4 ms·
Google wants your Google Account to be the only Identity Signal available on the web. This feature is available right now in Analytics and Ads. It's called "Go
by lmkg 6y ago
Google wants your Google Account to be the only Identity Signal available on the web.
This feature is available right now in Analytics and Ads. It's called "Google Signals." The documentation is publicly available, although it's a little scattered between different product page. I'll summarize:
If the user is using Chrome, and is logged into their Google Account, then you can use that instead of cookies. This is used for pulling in demographic information, cross-domain tracking, and cross-device tracking (something even 3rd-party cookies can't do without fingerprinting!).
The Privacy Sandbox kills other channels that might be an identity signal. Meaning ones available to parties other than Google.
Even as an anti-Google zealot who disapproves of this, I'll admit there are some ancillary benefits. For one, I honestly do believe that Google intends to kill fingerprinting, because it's in their interest to do so. For another, Google does offer a setting "disable personalized advertising" which will centrally let you opt-out of this tracking.
But most people are surprised when they find out that things already work this way, which to me already puts it on ethically dubious foundations from a privacy perspective. And, of course, the monopoly issue.
- hrktb 6y agoThat’s interesting, Google > “disable personalized advertising” On this bit, tracking concerns are not just for advertising though. Extending your reading on how they replace cookies with the Google id, I’d see them replacing ad targeting with other uses of the data anything that wouldn’t straight be labelled as “ad” (scoring, black listing, indirect target matching, etc.)
- joefkelley 6y agoI'm a Google engineer who interacts a little bit with this kind of stuff. There are a few settings for this kind of thing. You can take a look at https://myaccount.google.com/data-and-personalization https://myaccount.google.com/data-and-personalization The "Ad personalization" bit is probably what the parent comment is referring to. But it sounds like you're interested in the "Web & App Activity" bit, which will turn off the non-ads usage of your data. To a certain extent at least, since there are some grey areas. For example, I'm on the team that sends Google Shopping emails. If you click a button to track the price of a specific TV, we'll still send you an email if that price drops even if you've opted out of "Web & App Activity". But if you've just been browsing shopping pages for TVs, we won't send you a general email about TV deals if you've opted out. Both of those cases are in some literal sense "web activity" but it's still pretty clear what the user expects. But you might imagine- if you're tracking the price of a specific TV and opted-out of Web & App Activity, should we send you an email if a near-identical TV drops in price? We probably wouldn't, and we don't have anything like this today, but it's not quite as clear. And Google has so many features across different teams, I can imagine there's probably at least one where some privacy reviewer made a different call than what you would have made.
- lifeisstillgood 6y agoForgive the grumpy old man approach here, but can't this all just stop. The price of a TV (or almost any common product) is driven more by large scale factors (cost, competition, features and brand) than the latest 4 dollar shift because of some promotion in some channel somewhere. We are optimising for the wrong things. Computers are supposed to be our agent in the digital realm, reaching out for us, in our best interests. If we turn off all storage of personalised information completely and utterly, 95% of everything I ask can be answered from context (please show me cheap TVs). Look, i don't object to the idea behind the sandbox (it's always been weird that browsers tell the server what fonts and other settings exist. I mean who ever optimised for that) What bothers me is that it's a google id. Just let me have a few U2F ids - this is my shopping id, track it if you may. when I take it out of the slot stop tracking me. I am sure I am feeling extra grumpy today, but when we stop tracking and trying to find ways to make me buy, and start finding ways to make my life better, that's when we have a digital revolution.
- hhjj 6y agoYes we need (again) an inversion of control. At first advertising links only tracked origin (website), so announcers could target right website to put links on it. But soon advertisers realized you could gain more granular information in using more active technology like cookies, gifs, flash, etc. So they began tracking users and their journey through all websites with all privacy problems it entails. I think in terms of privacy the only level acceptable is the one you have to deliberately have to engage with to start "tracking" (that means advertising content must be displayed alongside publisher content and not personalized nor tracked through advertising company if the user hasn't engaged with). I also think that marketing/advertising is bad since it distorts value perception but i remain pragmatic and we can't ban all advertising that easily.
