A U.S. district judge in California has ruled that users can sue Google for collecting user data when they use Chrome’s in-private (incognito) mode. The class action will now proceed. No, no action so far in Australia. In-private browsing sounds good. Any inexperienced user thinks that just because the screen turns to dark mode or even has a notice that it is in private mode, they are anonymous. Well, no, it is not. Before we lambast Google, let’s look at the issue.
In private browsing (according to Microsoft Edge based on Google Chrome)
- Deletes your browsing info when you close all InPrivate windows (we presume cookies and browsing history)
- Saves collections, favourites, and downloads
- Prevents Microsoft Bing searches from being associated with you
What in-private browsing does not do
- Hide your browsing history from your school, employer, or internet service provider (it won’t be on the PC but traceable via your device’s IP address)
- Give you additional protection from tracking by default (you must select ‘strict’ tracking prevention that can prevent many websites from operating)
- Add additional protection to what’s available in normal browsing
Google Chrome defines similar issues here. But there is a kicker. Sites you visit may not respect ‘Do Not Track’ requests (most don’t) and may exfiltrate data like
- Websites you visit, including the ads and resources used on those sites
- Websites you sign in to
- Your employer, school, or whoever runs the network you’re using
- Your internet service provider
- Search engines may show search suggestions based on your location or activity in your current Incognito browsing session. When you search on Google, Google will always estimate the general area that you’re searching from
Many sites you visit will place alternative or extra tracking tools like transparent gifs, machine fingerprints and more even if you are using in-private browsing. You can’t win just by blocking cookies.
What is the in-private case about?
Basically, that even in-private Google still uses tracking tools including Google Analytics, Google Ad Manager, the Google app on mobile devices, and the Google sign-in button for websites. Most websites use Google Analytics and Ad Manager too. It is pretty standard stuff to earn click revenue for the site.
Through its pervasive data tracking business, Google knows who your friends are, what your hobbies are, what you like to eat, what movies you watch, where and when you like to shop, what your favourite vacation destinations are, what your favourite colour is, and even the most intimate and potentially embarrassing things you browse on the internet — regardless of whether you follow Google’s advice to keep your activities’ private’.
Attorneys for the plaintiffs.
As Google says (admittedly in fine print), using Chrome’s in-private browsing mode does not mean users are “invisible.” The company contends that its privacy policy, which the users (plaintiffs) consented to, disclose that it receives user data when they browse online.
But it seems that while in-private may be invisible to some other parties, Google omits itself from the list of entities to which a user’s private browsing activity may be visible.
GadgetGuy’s take
In-private browsers are not – privacy policy is an oxymoron. As we said earlier, let’s not lambast Google. The real culprits are the internet regulators that allowed this to happen via ignorance, inaction, intractability and big-tech influence. Google and every other browser, search engine, website, social media site, and the whole internet operate in the grey area between legal and ethical privacy definitions. It is like lying by omission!
If you need to have some privacy, want to stop your web activity tracking, there are a few things you can and should do.
These are mainly Windows options. Android, Apple macOS and iOS users are welcome to submit their favourite personal security apps.
First, install and use VPN. Use a paid one as the free ones can and will spy on you. I like Private Internet Access or NordVPN that are available on most platforms. This disguises your actual IP address.
Second, use a different browser like Firefox (my preference) and set it to maximum privacy.
Third, consider using Duck Duck Go as your search engine. It has a Firefox extension and also has a private browser. The downside is the anonymous results are not location-based.
Fourth, use an ad and cookie tracking blocker like Ghostery (now owned by Firefox but work with most browsers). It has a free plan that is adequate for most users.
Finally, keep a clean PC. Two free tools will help clean all browser traces, and these are 100% safe to use. Wise Cleaner (set it to 100% clean) and Wise Registry Cleaner (use intensive mode) here used at least weekly will remove all traces of web history and make your system run more smoothly.
Windows users will also benefit enormously from installing O&O ShutUp 10 (a good general read on Windows Privacy), the Windows security dashboard that Microsoft should have invented. It can lock up Windows tighter than a fish’s sphincter. And if you ‘break’ something, there is a handy restore button to allow you to play with settings to suit your paranoia level.
Good advice, Ray! And in a similar vein: “Android, iOS beam telemetry to Google, Apple even when you tell them not to” at https://www.theregister.com/2021/04/01/android_ios_location/