11 ms·

Unless I am reading this incorrectly, I think this paragraph better summerizes the article versus the headline: "In this case, Google is accused of relying on

by kop316 6y ago

Unless I am reading this incorrectly, I think this paragraph better summerizes the article versus the headline: "In this case, Google is accused of relying on pieces of its code within websites that use its analytics and advertising services to scrape users’ supposedly private browsing history and send copies of it to Google’s servers. Google makes it seem like private browsing mode gives users more control of their data, Amanda Bonn, a lawyer representing users, told Koh. In reality, “Google is saying there’s basically very little you can do to prevent us from collecting your data, and that’s what you should assume we’re doing,” Bonn said." It doesn't seem like the complaint is that Chrome collects data on you in "Incognito" mode, rather that websites (e.g. Google Analytics) still collect on you in "Incognito" mode.

Blikkentrekker 6y ago
Going incognito on Chromium still gives a warning that it does little for website tracking and purely does not save browsing history. So one can browse the finest pornography[1] without one's cohabitants finding out. [1] https://nhentai.net/g/335688/3/ https://nhentai.net/g/335688/3/
robteix 6y ago
> It doesn't seem like the complaint is that Chrome collects data on you in "Incognito" mode, rather that websites (e.g. Google Analytics) still collect on you in "Incognito" mode. Isn't that a distinction without a difference though? It's not Chrome, it's Google Analytics. It's all Google in the end, isn't it?
- solidsnack9000 6y ago
  It's all stuff from Google but in the hands of different people. Google Analytics is installed by the owner of the website; it makes a promise to them: it collects everything it can. If Google Analytics actually ignored data from Chrome in Incognito mode, it raises some questions: * How does it detect that, exactly? * Is there an unfair competition aspect to it? What about other browsers, not from Google?
  - vinger 6y ago
    What other browser hold 70/80% of the market?
  - fiddlerwoaroof 6y ago
    Yeah, making incognito mode detectable would be a huge privacy issue: it would enable blocking users based on incognito and all sorts of other bad issues. If incognito mode is undetectable, there’s no way for Google Analytics to distinguish between “cross-device” traffic from an incognito window vs. from a phone and a laptop. Whether or not cross-decide tracking is good or bad, it’s irrelevant to this question.
    - postalrat 6y ago
      How is blocking incognito a bad thing? Right there it should tell the user they need to avoid that site at any price. I'm pretty sure incognito is detectable right now. I'm always going to assume it is.
  - bee_rider 6y ago
    That second point is really interesting. It seems sketchy on both ends, really. Either they are intentionally circumventing their own privacy feature, or they are giving their own browser an unfair competitive advantage. Huh, maybe the level of integration here is just inherently problematic and companies shouldn't try to fulfill every role in the market.
  - unilynx 6y ago
    > If Google Analytics actually ignored data from Chrome in Incognito mode, it raises some questions: How does it detect that, exactly? The most honest implementation would be to set the DNT header in incognito mode (as Firefox apparently does) and to have Analytics honor it. Does not require anything shady/anticompetitive
    - captn3m0 6y ago
      This. Would be amazing to have a ruling enforcing DNT on GA, even if for Incognito since that gives backing to the DNT header, which has mostly been "don't honor" for advertisers.
- ttt0 6y ago
  Maybe it's the perfect time to seriously consider whether Google should be split up. They control everything. From a nameserver, through a web browser, to online services and advertisement.
- TheRealPomax 6y ago
  Not in court, no. In court that is a huge difference, because Google is a company, Chrome is a product, and Google Analytics is a technology, and those are completely different things. A good lawyer could quite successfully argue that all three being "Google" is not sufficient for the public to reasonably expect that "private browsing" means Google will still be monitoring you. And while Google would argue that its EULA no doubt contains a clause along those lines, the deception is still there, and can still be litigated (even if the verdict ends up being "this is deceptive and you must change this aspect of your product" without this particular thing, among many many others, requiring punitive measures)
  - GavinMcG 6y ago
    This assertion without an argument is not especially helpful. What legal distinction must hold the line here, in your view? Why is it insufficient to suggest that a user in a Google Chrome Incognito window might reasonably expect Google to be on notice that they do not consent to Google tracking? Edit: the parent has since been edited. It had said only "Not in court, no. In court that is a huge difference."
    - hojjat12000 6y ago
      Because "incognito mode" is not about tracking! It is about saving information on your local machine. If you are in incognito mode and log into Gmail, you will see your own email! You are not incognito to Gmail. It used to be called "porn mode". I think that's a better name for incognito. It is there to stop others who use your computer to spy on you. Ofcourse you can use incognito (assuming you don't log into anything) and be reasonably anonymous (there are many other things that can track you even in incognito). I think it just need a rebranding. I vote "porn mode".
      - xiphias2 6y ago
        Porn mode is also about companies and governments finding out information that they can use to blackmail you.
      - 6y ago
- GeneralMayhem 6y ago
  No. Chrome is doing exactly what it says it is. It's different data, used for different purposes, by different entities. That's a huge legal difference, and also a significant practical one.
  - loveistheanswer 6y ago
    No. Chrome is owned by Google. Claiming otherwise is like punching someone in the face with your right hand, and then telling the judge your right hand is a separate entity.
  - GavinMcG 6y ago
    Or it's by the different parts of the same entity. Why are you confident that Google's internal choices about organizing their business are what win the day here, rather than Google's interface with the consumer?
  - ttt0 6y ago
    Is it? What about X-Client-Data header?
- root_axis 6y ago
  The difference seems pretty meaningful. Google analytics really has nothing to do with Chrome in this context, the same thing would be true in any browser visiting a site with Google analytics tracking.
