3 ms·

Hi, I'm Dr Tim Libert, founder of webXray who did this audit. Happy to answer questions from YC'ers. [Note, stepping away for some mental health exercise, str

by tlibert 6mo ago

Hi, I'm Dr Tim Libert, founder of webXray who did this audit. Happy to answer questions from YC'ers. [Note, stepping away for some mental health exercise, stressful day!] I also want to push back on Google telling the press our California Privacy Audit is "is based on a fundamental misunderstanding of how [Google's] products work". I'm the former head of Cookie Compliance at Google and I have the federal court filings that show their statements are not simply true, and Google knows it isn't true. For the record, here are direct quotes from a federal court filing made by Google's "Data Protection Officer and Senior Director of Privacy", who stated that "If called to testify as a witness, [they] could and would testify competently to such facts under oath." Here are those facts: * "Due to Dr. Libert’s academic background focusing on cookies, he became one of the primary members of the team assisting with Google’s cookie compliance and governance efforts..." * "Dr. Libert quickly assumed responsibility for aiding our in-house regulatory lawyers in addressing governmental investigations into cookies..." * "Dr. Libert often worked under the guidance of in-house counsel to develop technical solutions to issues raised by privacy regulators..." * "Dr. Libert was also responsible for the development of internal policies on cookies and web storage. He drafted Google’s internal cookie guidelines in 2021 and early 2022, which applies to all cookies or cookies-like objects, and outlines processes on managing cookies, storing cookies, logging data associated with cookies, server protocols, policies on data collection, and data linkage..." * "By developing the policy and conducting the audit, Dr. Libert gained insight into every Google-owned cookie deployed across Google’s web properties..." * "Dr. Libert also proposed changes to how Google interprets specific definitions across its products’ various privacy policies. This included work on policies relating to analytics and advertising services used by third-party apps and websites..." -- TLDR: Google can say what they want about me in public, but when they are under oath in a federal court of law, this is what they really say.

