From Surveillance to Security: Google Reworks Incognito Data Practices

Google has agreed to modify how it manages data collected in Chrome’s Incognito mode.

This decision comes after legal scrutiny revealed that the tech giant’s private browsing feature might not have been as private as users believed.

Since 2008, critics have argued that Incognito fails to protect users from surveillance and gives a false sense of security, aiding companies like Google in passive monitoring. In 2020, Google account holders sued the company for allegedly tracking their activities through Incognito mode.

This mode offers client-side privacy by not storing browsing history locally but does not hide visits from Google. The lawsuit challenged Google’s language suggesting otherwise, extending to data collection in private modes across browsers.?

What Will Google Do?

Approval of the settlement is pending from US District Judge Yvonne Gonzalez Rogers, expected on July 30.

If a California federal judge approves the settlement, Google must destroy billions of web browsing data records collected in “Incognito mode” on Google Chrome before December 2023. Any information that cannot be deleted must be de-identified. The number of people affected by Google’s actions could be as high as 136 million users.

To further protect user privacy, Google plans to obscure parts of IP addresses and remove specific page identifiers from URLs collected during Incognito sessions. These changes aim to ensure that Google cannot easily determine which specific web pages a user visited. Google is also mandated to make its data collection practices in Incognito mode clearer to users, including explicit disclosures in its Privacy Policy and on the Incognito mode startup screen.

The lawsuit, seeking $5 billion in damages for alleged privacy violations, underscores the growing concerns over digital surveillance and the need for transparency in data collection practices.

While the settlement doesn’t include financial damages to users, it forces Google to adopt significant measures that limit data collection from private browsing sessions, marking a victory for consumer privacy advocates. This case highlights the ongoing challenges and expectations facing tech companies in terms of user privacy and data protection.