  - kevin_thibedeau 6y ago
    Chrome is designed to give Google control of the information it collects. That is the only reason it exists. It has everything to do with GA. They're not burning millions on developers out of goodwill.
    - root_axis 6y ago
      > Chrome is designed to give Google control of the information it collects Sure, but chrome does not do this in incognito mode, same as any other private mode browser, there's nothing specific about chrome that allows GA to collect your analytics in incognito mode, GA can do so in any browser.
    - d1zzy 6y ago
      Says who? Not according to the public discussions at the time it was started.
- 7800 6y ago
  Incognito mode isn’t privacy. It just keeps cookies and cache cleared initially for that incognito session. That’s like Firefox, etc. The EU and California notion that disabling cookies stops companies from tracking you is also false. Everything between you and the site can track you, and the site could track you without cookies. Even hiding your IP via using a VPN doesn’t protect privacy as much as you’d think, somewhat depending on the VPN provider and those interested. Tor? Not always private. If you don’t believe me, search for it and show me how to prove that it is or could be fully. And it makes you a target; why do you need that privacy, they ask? Privacy is a grey area.
- fchu 6y ago
  Not quite. Having a blanket "Google doesn't track you" statement doesn't capture the complexity of reality: what if the website you're browsing is using Firebase for their authentication, or Google Pay for payment. I'm certain most users would want the website to function correctly, otherwise it defeats the point of using incognito. In all of these cases, Google will have a record of you, even if those records are not actively joined. Where do you draw the line?
nsgi 6y ago
How can there be a reasonable expectation that websites won't track users in incognito mode when browsers don't give websites that information (unless the website works it out in a backwards way)?
- jschwartzi 6y ago
  Firefox sets the Do-Not-Track flag when you're browsing in Incognito mode. I think it's only Chrome that doesn't provide that information. So it's entirely possible for your analytics trackers to not forward those analytics on for users who are in Incognito mode if those users are using a browser like Firefox.
  - deckard1 6y ago
    Do-Not-Track failed. According to Wikipedia, Apple dropped support and not many people adopted it anyway. It was always doomed to fail. You're asking the wolves not to eat you by setting an HTTP header. If these companies were the kind to care about the honor system, they wouldn't be tracking you in the first place.
    - wtetzner 6y ago
      I think the point jschwartzi was trying to make is that Do Not Track paired with legislation requiring companies to honor it could be a reasonable solution.
      - d1zzy 6y ago
        I'd still end up having to disable it because there are plenty of trackers that are not bound by US laws (or any laws) and providing DNT is a stronger identification signal than not giving it.
    - feoren 6y ago
      Regulation around Do-Not-Track failed, as it often does when captured by industry. The Do Not Call list started in 2003, but it seems it's starting to be taken a lot more seriously lately. Everyone should keep using Do-Not-Track and somehow logging/reporting/publishing violations of it (although I don't even know to whom -- maybe the best we can do is a version of plaintextoffenders for now). It can eventually end up as ammunition for a future bill to actually start regulating this effectively. Calling it a failure and abandoning it is not going to help.
eschulz 6y ago
Upon opening an Incognito tab, Chrome warns you that your activity might be visible to websites that you visit. I'm sure Google's attorneys are aware of this.
- alasdair_ 6y ago
  >Upon opening an Incognito tab, Chrome warns you that your activity might be visible to websites that you visit. I'm sure Google's attorneys are aware of this. To a layperson, there is a marked difference between activity and identity - there is nothing on the tab that states that the identity of the user is still discoverable.
  - eschulz 6y ago
    You make a good point. There are trusting people, and then there are software devs and lawyers.
- pessimizer 6y ago
  Chrome warns you that websites that you visit may still track you. It doesn't warn you that Google, who owns Chrome, will still track you, which would put the lie to "incognito" anyway. It's as silly as if I ran an "anonymous" clinic where you didn't have to give your name, but my employees were instructed to figure out who you were by running in-house facial recognition software and to place the results in your file. That's materially different than warning people that "although our clinic is anonymous, you may be recognized in the waiting room by other patients" which is the way people understand Chrome's warning.
  - bqmjjx0kac 6y ago
    There are many sites on the internet, and other clinics to visit in your metaphor.
ehnto 6y ago
I would agree. It's an interesting position to be put in. I think most of us in tech can see the technical separation between the two bits of software, and likely feel like Google Chrome is not responsible for Google Analytic's actions, but I wonder if the court will see it that way. I think it's not an unreasonable take that if a user has let Google know it doesn't want to be tracked, that Google shouldn't track them with any of the technology they have.
- akersten 6y ago
  > I think it's not an unreasonable take that if a user has let Google know it doesn't want to be tracked, that Google shouldn't track them with any of the technology they have. So the same people saying Google is a monopoly would say they must then further abuse their monopoly position to stop Google Analytics from tracking specifically Google Chrome users in incognito mode? The only correct outcome of this case is for those involved to realize that a browsers' "private browsing" mode is referring to a completely different type of privacy. It has nothing to do with whether Google Analytics is present in a website. Unless they want to rule that websites can't track users at-all (and what does that even mean?) when they're browsing in private mode (and how would they know?), but that would be omnibus legislating from the bench.
  - ehnto 6y ago