- lifeisstillgood 6y agoI wanted to expand on this a bit. If we are ever going to manage the flood of data out there we need digital agents acting on our behalf. The AI behind the facebook feed or the google ad tech is a very early beta of those agents - and "on our behalf" may seem a stretch. But that's not just a cheap snide remark - I think on our behalf is a fundamental issue of how they will be built and designed and regulated. Richard Thaler has promoted Paternalistic Libertarianism - which seems to me a very good default setting for digital agents working on out behalf. It's not however that simple. I hope we shall see a Medical approach to managing data - where everything is shaped by the best interests of the data subject. But there are three major world views - let's call them European, US and Chinese for over simplified ease. The Us view is caveat emptor - one should be rugged individualist enough to be able to calculate the best co-pay arrangement and by extension work out ones preferred facebook privacy settings. If you get it wrong you will be prey for the payday loan industry. The European view that by default it should be good for the individual (although as a Brit I should sneak in that the state gets to define good. And I suspect the Chinese view is it should be good for the confucian society - and the state may have some say in who is in and out of that. As we are entering the new era of regulation of tech, these conflicting world views are becoming entangled - and we coders will be on that front line. Choose a side - and be prepared for some very weird outcomes.
- cung 6y agoAn interesting thing I've noted on disabling personalized advertisements: My SO, who has personalized ads on and lives in the same household, sees ads based on my behaviour. So the ads aren't personalized to me, but they certainly are to my SO.
- goliatone 6y agoDepending on the type of ads being served that cross-profile-pollination could lead to info leakage and problematic and/or weird situations. It makes me want to be able to build a fake persona rather than a ghost/anonymous profile
- konjin 6y agoYou're assuming competence that isn't there. It's a shared ip address, there is still plenty of tracking that is dumb enough to assume that it means that you're the same person and that gets thrown into her 'unique fingerprint'. I'm not sure who gets the worst deal from tracking, the companies buying ads or us having to see them.
- conradev 6y agoI can’t seem to find the name, but someone built exactly this: an agent that sits on your computer and generates noise. Visiting random web pages, performing random searches, etc. You’d then get random, non-personalized ads.
- hyperdimension 6y ago"Ad Nauseum" -- I think it's a browser extension. That said, I have heard a few times comments mentioning that it's easy to filter out (from the ad provider side.) I hope not, but if it is, I would only hope someone smarter than I would send a PR. :)
- input_sh 6y agoIn other words, they're personalised to your IP address, but since only your SO has personalised ads turned on, they see what's personalised to both of you.
- solarkraft 6y agoObviously that just gives Google a monopoly on tracking. So that's cool, I guess ...
- uyt 6y agoCentralization is not always bad. Google is a single company and can be regulated so you can opt-out. I guess I just don't care who makes money off fingerprinting as long as I can choose that no one makes money off me personally.
- blackearl 6y agoI'm leery of any all encompassing systems that you can supposedly turn off with a single toggle. For example, you would think that not having a FB profile is the ultimate opt out but they have all your data as a shadow profile.
- kikokikokiko 6y agoThe REAL danger of fingerprinting is not on "some company making money of me through ads", it's that basically one or more entities, i.e. companies and/or governments, can identify you, your habits, political affiliation, localization etc, completely. And then they can modify the internet you see, censor what you can say etc. I couldn't care less about the ads part.
- Barrin92 6y agothis post doesn't deserve downvotes. Googles size also makes them accountable. Decentralisation is useless if you end up in the wild west with 100 companies, none of which can secure your data. I'd rather be on a well-regulated network that has the resources to have proper security in place rather than on fifty tiny ones who scrape very detail of my life and serve me crappy ads, this is basically how porn-sites work.
- Supermancho 6y ago> Decentralisation is useless if you end up in the wild west with 100 companies, none of which can secure your data. It's not useless, nor is it realistic to imply they are all unable to secure "your data" through their narrow lens. Treating "your data" as monolithic, necessarily implies attribution through centralization - all exchanges between multiple parties are at least a 2 way transaction of identity. It's the consequence of decentralization that there are gaps, not a fatal weakness.
- wackget 6y agoHow do you kill fingerprinting, though? It's impossible without limiting what web developers can do with their sites.
- bombcar 6y agoMany ways! You reduce the nearly unlimited responses for various aspects of a defined few - such as a basic list of fonts or the nearest screen resolution. You only provide random data unless the user specifically grants fine tuned info. You stop providing long lists of capabilities and instead leave it to the implementation to assume. Providing a “baseline” user agent instead of a detailed specific version could help for example.
- cpeterso 6y ago> If the user is using Chrome, and is logged into their Google Account, then you can use that instead of cookies. How is the Google Account ID shared if not by cookies?
- bigiain 6y ago"Oh _these_ aren't cookies! It's just that Chrome sets and sends custom http headers to all Google owned websites. _Totally_ not cookies! _Totally_ GDPR compliant!" Set-X-Totally-Not-An-HTTP-Cookie: sessionToken=bigiain; Expires=Wed, 17 Jan 2091 10:18:14 GMT
- nahtnam 6y agoI wonder if they are also doing this to get around the GDPR related cookies stuff. Don't need to have a banner if you don't use cookies. I assume this would also apply to sites using Google Analytics as well
- Gwypaas 6y agoGDPR is actually technology agnostic, it doesn't mention cookies or any other technology. If you store extra PII in any way, cookies, fingerprinting, localstorage or whatever you need to ask for consent with opt-in.
