Google Chrome is snooping in incognito mode and now has to delete data

Monitoring everywhere
Why Google’s incognito mode isn’t private at all – and that’s finally changing

There are many websites that not everyone should know that you are visiting – not even Google. But just turning on private mode is not enough to stop snooping. Now the company has to delete billions of data records that were still stored.

The official example is almost a little cute: If you google a birthday present for your loved ones, but you don’t want them to find out about it – then you switch on the browser’s private mode. In many cases it will probably be used for slightly different needs. But most people hope for much more from the mode than it actually offers: there is very little that is private about it – Google is diligently snooping. But now the company has to change that.

This is the result of a class action lawsuit that was filed against Google in 2020. She accused the group of deliberately keeping its users in the dark in marketing and communication about how Google’s private mode, called “incognito mode”, works – and what data the group continues to collect about its customers. Now the proceedings have ended with a settlement filed on Monday in a San Francisco court. According to the documents, Google not only has to change the way it handles the data – but also delete billions of data records.

Google Chrome: How private is incognito mode really?

The private mode has so far worked significantly differently than one would intuitively assume. If you switch on a private window, only the history in this window, possibly data entered in forms and permitted cookies are not saved. However, the mode neither suppresses tracking by Google itself nor by other websites. In plain language: Private mode only protects you from prying eyes from other people who are also using the device. Anyone else who is interested will continue to read along as usual.

Even the mode’s activation window now openly admits this: “Other people who use this device cannot see your activities, so you can surf privately,” Google’s Chrome browser explains the mode. And then adds: “This has no impact on how data is collected by the websites you visit and the services you use, including Google.”

Porn sites know who is surfing there

And this is being used diligently: A study showed in 2019 that internet giants such as Meta (then still Facebook) and Google were able to track their registered users through porn sites – regardless of whether they used private mode or not. At that time, researchers from Carnegie Mellon University, the University of Pennsylvania and Microsoft examined 22,484 porn sites for so-called tracking tools. And they found what they were looking for: More than 93 percent of the sites mercilessly passed on the data to the Internet giants. Google’s trackers alone were found on 74 percent of the sleazy sites, while Facebook’s were still found on 10 percent.

The data collectors could then process the very private preferences with the users’ other profile data and use them for advertising purposes, for example. According to its own statements, Google did not want to do that: “Personalized advertising and advertising profiles that are based on a user’s sexual interests or related activities on the Internet” were avoided, the company told the New York Times at the time.

Billions of records are deleted

Lawyer David Boies calculated how valuable the information was for Google based on more available data: For a while, Google was willing to pay money for user data and transferred three dollars a month for data that could not be determined otherwise. If all of the 136 million possible co-plaintiffs in the USA were to use just one device twice a year, the total would be $6.12 billion, the lawyers calculate in the documents filed on Monday. Of course, most people probably use the browser much more often. “These are very conservative calculations,” it says.

Google now wants to restrict data flows with two measures: On the one hand, the company promised to delete billions of data records that were saved during private sessions. On the other hand, the group promises to significantly reduce data collection in private mode for at least five years. This has been the case for a long time with regard to third-party providers: in 2020, in response to the lawsuit, the company introduced that Chrome prevents the setting of third-party cookies in private mode by default, thereby making tracking more difficult. The agreement now states that the company wants to keep it that way. It was a “historic agreement,” enthused lawyer Boies to “Ars Technica.”

“Historic” success or just triviality?

The company sees things a little differently. “The plaintiffs actually wanted five billion dollars and got nothing from it,” Google spokesman José Castañed told Ars Technica. He also downplays the deletion of the data, saying it is “not particularly important,” said the spokesman. “We have never connected Incognito Mode data to user profiles or used it for personalization.” The agreement shows that Google initially claimed that it could not find the data, but ultimately agreed to delete it.

It is still unclear whether Google will have to pay any additional money. The agreement does not provide for any direct payments to the plaintiffs – the data deletion is also viewed by the plaintiffs as a financial contribution from Google. However, the agreement leaves open the possibility of individually claiming compensation. About 50 claimants are already preparing corresponding lawsuits in California, Boies told the Wall Street Journal.

This is how you surf truly privately

However, if you really want to surf untracked, you should think about using a browser other than Chrome anyway. After all, advertising is Google’s business model. The previously popular Mozilla Firefox, for example, has been positioning itself as a data protection alternative for years. The browser, which is operated by a foundation, has been blocking all attempts to collect the data in private mode since 2021. The collecting madness of social networks such as Facebook is also prevented by so-called “containers”: While Facebook, Tiktok and Co. also try to access the data from other tabs in other browsers, in Firefox they are locked in a digital container – and cannot be read out become.

Sources:Settlement documents, New York Times, Ars Technica, Wall Street Journal