    I don't think that's abusing their monopoly, it's acknowledging that they are a monopoly and so they should be held accountable as a wholistic entity. I don't have a legislative outcome in mind, but I would like to point out that "Do Not Track" program was an attempt to do exactly what your second paragraph suggests, it just had no teeth and was entirely voluntary. I really don't think it's too big of an ask to not track someone flagging they don't want to be tracked, and if it takes regulation to do that then so be it. Ad-tech needs a wake up call to start behaving more ethically.
    - akersten 6y ago
      > I don't think that's abusing their monopoly, it's acknowledging that they are a monopoly and so they should be held accountable as a wholistic entity. The reason it would be abusing their monopoly is that Firefox and Edge private mode browsers would not get the same treatment. Google Analytics would still be active for them in private mode. The only ways out for parties here are: * Accept the way technology works, that browsers are separate from code that runs on websites, and acknowledge that users can be tracked regardless of what their browser chooses to do * Mandate that Google devise a way to stop tracking for all browsers in private mode (not a technically possible solution; judicial overreach), or just for Google Chrome (possible; but amplifies their monopoly because it would be a privacy incentive for users to switch to Chrome, a Google product; is also judicial overreach) * Mandate that browsers have a standard way to indicate to websites that they do not want to "be tracked" and websites must respect that (and I don't have to tell you that this one is judicial overreach :) ) So, that's why I say the only way forward that makes sense for this case is for the plaintiffs to drop it. There's no acceptable judicial recourse for them here. They can lobby the legislature if they want to make it mandatory that ad networks respect the abandoned Do-Not-Track header.
GeneralMayhem 6y ago
Right. Open up an incognito window right now, and you'll see, in plain English, front and center: >Your activity might still be visible to websites you visit. The error here is in treating all of Google and all of data as monoliths. The first paragraph of the article makes this... let's be generous and call it an honest mistake: > The Alphabet Inc. unit says activating the stealth mode in Chrome, or “private browsing” in other browsers, means the company won’t “remember your activity.” Yeah, I doubt anyone from Google says that, which is why they had to use phrases instead of sentences in quotes. Chrome won't remember your activity. That doesn't mean Google won't if they know who you are for some other reason.
- sammorrowdrums 6y ago
  And outside of Tor, your public IP says a lot... never mind profiling. It would be very hard to prevent, especially for the least legitimate tracking, and then if incognito makes itself too obvious, that info is also interesting for tracking... Privacy is hard
  - gruez 6y ago
    >and then if incognito makes itself too obvious, that info is also interesting for tracking... AFAIK that's already trivially detectable on most (all?) browsers.
    - sammorrowdrums 6y ago
      Yeah, and there are some excellent fingerprinting testing sites that show it that even from a single website visit you can be narrowed down substantially, and from there a few more visits to sites working together and they could easily pin you down to an exact person. The discussion about malicious actors is insane, even legitimate ones can do it easily.
  - swiley 6y ago
    Eventually everyone will be forced to use TOR because of stuff like this.
  - 6y ago
andjd 6y ago
I mean, it's all Google, right? If Google analytics is de-anonymizing you in incognito mode, does it matter if Google build a back door into Chrome, or whether they just didn't develop patches in Chrome to plug whatever workaround it's own tool was using? Furthermore, wouldn't a reasonable person expect when a company offers a product with a privacy feature, that at the very least it would provide privacy from trackers that the very same company controls?
macksd 6y ago
Yeah Google warns you when you enable Incognito mode that it's about Chrome won't store, and specifically says website's can still track you. I think the complaint is that in this case, Google wrote the code that is commonly used to do both. I think the lawyer is arguing that since Google gives the option in one product, they should honor it in the other. Honestly, I'm not sure how I feel about that argument, but it reminds me of the character Ned from 17 Again: "I wrote the software the prevents people from stealing music. Of course, I also wrote the software that helps people steal music..." Selling weapons to both sides and all that.
- munk-a 6y ago
  I think there are some strong reasons to want marketers to generally be less able to track our online activity and for fingerprinting of the style of Google Analytics or Facebook to not exist but Google is just one participant in this activity, it's particularly ironic that Google Analytics is working to actively counter the work of the Chrome team's incognito mode but I would only really be concerned if those two teams colluded to give Google Analytics a competitive advantage. I do generally think it's quite fair to view Alphabet as an unreasonably large company that needs to be subjected to anti-trust laws - there are many companies with far too broad a breadth of market control in the modern world. So maybe that's the better tactic, actually dust off our anti-trust laws and break up some of these tech giants.
- numpad0 6y ago
  Is act of selling weapons to both side, ethical? Is it automatically unethical, that it is considered a monopoly, that needs to be regulated, universally across industries and contexts? Or is it not?
- eternalban 6y ago
  > Selling weapons to both sides and all that. I wrote software that will track you on the net, not matter where or when. I also wrote the software the gives you the impression that you can do something about tracking.
- ehsankia 6y ago
  > since Google gives the option in one product, they should honor it in the other But it can't, because websites, in theory, aren't and shouldn't be able to detect if someone is in incognito mode. There's sometimes hacky ways, but so far Chrome has patched those as they've come up.
woah 6y ago
That's a pretty vague and ultimately meaningless distinction. You use a Google product that says it's not going to track you, and then it tracks you and sends your data to Google's servers. The fact that the link to Google's servers is on "other websites" doesn't really change the basic reality of what is happening.
- joshuamorton 6y ago
  But in context chrome doesn't track you. The website you visit tracks you.
  - ClumsyPilot 6y ago
    But in context falling out of a plane doesn't kill you. The land you hit kills you.