bilekas 6mo ago
No questions to ask, just wanted to say thank you for your work. I'm sure it's not easy and definitely less stressful to just leave things be. Thank you.
- tlibert 6mo ago
  This is a phenomenally stressful day, I pissed of Google, Microsoft, and Meta in one shot, and they will come after me again. We do it because we believe in our product, and we'll stand the test anybody - even BigTech - puts us to: https://webxray.ai/ https://webxray.ai/
steve1977 6mo ago
> I'm the former head of Cookie Compliance If the Internet didn't turn out the way it turned out, this could have been the greatest job ever.
- tlibert 6mo ago
  Being the best in the world at what you do and not being allowed to do it is...not the greatest job. ;-)
  - nextzck 6mo ago
    Thank you for doing it anyways. The state of things seriously depresses me. We used to leave platforms just for putting up banner ads.
mentalgear 6mo ago
Thanks for speaking out publicly - especially as an Ex-Big Tech employee who knows the internal workings of these companies - and actually trying to do something about this. I personally felt many times being tracked by Google or other big tech companies showing me something relevant to previous search queries even though they were made on different platforms and using adblock extensions (ublock origin). So their active tracking is definitely very elaborate.
- tlibert 6mo ago
  I won't lie, I miss the Staff/L6 paycheck and lack of stress. This is way less money for way more stress, but I chart my own path. I'm proud of what my company https://webxray.ai https://webxray.ai is doing.
hmokiguess 6mo ago
Apologies in advance an excuse my ignorance as I am going on a hunch here and don't have much rather than perhaps frustration driving my comment, but it feels like this isn't the first and nor will be the last we find stuff like this. I can't help but think they will pay the fines and go on continuing doing this, which makes it seem like it just evolved into a scheme where the government now takes their cut.
- tlibert 6mo ago
  I've been at this 15 years now, and it's neither the first nor last thing I'll do. We call the site "Global Privacy Audit" because California is first. The laws in California are weaker than elsewhere in the world. This is a warm up for the main dish.
- nextzck 6mo ago
  Sadly this isn’t even that bad compared to what’s in their own app binaries. If you’ve got an old iPhone you can jb and some claude usage to spare I highly recommend hooking up a ghidra mcp so you can see for yourself. I don’t have any of their apps on my phone. And there is no known method to get rid of the trackers in your iCloud keychain.
nostrademons 6mo ago
The GPC spec does not say "no cookies will be set" [1], and does not mention cookies at all. It merely provides a way for the user to indicate their preference that their information not be shared or tracked. The spec even says: > In the absence of regulatory, legal, or other requirements, websites can interpret an expressed Global Privacy Control preference as they find most appropriate for the given person, particularly as considered in light of the person's privacy expectations, context, and cultural circumstances. The CCPA [2] also never explicitly mentions cookies or forbids them from being set. The relevant passages about opting out on the sale of personal information are: > a) A business shall provide two or more designated methods for submitting requests to opt-out, including an interactive form accessible via a clear and conspicuous link titled “Do Not Sell My Personal Information,” on the business’s website or mobile application. Other acceptable methods for submitting these requests include, but are not limited to, a toll-free phone number, a designated email address, a form submitted in person, a form submitted through the mail, and user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information How would you respond to their claim that you are fundamentally misunderstanding GPC, and that the spec and the law do not mean you never set cookies, they mean that you must honor the preferences expressed by the header in backend processes that involve tracking or sale of personal information? [1] https://w3c.github.io/gpc/ https://w3c.github.io/gpc/ [2] https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oal-sub-final-text-of-regs.pdf https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oa...?
- tlibert 6mo ago
  To quote our report: At webXray we are experts in tracking technologies, and we work closely with in-house counsel, defense, plaintiff firms, and regulators. However, we are not lawyers ourselves, thus nothing in this report represents a legal conclusion. webXray was not founded to supplant the role of lawyers, courts, or judges. We were founded to provide clear, accurate, forensic data, without fear or favor. We believe that by filling this gap we can enhance outcomes for all consumers, businesses, and regulators. --- We are filing the gap related to reliable facts not existing. We did a scientifically controlled test with GPC on and off. We presented the results as technical findings along with general background. We are not lawyers, and we are happy to help others perform their own audits: https://webxray.ai https://webxray.ai - we have no desire to be lawyers. We are a hard-tech engineering outfit, we deliver scientific clarity on complex topics.
throwawayq3423 6mo ago
Not sure why you're being downvoted. Thank you for what you do.
- tlibert 6mo ago
  Appreciated, means a lot. I'm not surprised at the downvotes, but someday we all have to look in the mirror and decide if we like what we see, but it's easier to downvote in the meantime.
  - nickburns 6mo ago
    If I may... I suspect quite a few of your comments have been downvoted for being a little—frenetic. In many ways, your work here (together with your previous work experience) speaks for itself, at least to those of us who get it. Unfortunately, awareness-raising and solution-building are probably two entirely separate stages for this issue.
    - tlibert 6mo ago
      I’m used to a quick fire response format for legal questioning. My words are carefully chosen, but I do reply quickly because I played every question in my head in advance. The dig on downvotes however was intentionally cheeky. I’m well respected by many engineers who worked with me, no hard feelings, just a little teasing.
- jmye 6mo ago
  There are a lot of Google and Meta engineers who are convinced that they're not the bad guys.

by tlibert 6mo ago

bilekas 6mo ago

No questions to ask, just wanted to say thank you for your work. I'm sure it's not easy and definitely less stressful to just leave things be. Thank you.

tlibert 6mo ago
This is a phenomenally stressful day, I pissed of Google, Microsoft, and Meta in one shot, and they will come after me again. We do it because we believe in our product, and we'll stand the test anybody - even BigTech - puts us to: https://webxray.ai/ https://webxray.ai/

steve1977 6mo ago

> I'm the former head of Cookie Compliance If the Internet didn't turn out the way it turned out, this could have been the greatest job ever.

tlibert 6mo ago
Being the best in the world at what you do and not being allowed to do it is...not the greatest job. ;-)
- nextzck 6mo ago
  Thank you for doing it anyways. The state of things seriously depresses me. We used to leave platforms just for putting up banner ads.

mentalgear 6mo ago

Thanks for speaking out publicly - especially as an Ex-Big Tech employee who knows the internal workings of these companies - and actually trying to do something about this. I personally felt many times being tracked by Google or other big tech companies showing me something relevant to previous search queries even though they were made on different platforms and using adblock extensions (ublock origin). So their active tracking is definitely very elaborate.

