their individual products, and it has an entirely separate history from W&AA tracking. It happens to be owned by Google (as of recently), but the data isn't in the same hoppers as the Android hoppers and Google can't see it (it's part of the Cloud offering; Google offers the service and stores the data, but aggregating or using the data itself would be a violation of their agreements with Firebase customers). Firebase and W&AA tracking are two different subsystems owned and maintained by two different departments at Google (in fact, hypothetically, they could build W&AA tracking as a client project on top of Firebase, if they hadn't already built it). Firebase was an acquisition; when the W&AA tracking feature was added, Firebase wasn't even part of Google. This is a lawyer recognizing that an acquisition has created a novel arrangement that could be interpreted as suspicious.
- suifbwish 6y agoDoes it matter if anyone is surprised? If the courts rule they are in the wrong, they could be fined for each violation which would be billions of dollars.
- shadowgovt 6y agoInteresting. Between this and the Incognito Mode lawsuit, it seems some lawyers are trying to make a case that companies have the burden of making their systems plain-language understandable to the consumer, not technically understandable. "Incognito mode" has never meant "Third party sites can't track you," but one could argue its plain-language understanding should be that. Similarly, disabling "Web & App Activity" actually means Android's built-in tracking is disabled, but does nothing about third-party site tracking (which is what Firebase is; it's a framework for third parties building usage tracking into apps that happens to be owned by Google but doesn't drop its data into the same hopper as the Android project's tracking). One can clearly see how turning off Web & App Activity tracking could cause a person to assume systems like Firebase are also disabled, but it doesn't. I don't know what the right answer is yet. Manufacturer responsibility v. personal responsibility is an old question, and it's why we have court systems.
- im3w1l 6y agoNever considered firebase.. How would you even avoid that?
- jojobas 6y agoDon't use services where you are the product.
- AnthonyMouse 6y agoIf only it were that simple. Just because you pay them doesn't mean they're not tracking you. Look at Windows 10. And just because they promise not to misbehave doesn't mean they're not subject to secret coercion (e.g. from China) or to getting hacked. The only solution is for them not to have your data at all. It has to stay on your machine and never be on theirs.
- crdrost 6y agoFirebase is loosely speaking an app development framework which hosts the server side of your app on Google Cloud. The firebase web site lists some apps built with it like NYT and trivago and Duolingo, but I don't think you could reasonably avoid them based on how they look, those look like every other app. It's really not clear what this lawsuit is about from this article, either. Is the problem the Google Cloud integration? Is the problem Google Analytics being shipped with apps? All that we can really tell from the information given is that there is some conflict between non-Google apps and the Google privacy settings, which just sounds like a strange tension. Like, of course non-Google apps are not subject to Google's privacy policy. Still, this lawsuit may have some indirect effect where Google someday needs to rebrand, and the apps that it sends straight to you like Docs and Gmail continue to be “Google” while the platforms for other developers like Google Cloud carry some other name as part of a different subsidiary of Alphabet, Inc. I don't want to speculate too much about that, it seems strange but that's why we have court systems to work through the stranger points of law.
- gundmc 6y agoThis is the second suit from this firm that seems to be formed on an incredibly weak and intentionally misleading argument. Here: the user turns off data collection from Google services, but third party apps use a Google Cloud offering to collect analytics (which Google cannot access). Previously: I launched Chrome in incognito mode, but when I log into Google it records my activity. Given the article's mention of Oracle as a client, it seems likely this is part of Oracle's continued smear campaign against Google. Keeping a stream of negative headlines regardless of substance, especially as the big Supreme Court case looms.
- shadowgovt 6y agoOh wow; I missed they were the same firm. I was intentionally leaning away from linking the two cases too closely so as not to foment a conspiracy theory, but "Two cases from the same firm" isn't conspiracy; it's just strategy.
- pd33 6y agoParts of Firebase do share data with Google that Google can access and use. https://firebase.google.com/policies/analytics https://firebase.google.com/policies/analytics
- gundmc 6y agoI'm not seeing anything that obviously supports your statement in that link, but I may be missing something. Could you quote the relevant section?
- gundmc 6y agoI'm outside the edit window, but this page [1] looks more relevant. App owners can opt in to sharing additional data with Google for use in things such as spam prevention. It is off by default. [1] https://support.google.com/firebase/answer/6383877?hl=en https://support.google.com/firebase/answer/6383877?hl=en
- dang 6y agoThe similar suit filed a month ago by the same firm was discussed here: https://news.ycombinator.com/item?id=23405022 https://news.ycombinator.com/item?id=23405022 also https://news.ycombinator.com/item?id=23397045 https://news.ycombinator.com/item?id=23397045
- dependenttypes 6y agoGoogle should face a lawsuit for intentionally breaking the audio challenge in captcha when someone is using a proxy or has the fingerprinting protection enabled (same for cloudflare with their hcaptcha actually which does not even have an audio challenge). Also for making captcha more difficult when using firefox.
- T3RMINATED 6y agoBut yea lets ban TikTok
- zelphirkalt 6y agoWell, how come I am not surprised. Google is an ad company and I think lots of people still have not understood this. Google abuses that and does whatever they can to get more data. Ethics play no role for them.
- spodek 6y ago"Don't Be Evil", according to Wikipedia: "In April 2018, the motto was removed from the code of conduct's preface and retained in its last sentence." https://en.wikipedia.org/wiki/Don%27t_be_evil https://en.wikipedia.org/wiki/Don%27t_be_evil Since you can't demote it past the last sentence, maybe they should change it to "Whatever sells" or something similarly mercenary.
- a3n 6y agoWell, they have to track people that they aren't tracking. Otherwise they wouldn't know who they're not tracking.
- dudus 6y agoI realize this is a joke. But that's an interesting contradiction, how do you know how many people you didn't track? The answer is that you don't. These companies estimate how many people block cookies or pie-hole requests to /dev/null or have ad blockers, etc. Their estimations are bad and they don't really know. It's a real problem.
- digitalpacman 6y agoLiterally no one stops tracing you when you opt out.