    - joshuamorton 6y ago
      To use your metaphor, if you jump out of a Boeing plane and land on a Boeing factory, it's not Boeing's fault that your parachute failed.
      - ClumsyPilot 6y ago
        well it is if they sold you the Boeing parachute that says "makes your fall safe" And then people go "but it was the landing, not the fall that killed you! The contract didn't say anything about that! "
        joshuamorton 6y ago
        But they don't. They manufactured the plane, and even had a warning on the door that jumping out is dangerous since parachutes can fail! I guess I should modify my comment above. You can't sue them for the plane being broken, which is what this suit is.
PastaMonster 6y ago
The problem is that google refuse to fix bugs that allow fingerprinting. Those bugs can be years old!! This is why we need laws that force devs to fix privacy and security bugs or pay HUGE!!! fines. Hit them where it hurts. If each unfixed bug costs them 25% of the company's total worth per MONTH while it remains unfixed I bet they will fix them very fast. The dev tools window is still detectable by malicious javascript on sites. That stops and hides when the dev tools window is detected. I am certain google use that detection for their malicious behavior too. Why else drag their feet? They are hypocritical. First they are anal-retentive about security and on the other hand they ignore bugs for years. Not to mention the double standard google have. Long ago they fixed chrome to detect auto-installed extensions when you installed other software and yet google is doing the same bloody thing themselves. Try it yourself on a fresh new profile and check the extension page and the extension folder. Extensions are auto installed without permission. Manually removing them doesn't work either. They will be reinstalled. Edit: Speaking the truth will get you down voted. It's hilarious people down vote instead of coming with a counter argument. Perhaps they are so annoyed because they can't make a legitimate excuse for that nasty malicious behavior.
onlyrealcuzzo 6y ago
Wasn't Incognito pretty much built so you could go to PornHub without every time you type P in your address bar it shows everyone looking at your screen what kind of porn you're into? Did Incognito give anyone any indication that it was somehow making you untrackable? It just meant that the browser itself wasn't storing what you were doing.
- vngzs 6y ago
  Incognito mode includes the following text on the new tab screen: > Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. > Chrome won't save the following information: Your browsing history, Cookies and site data, Information entered in forms > Your activity might still be visible to: Websites you visit, Your employer or school, Your internet service provider. I'm normally a pretty pro-digital privacy person, because I believe the odds are stacked against average consumers to an unimaginable degree. That said, I don't believe incognito mode is misleading about what it achieves. I think it's pretty upfront about what it does and what it doesn't do.
  - Nemo_bis 6y ago
    It would be interesting to see counterproofs to the claim that "other people who use this device won't see your activity". They might not see it in Chrome, but what if I search pregnancy tests and then another user of the same device sees Google Ads for pregnancy tests, or for baby products? They'll reasonably infer someone was looking for them and this might put lives in danger. The example is not theoretical: https://www.ftc.gov/news-events/blogs/business-blog/2021/01/health-app-broke-its-privacy-promises-disclosing-intimate https://www.ftc.gov/news-events/blogs/business-blog/2021/01/...
buttersbrian 6y ago
I get the complaint, when the browser and analytics stack are both Google. But what if the browser is Incognito Chrome, and the analytics is another company, say Adobe? Does the browser industry need a universal way to signal browsing is in "incognito" and then all analytics and tracking software MUST adhere to that, or what?
- lolinder 6y ago
  There's already the Do Not Track header, which is supposed to serve exactly this purpose. Its problem is it has no teeth. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
  - buttersbrian 6y ago
    Yes! You are right that it lacks teeth, but also maybe doesn't go far enough. I think that's where some hoped the GPC would come in. Also, does it mean that Amazon shouldn't log general traffic, that they later decide the analyze? Even Anonymized, that data holds value to the target site, even if it were never traded/sold/etc. Lot of room for improvement beyond DNT, GPC, etc.
zelon88 6y ago
The problem is that Google stands on both sides of this relationship. With Firefox there are borders around where your browser ends and the sites you visit begin. Google has been blurring that line between browser and content ever since single sign on in Chrome 69. I think it's a fair exercise to explore the relationship between Chrome and Google services just because they put themselves in this position for a reason. We deserve to know what that reason is. I don't trust Google at their word. With Firefox there's no question because Mozilla lacks the ability to leverage anything they might incidentally collect in private browsing. Google does have that ability and we should know if they are abusing it. If you asked Google employees and Google fans if they thought Google was reading their Gmail for advertising they'd probably roll their eyes at you. And alas they turned out to be mistaken.
- magicalist 6y ago
  > If you asked Google employees and Google fans if they thought Google was reading their Gmail for advertising they'd probably roll their eyes at you. And alas they turned out to be mistaken. Maybe you weren't around at the time or don't remember, but that was part of the launch announcement and never hidden and was mildly controversial at the time, for instance: https://www.nbcnews.com/id/wbna4732385 https://www.nbcnews.com/id/wbna4732385
cptskippy 6y ago
I think the question then becomes, is Google able to tie your Incongnito activity back to your regular activity?
- Nemo_bis 6y ago
  Obviously yes. The activity comes from the same IP address, user-agent and everything.
darth_avocado 6y ago
Why is this a surprising thing? The only thing incognito mode does is that your browser doesn't remember what you surfed on the internet, pretty much everything else is fair game. Your ISPs know what you're upto, adtech is so advanced that they can still track you purely based on your IP, all the websites pretty much know who you are (if you've visited them before) even if you don't log in, why is it so surprising?

