By Dell Cameron and Andrew Couts
If you still hold any notion that Google Chrome’s “Incognito mode” is a good way to protect your privacy online, now’s a good time to stop.
Google has agreed to delete “billions of data records” the company collected while users browsed the web using Incognito mode, according to documents filed in federal court in San Francisco on Monday. The agreement, part of a settlement in a class action lawsuit filed in 2020, caps off years of disclosures about Google’s practices that shed light on how much data the tech giant siphons from its users—even when they’re in private-browsing mode.
Under the terms of the settlement, Google must further update the Incognito mode “splash page” that appears anytime you open an Incognito mode Chrome window after previously updating it in January. The Incognito splash page will explicitly state that Google collects data from third-party websites “regardless of which browsing or browser mode you use,” and stipulate that “third-party sites and apps that integrate our services may still share information with Google,” among other changes. Details about Google’s private-browsing data collection must also appear in the company’s privacy policy.
Furthermore, Google will erase some of the data it previously gathered on Incognito users. This comprises “private-browsing data” over “nine months” old since the settlement terms were agreed upon last December and private-browsing data acquired during December 2023. However, many documents referring to Google’s data collection techniques within the case remain classified, raising questions about the completeness of the deletion process.
Google’s representative, Jose Castaneda, stated that the organization takes pleasure in erasing ancient technical information that was never linked to a person and was never utilized for personalization. He also highlighted that the firm wouldn’t pay a cent as a settlement amount after initially facing a $5 billion charge.
Google is expected to take other measures such as persist in blocking third-party cookies within Incognito mode for five years, partially concealing IP addresses to avoid re-identifying anonymized user data, and eliminating certain header data that can currently be used to recognize users with Incognito mode switched on.
The data-removal section of the agreed payment reflects Google’s proactive changes to its Incognito mode data collection and the ways it describes the functionality of Incognito mode. Google has been gradually eliminating third-party cookies for nearly four years and declares it will entirely block them by the end of 2024. Google updated Chrome’s Incognito mode “burn page” in January with less strong language to suggest that using Incognito is not “private,” but rather “more private” than not utilizing it.
revamped Chrome’s Incognito mode “welcome page”
The settlement’s relief is strictly “injunctive,” meaning its central purpose is to put an end to Google activities that the plaintiffs claim are unlawful. The settlement does not rule out any future claims—The Wall Street Journal reports that the plaintiffs’ attorneys had filed at least 50 such lawsuits in California on Monday—though the plaintiffs note that monetary relief in privacy cases is far more difficult to obtain. The important thing, the plaintiffs’ lawyers argue, is effecting changes at Google now that will provide the greatest, immediate benefit to the largest number of users.
Critics of Incognito, a staple of the Chrome browser since 2008, say that, at best, the protections it offers fall flat in the face of the sophisticated commercial surveillance bearing down on most users today; at worst, they say, the feature fills people with a false sense of security, helping companies like Google passively monitor millions of users who’ve been duped into thinking they’re browsing alone.
Tik Root
Leif Wenar
Matt Kamen
Kate O’Flaherty