- onion2k 6y agoIf the user is using Chrome, and is logged into their Google Account... What does it do if the user isn't signed in to Google? Google's engineers would have to have an unbelievable level of contempt for users to propose a feature that claims to improve privacy by signing in to Google.
- bryanrasmussen 6y agoIt is a well known stereotype of programmers that they have contempt for users.
- lrossi 6y agoIt will probably nag you all the time like it does now for each YouTube video you open without signing in.
- bigiain 6y ago> Google's engineers would have to have an unbelievable level of contempt for users to propose a feature that claims to improve privacy by signing in to Google. I, for one, find that level of contempt totally believable.
- callmeal 6y ago>What does it do if the user isn't signed in to Google? Well, then they just use you to train their fire-hydrant, bus, bicycle, and stair image recognition algorithms.
- userbinator 6y ago"It is difficult to get a man to understand something when his salary depends on his not understanding it."
- brundolf 6y agoInteresting way of looking at this: monopolies stifle markets and hurt consumers. But consumers of the ad market are not the end-users, they're the companies buying ads. Therefore, by strangling the market, it is actually possible for Google to be helping people for whom that market is a bad thing (which is most of us).
- soared 6y agoYou are plainly ignoring the actual privacy sandbox in favor of the clickbait. Google is killing 3p cookies which kills google competitor products. But the sandbox is purpose built to create new infrastructure for the competitors (and google) to rebuild in a privacy focused way. The privacy sandbox is a way to create an alternative to IDs (like google’s sign in option) and 3rd party cookies. You can go through proposals and see how these can work here: https://github.com/w3c/web-advertising https://github.com/w3c/web-advertising Look, I’m not a google fan but you can’t just ignore half of what google is doing. Even then, you’re missing that they are other ID projects that are closing ground on googles ID.
- i2shar 6y agoThis is an egregious violation of privacy of the unsuspecting Chrome user who conducts their business while signed in to Chrome. To make things worse, couple of years ago, Chrome started mingling Chrome Sync and cookies for accounts.google.com which meant that signing into Chrome Sync also automatically signed you into all of Google services. The cookies reappear even if you delete them, just because you are signed into Chrome Sync. Now, that same identity (<you>@gmail.com) is not just used for Google's own websites, but also made available to anyone who uses Google Analytics - which is 90% of the web - including your cross-domain and cross-device history. Of course, none of this is new, but I shudder every time at the thought of how much information the user is giving away about themselves.
- shostack 6y agoHow is that identity made available to anyone via GA? Google does not allow user identifiable PII in GA. Are you conflating the aggregate anonymized data in GA with the user level visibility Google has into the raw data?
- hyperdimension 6y ago"...conflating the aggregate anonymized data in GA with the user level visibility Google has into the raw data?" Isn't that kind of the point? I see no difference. Who cares what individual site owners happen to be able to see if Google is going to monitor, track, send back (telemeter?) way more data and be able to analyze and store it forever? It's all about who might possibly get the data at a later date than who happens to house it presently. EDIT: In fact, come to think of it, why are there two things being 'conflated' here? Why is Google collecting more information about Google Analytics-using sites than it's exposing to site owners?
- sigmaml 6y agoI am not sure if you use and know how Google Analytics works. You are conflating two things here.
- lmkg 6y ago
- hyperdimension 6y ago"Google Signals," huh. That sure doesn't sound insidious...kind of like a large Internet ad company trying to make sure that they're the only one who can track your activity online. Don't worry, though. If you were using any of the now-dead competing advertiser networks, you can target using this information for a small fee! They sure know how to benevolently push forward the wheel of progress to fight to ensure your absolute privacy from everyone but them. Not that I'm a fan of these 'Signals'--or even cookies for that matter.
- WhyNotHugo 6y agoThe do intend to kill fingerprinting [and cookies]. But only because they have a far more efficient way of tracking users _and_ make sure they're the only one who can benefit from this. It's unbelievable how absurdly anti-competitive and anti-consumer google has become, yet nobody seems to care.
- Proven 6y agoI share your outrage but if users overwhelmingly don't care you can't say consumers are hurting, so all this tracking and anti privacy is factually proven to be pro-consumer. Even if you don't count yourself among those ignorant consumers, no one can force you to use Chrome and Google services. To call on the government to force private businesses to make products and services the way we'd prefer them would make us even more ignorant than those ignorant users - at least some of them don't know what they are doing.