by kop316 6y ago

Blikkentrekker 6y ago

Going incognito on Chromium still gives a warning that it does little for website tracking and purely does not save browsing history. So one can browse the finest pornography[1] without one's cohabitants finding out. [1] https://nhentai.net/g/335688/3/ https://nhentai.net/g/335688/3/

robteix 6y ago

> It doesn't seem like the complaint is that Chrome collects data on you in "Incognito" mode, rather that websites (e.g. Google Analytics) still collect on you in "Incognito" mode. Isn't that a distinction without a difference though? It's not Chrome, it's Google Analytics. It's all Google in the end, isn't it?

solidsnack9000 6y ago
It's all stuff from Google but in the hands of different people. Google Analytics is installed by the owner of the website; it makes a promise to them: it collects everything it can. If Google Analytics actually ignored data from Chrome in Incognito mode, it raises some questions: * How does it detect that, exactly? * Is there an unfair competition aspect to it? What about other browsers, not from Google?
- vinger 6y ago
  What other browser hold 70/80% of the market?
- fiddlerwoaroof 6y ago
  Yeah, making incognito mode detectable would be a huge privacy issue: it would enable blocking users based on incognito and all sorts of other bad issues. If incognito mode is undetectable, there’s no way for Google Analytics to distinguish between “cross-device” traffic from an incognito window vs. from a phone and a laptop. Whether or not cross-decide tracking is good or bad, it’s irrelevant to this question.
  - postalrat 6y ago
    How is blocking incognito a bad thing? Right there it should tell the user they need to avoid that site at any price. I'm pretty sure incognito is detectable right now. I'm always going to assume it is.
- bee_rider 6y ago
  That second point is really interesting. It seems sketchy on both ends, really. Either they are intentionally circumventing their own privacy feature, or they are giving their own browser an unfair competitive advantage. Huh, maybe the level of integration here is just inherently problematic and companies shouldn't try to fulfill every role in the market.
- unilynx 6y ago
  > If Google Analytics actually ignored data from Chrome in Incognito mode, it raises some questions: How does it detect that, exactly? The most honest implementation would be to set the DNT header in incognito mode (as Firefox apparently does) and to have Analytics honor it. Does not require anything shady/anticompetitive
  - captn3m0 6y ago
    This. Would be amazing to have a ruling enforcing DNT on GA, even if for Incognito since that gives backing to the DNT header, which has mostly been "don't honor" for advertisers.
ttt0 6y ago
Maybe it's the perfect time to seriously consider whether Google should be split up. They control everything. From a nameserver, through a web browser, to online services and advertisement.
TheRealPomax 6y ago
Not in court, no. In court that is a huge difference, because Google is a company, Chrome is a product, and Google Analytics is a technology, and those are completely different things. A good lawyer could quite successfully argue that all three being "Google" is not sufficient for the public to reasonably expect that "private browsing" means Google will still be monitoring you. And while Google would argue that its EULA no doubt contains a clause along those lines, the deception is still there, and can still be litigated (even if the verdict ends up being "this is deceptive and you must change this aspect of your product" without this particular thing, among many many others, requiring punitive measures)
- GavinMcG 6y ago
  This assertion without an argument is not especially helpful. What legal distinction must hold the line here, in your view? Why is it insufficient to suggest that a user in a Google Chrome Incognito window might reasonably expect Google to be on notice that they do not consent to Google tracking? Edit: the parent has since been edited. It had said only "Not in court, no. In court that is a huge difference."
  - hojjat12000 6y ago
    Because "incognito mode" is not about tracking! It is about saving information on your local machine. If you are in incognito mode and log into Gmail, you will see your own email! You are not incognito to Gmail. It used to be called "porn mode". I think that's a better name for incognito. It is there to stop others who use your computer to spy on you. Ofcourse you can use incognito (assuming you don't log into anything) and be reasonably anonymous (there are many other things that can track you even in incognito). I think it just need a rebranding. I vote "porn mode".
    - xiphias2 6y ago
      Porn mode is also about companies and governments finding out information that they can use to blackmail you.
    - 6y ago
GeneralMayhem 6y ago
No. Chrome is doing exactly what it says it is. It's different data, used for different purposes, by different entities. That's a huge legal difference, and also a significant practical one.
- loveistheanswer 6y ago
  No. Chrome is owned by Google. Claiming otherwise is like punching someone in the face with your right hand, and then telling the judge your right hand is a separate entity.
- GavinMcG 6y ago
  Or it's by the different parts of the same entity. Why are you confident that Google's internal choices about organizing their business are what win the day here, rather than Google's interface with the consumer?
- ttt0 6y ago
  Is it? What about X-Client-Data header?
root_axis 6y ago
The difference seems pretty meaningful. Google analytics really has nothing to do with Chrome in this context, the same thing would be true in any browser visiting a site with Google analytics tracking.
- kevin_thibedeau 6y ago
  Chrome is designed to give Google control of the information it collects. That is the only reason it exists. It has everything to do with GA. They're not burning millions on developers out of goodwill.
  - root_axis 6y ago
    > Chrome is designed to give Google control of the information it collects Sure, but chrome does not do this in incognito mode, same as any other private mode browser, there's nothing specific about chrome that allows GA to collect your analytics in incognito mode, GA can do so in any browser.
  - d1zzy 6y ago
    Says who? Not according to the public discussions at the time it was started.
7800 6y ago
Incognito mode isn’t privacy. It just keeps cookies and cache cleared initially for that incognito session. That’s like Firefox, etc. The EU and California notion that disabling cookies stops companies from tracking you is also false. Everything between you and the site can track you, and the site could track you without cookies. Even hiding your IP via using a VPN doesn’t protect privacy as much as you’d think, somewhat depending on the VPN provider and those interested. Tor? Not always private. If you don’t believe me, search for it and show me how to prove that it is or could be fully. And it makes you a target; why do you need that privacy, they ask? Privacy is a grey area.
fchu 6y ago
Not quite. Having a blanket "Google doesn't track you" statement doesn't capture the complexity of reality: what if the website you're browsing is using Firebase for their authentication, or Google Pay for payment. I'm certain most users would want the website to function correctly, otherwise it defeats the point of using incognito. In all of these cases, Google will have a record of you, even if those records are not actively joined. Where do you draw the line?