tlibert 6mo ago
I won't lie, I miss the Staff/L6 paycheck and lack of stress. This is way less money for way more stress, but I chart my own path. I'm proud of what my company https://webxray.ai https://webxray.ai is doing.

hmokiguess 6mo ago

Apologies in advance an excuse my ignorance as I am going on a hunch here and don't have much rather than perhaps frustration driving my comment, but it feels like this isn't the first and nor will be the last we find stuff like this. I can't help but think they will pay the fines and go on continuing doing this, which makes it seem like it just evolved into a scheme where the government now takes their cut.

tlibert 6mo ago
I've been at this 15 years now, and it's neither the first nor last thing I'll do. We call the site "Global Privacy Audit" because California is first. The laws in California are weaker than elsewhere in the world. This is a warm up for the main dish.
nextzck 6mo ago
Sadly this isn’t even that bad compared to what’s in their own app binaries. If you’ve got an old iPhone you can jb and some claude usage to spare I highly recommend hooking up a ghidra mcp so you can see for yourself. I don’t have any of their apps on my phone. And there is no known method to get rid of the trackers in your iCloud keychain.

nostrademons 6mo ago

The GPC spec does not say "no cookies will be set" [1], and does not mention cookies at all. It merely provides a way for the user to indicate their preference that their information not be shared or tracked. The spec even says: > In the absence of regulatory, legal, or other requirements, websites can interpret an expressed Global Privacy Control preference as they find most appropriate for the given person, particularly as considered in light of the person's privacy expectations, context, and cultural circumstances. The CCPA [2] also never explicitly mentions cookies or forbids them from being set. The relevant passages about opting out on the sale of personal information are: > a) A business shall provide two or more designated methods for submitting requests to opt-out, including an interactive form accessible via a clear and conspicuous link titled “Do Not Sell My Personal Information,” on the business’s website or mobile application. Other acceptable methods for submitting these requests include, but are not limited to, a toll-free phone number, a designated email address, a form submitted in person, a form submitted through the mail, and user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information How would you respond to their claim that you are fundamentally misunderstanding GPC, and that the spec and the law do not mean you never set cookies, they mean that you must honor the preferences expressed by the header in backend processes that involve tracking or sale of personal information? [1] https://w3c.github.io/gpc/ https://w3c.github.io/gpc/ [2] https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oal-sub-final-text-of-regs.pdf https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oa...?

tlibert 6mo ago
To quote our report: At webXray we are experts in tracking technologies, and we work closely with in-house counsel, defense, plaintiff firms, and regulators. However, we are not lawyers ourselves, thus nothing in this report represents a legal conclusion. webXray was not founded to supplant the role of lawyers, courts, or judges. We were founded to provide clear, accurate, forensic data, without fear or favor. We believe that by filling this gap we can enhance outcomes for all consumers, businesses, and regulators. --- We are filing the gap related to reliable facts not existing. We did a scientifically controlled test with GPC on and off. We presented the results as technical findings along with general background. We are not lawyers, and we are happy to help others perform their own audits: https://webxray.ai https://webxray.ai - we have no desire to be lawyers. We are a hard-tech engineering outfit, we deliver scientific clarity on complex topics.

throwawayq3423 6mo ago

Not sure why you're being downvoted. Thank you for what you do.

tlibert 6mo ago
Appreciated, means a lot. I'm not surprised at the downvotes, but someday we all have to look in the mirror and decide if we like what we see, but it's easier to downvote in the meantime.
- nickburns 6mo ago
  If I may... I suspect quite a few of your comments have been downvoted for being a little—frenetic. In many ways, your work here (together with your previous work experience) speaks for itself, at least to those of us who get it. Unfortunately, awareness-raising and solution-building are probably two entirely separate stages for this issue.
  - tlibert 6mo ago
    I’m used to a quick fire response format for legal questioning. My words are carefully chosen, but I do reply quickly because I played every question in my head in advance. The dig on downvotes however was intentionally cheeky. I’m well respected by many engineers who worked with me, no hard feelings, just a little teasing.
jmye 6mo ago
There are a lot of Google and Meta engineers who are convinced that they're not the bad guys.