nsgi 6y ago

How can there be a reasonable expectation that websites won't track users in incognito mode when browsers don't give websites that information (unless the website works it out in a backwards way)?

jschwartzi 6y ago
Firefox sets the Do-Not-Track flag when you're browsing in Incognito mode. I think it's only Chrome that doesn't provide that information. So it's entirely possible for your analytics trackers to not forward those analytics on for users who are in Incognito mode if those users are using a browser like Firefox.
- deckard1 6y ago
  Do-Not-Track failed. According to Wikipedia, Apple dropped support and not many people adopted it anyway. It was always doomed to fail. You're asking the wolves not to eat you by setting an HTTP header. If these companies were the kind to care about the honor system, they wouldn't be tracking you in the first place.
  - wtetzner 6y ago
    I think the point jschwartzi was trying to make is that Do Not Track paired with legislation requiring companies to honor it could be a reasonable solution.
    - d1zzy 6y ago
      I'd still end up having to disable it because there are plenty of trackers that are not bound by US laws (or any laws) and providing DNT is a stronger identification signal than not giving it.
  - feoren 6y ago
    Regulation around Do-Not-Track failed, as it often does when captured by industry. The Do Not Call list started in 2003, but it seems it's starting to be taken a lot more seriously lately. Everyone should keep using Do-Not-Track and somehow logging/reporting/publishing violations of it (although I don't even know to whom -- maybe the best we can do is a version of plaintextoffenders for now). It can eventually end up as ammunition for a future bill to actually start regulating this effectively. Calling it a failure and abandoning it is not going to help.

eschulz 6y ago

Upon opening an Incognito tab, Chrome warns you that your activity might be visible to websites that you visit. I'm sure Google's attorneys are aware of this.

alasdair_ 6y ago
>Upon opening an Incognito tab, Chrome warns you that your activity might be visible to websites that you visit. I'm sure Google's attorneys are aware of this. To a layperson, there is a marked difference between activity and identity - there is nothing on the tab that states that the identity of the user is still discoverable.
- eschulz 6y ago
  You make a good point. There are trusting people, and then there are software devs and lawyers.
pessimizer 6y ago
Chrome warns you that websites that you visit may still track you. It doesn't warn you that Google, who owns Chrome, will still track you, which would put the lie to "incognito" anyway. It's as silly as if I ran an "anonymous" clinic where you didn't have to give your name, but my employees were instructed to figure out who you were by running in-house facial recognition software and to place the results in your file. That's materially different than warning people that "although our clinic is anonymous, you may be recognized in the waiting room by other patients" which is the way people understand Chrome's warning.
- bqmjjx0kac 6y ago
  There are many sites on the internet, and other clinics to visit in your metaphor.

ehnto 6y ago

I would agree. It's an interesting position to be put in. I think most of us in tech can see the technical separation between the two bits of software, and likely feel like Google Chrome is not responsible for Google Analytic's actions, but I wonder if the court will see it that way. I think it's not an unreasonable take that if a user has let Google know it doesn't want to be tracked, that Google shouldn't track them with any of the technology they have.

akersten 6y ago
> I think it's not an unreasonable take that if a user has let Google know it doesn't want to be tracked, that Google shouldn't track them with any of the technology they have. So the same people saying Google is a monopoly would say they must then further abuse their monopoly position to stop Google Analytics from tracking specifically Google Chrome users in incognito mode? The only correct outcome of this case is for those involved to realize that a browsers' "private browsing" mode is referring to a completely different type of privacy. It has nothing to do with whether Google Analytics is present in a website. Unless they want to rule that websites can't track users at-all (and what does that even mean?) when they're browsing in private mode (and how would they know?), but that would be omnibus legislating from the bench.
- ehnto 6y ago
  I don't think that's abusing their monopoly, it's acknowledging that they are a monopoly and so they should be held accountable as a wholistic entity. I don't have a legislative outcome in mind, but I would like to point out that "Do Not Track" program was an attempt to do exactly what your second paragraph suggests, it just had no teeth and was entirely voluntary. I really don't think it's too big of an ask to not track someone flagging they don't want to be tracked, and if it takes regulation to do that then so be it. Ad-tech needs a wake up call to start behaving more ethically.
  - akersten 6y ago
    > I don't think that's abusing their monopoly, it's acknowledging that they are a monopoly and so they should be held accountable as a wholistic entity. The reason it would be abusing their monopoly is that Firefox and Edge private mode browsers would not get the same treatment. Google Analytics would still be active for them in private mode. The only ways out for parties here are: * Accept the way technology works, that browsers are separate from code that runs on websites, and acknowledge that users can be tracked regardless of what their browser chooses to do * Mandate that Google devise a way to stop tracking for all browsers in private mode (not a technically possible solution; judicial overreach), or just for Google Chrome (possible; but amplifies their monopoly because it would be a privacy incentive for users to switch to Chrome, a Google product; is also judicial overreach) * Mandate that browsers have a standard way to indicate to websites that they do not want to "be tracked" and websites must respect that (and I don't have to tell you that this one is judicial overreach :) ) So, that's why I say the only way forward that makes sense for this case is for the plaintiffs to drop it. There's no acceptable judicial recourse for them here. They can lobby the legislature if they want to make it mandatory that ad networks respect the abandoned Do-Not-Track header.

GeneralMayhem 6y ago

Right. Open up an incognito window right now, and you'll see, in plain English, front and center: >Your activity might still be visible to websites you visit. The error here is in treating all of Google and all of data as monoliths. The first paragraph of the article makes this... let's be generous and call it an honest mistake: > The Alphabet Inc. unit says activating the stealth mode in Chrome, or “private browsing” in other browsers, means the company won’t “remember your activity.” Yeah, I doubt anyone from Google says that, which is why they had to use phrases instead of sentences in quotes. Chrome won't remember your activity. That doesn't mean Google won't if they know who you are for some other reason.

sammorrowdrums 6y ago
And outside of Tor, your public IP says a lot... never mind profiling. It would be very hard to prevent, especially for the least legitimate tracking, and then if incognito makes itself too obvious, that info is also interesting for tracking... Privacy is hard
- gruez 6y ago
  >and then if incognito makes itself too obvious, that info is also interesting for tracking... AFAIK that's already trivially detectable on most (all?) browsers.
  - sammorrowdrums 6y ago
    Yeah, and there are some excellent fingerprinting testing sites that show it that even from a single website visit you can be narrowed down substantially, and from there a few more visits to sites working together and they could easily pin you down to an exact person. The discussion about malicious actors is insane, even legitimate ones can do it easily.
- swiley 6y ago
  Eventually everyone will be forced to use TOR because of stuff like this.
- 6y ago

andjd 6y ago

I mean, it's all Google, right? If Google analytics is de-anonymizing you in incognito mode, does it matter if Google build a back door into Chrome, or whether they just didn't develop patches in Chrome to plug whatever workaround it's own tool was using? Furthermore, wouldn't a reasonable person expect when a company offers a product with a privacy feature, that at the very least it would provide privacy from trackers that the very same company controls?

macksd 6y ago

Yeah Google warns you when you enable Incognito mode that it's about Chrome won't store, and specifically says website's can still track you. I think the complaint is that in this case, Google wrote the code that is commonly used to do both. I think the lawyer is arguing that since Google gives the option in one product, they should honor it in the other. Honestly, I'm not sure how I feel about that argument, but it reminds me of the character Ned from 17 Again: "I wrote the software the prevents people from stealing music. Of course, I also wrote the software that helps people steal music..." Selling weapons to both sides and all that.

munk-a 6y ago
I think there are some strong reasons to want marketers to generally be less able to track our online activity and for fingerprinting of the style of Google Analytics or Facebook to not exist but Google is just one participant in this activity, it's particularly ironic that Google Analytics is working to actively counter the work of the Chrome team's incognito mode but I would only really be concerned if those two teams colluded to give Google Analytics a competitive advantage. I do generally think it's quite fair to view Alphabet as an unreasonably large company that needs to be subjected to anti-trust laws - there are many companies with far too broad a breadth of market control in the modern world. So maybe that's the better tactic, actually dust off our anti-trust laws and break up some of these tech giants.
numpad0 6y ago
Is act of selling weapons to both side, ethical? Is it automatically unethical, that it is considered a monopoly, that needs to be regulated, universally across industries and contexts? Or is it not?
eternalban 6y ago
> Selling weapons to both sides and all that. I wrote software that will track you on the net, not matter where or when. I also wrote the software the gives you the impression that you can do something about tracking.
ehsankia 6y ago
> since Google gives the option in one product, they should honor it in the other But it can't, because websites, in theory, aren't and shouldn't be able to detect if someone is in incognito mode. There's sometimes hacky ways, but so far Chrome has patched those as they've come up.

woah 6y ago

That's a pretty vague and ultimately meaningless distinction. You use a Google product that says it's not going to track you, and then it tracks you and sends your data to Google's servers. The fact that the link to Google's servers is on "other websites" doesn't really change the basic reality of what is happening.

joshuamorton 6y ago
But in context chrome doesn't track you. The website you visit tracks you.
- ClumsyPilot 6y ago
  But in context falling out of a plane doesn't kill you. The land you hit kills you.
  - joshuamorton 6y ago
    To use your metaphor, if you jump out of a Boeing plane and land on a Boeing factory, it's not Boeing's fault that your parachute failed.
    - ClumsyPilot 6y ago
      well it is if they sold you the Boeing parachute that says "makes your fall safe" And then people go "but it was the landing, not the fall that killed you! The contract didn't say anything about that! "
      - joshuamorton 6y ago
        But they don't. They manufactured the plane, and even had a warning on the door that jumping out is dangerous since parachutes can fail! I guess I should modify my comment above. You can't sue them for the plane being broken, which is what this suit is.

PastaMonster 6y ago

The problem is that google refuse to fix bugs that allow fingerprinting. Those bugs can be years old!! This is why we need laws that force devs to fix privacy and security bugs or pay HUGE!!! fines. Hit them where it hurts. If each unfixed bug costs them 25% of the company's total worth per MONTH while it remains unfixed I bet they will fix them very fast. The dev tools window is still detectable by malicious javascript on sites. That stops and hides when the dev tools window is detected. I am certain google use that detection for their malicious behavior too. Why else drag their feet? They are hypocritical. First they are anal-retentive about security and on the other hand they ignore bugs for years. Not to mention the double standard google have. Long ago they fixed chrome to detect auto-installed extensions when you installed other software and yet google is doing the same bloody thing themselves. Try it yourself on a fresh new profile and check the extension page and the extension folder. Extensions are auto installed without permission. Manually removing them doesn't work either. They will be reinstalled. Edit: Speaking the truth will get you down voted. It's hilarious people down vote instead of coming with a counter argument. Perhaps they are so annoyed because they can't make a legitimate excuse for that nasty malicious behavior.

onlyrealcuzzo 6y ago

Wasn't Incognito pretty much built so you could go to PornHub without every time you type P in your address bar it shows everyone looking at your screen what kind of porn you're into? Did Incognito give anyone any indication that it was somehow making you untrackable? It just meant that the browser itself wasn't storing what you were doing.

vngzs 6y ago
Incognito mode includes the following text on the new tab screen: > Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. > Chrome won't save the following information: Your browsing history, Cookies and site data, Information entered in forms > Your activity might still be visible to: Websites you visit, Your employer or school, Your internet service provider. I'm normally a pretty pro-digital privacy person, because I believe the odds are stacked against average consumers to an unimaginable degree. That said, I don't believe incognito mode is misleading about what it achieves. I think it's pretty upfront about what it does and what it doesn't do.
- Nemo_bis 6y ago
  It would be interesting to see counterproofs to the claim that "other people who use this device won't see your activity". They might not see it in Chrome, but what if I search pregnancy tests and then another user of the same device sees Google Ads for pregnancy tests, or for baby products? They'll reasonably infer someone was looking for them and this might put lives in danger. The example is not theoretical: https://www.ftc.gov/news-events/blogs/business-blog/2021/01/health-app-broke-its-privacy-promises-disclosing-intimate https://www.ftc.gov/news-events/blogs/business-blog/2021/01/...

buttersbrian 6y ago

I get the complaint, when the browser and analytics stack are both Google. But what if the browser is Incognito Chrome, and the analytics is another company, say Adobe? Does the browser industry need a universal way to signal browsing is in "incognito" and then all analytics and tracking software MUST adhere to that, or what?

lolinder 6y ago
There's already the Do Not Track header, which is supposed to serve exactly this purpose. Its problem is it has no teeth. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
- buttersbrian 6y ago
  Yes! You are right that it lacks teeth, but also maybe doesn't go far enough. I think that's where some hoped the GPC would come in. Also, does it mean that Amazon shouldn't log general traffic, that they later decide the analyze? Even Anonymized, that data holds value to the target site, even if it were never traded/sold/etc. Lot of room for improvement beyond DNT, GPC, etc.

zelon88 6y ago

The problem is that Google stands on both sides of this relationship. With Firefox there are borders around where your browser ends and the sites you visit begin. Google has been blurring that line between browser and content ever since single sign on in Chrome 69. I think it's a fair exercise to explore the relationship between Chrome and Google services just because they put themselves in this position for a reason. We deserve to know what that reason is. I don't trust Google at their word. With Firefox there's no question because Mozilla lacks the ability to leverage anything they might incidentally collect in private browsing. Google does have that ability and we should know if they are abusing it. If you asked Google employees and Google fans if they thought Google was reading their Gmail for advertising they'd probably roll their eyes at you. And alas they turned out to be mistaken.

magicalist 6y ago
> If you asked Google employees and Google fans if they thought Google was reading their Gmail for advertising they'd probably roll their eyes at you. And alas they turned out to be mistaken. Maybe you weren't around at the time or don't remember, but that was part of the launch announcement and never hidden and was mildly controversial at the time, for instance: https://www.nbcnews.com/id/wbna4732385 https://www.nbcnews.com/id/wbna4732385

cptskippy 6y ago

I think the question then becomes, is Google able to tie your Incongnito activity back to your regular activity?

Nemo_bis 6y ago
Obviously yes. The activity comes from the same IP address, user-agent and everything.

darth_avocado 6y ago

Why is this a surprising thing? The only thing incognito mode does is that your browser doesn't remember what you surfed on the internet, pretty much everything else is fair game. Your ISPs know what you're upto, adtech is so advanced that they can still track you purely based on your IP, all the websites pretty much know who you are (if you've visited them before) even if you don't log in, why is it so surprising?