Don't trust Incognito mode

If you still believe that Google Chrome's Incognito Mode is the best way to protect your privacy on the Internet, now is the time to stop.

Google has agreed to delete 'billions of data records' collected by the company over the years when users browse the web using Incognito Mode, according to documents filed in federal court in San Francisco on April 1.

The deal brought to light Google's stealthy practices and the amount of data the tech giant collects from users, even when users are in private browsing mode.

Filed in 2020, the class action lawsuit accuses Google of misleading users about how Chrome tracks user browsing activity using Incognito Mode. The lawsuit alleges that Google's privacy and marketing disclosures failed to properly inform users about the type of data being collected, including details about the websites they viewed.

Under the terms of the agreement, Google must update the splash page, which appears any time a user opens a Chrome window in Incognito Mode. The page will have to make it clear that Google collects data from third-party sites 'regardless of the browser or browser mode you use'.

At the same time, the company must mention that '3rd party websites and applications that integrate the service may still share information with Google'. Details about Google's collection of private browsing data Google must also appear in the company's privacy policy.

Additionally, some data Google previously collected about anonymous users will be deleted. This includes "private browsing data older than 9 months" from the date Google signed the agreement's term sheet, as well as private browsing data collected throughout December 2023.

However, some documents in the lawsuit mentioning Google's data collection methods remain undisclosed, so it is difficult to assess the comprehensiveness of the data deletion process, Wired said.

Attorney David Boies, who represents users, said the agreement requires Google to delete and remediate the amount of illegally collected data 'at an unprecedented scope and scale'. 'This agreement is a historic step forward in demanding honesty and accountability from dominant technology companies,' the lawyer told the Wall Street Journal.

Google representative Jose Castaneda said the company is 'very willing to delete old data'. They have never been associated with an individual and have never been used for any form of personalization. Castaneda also noted that the company will not have to pay a fine under the deal, after previously facing a $5 billion fine.

The agreement also specifies a number of tasks Google must carry out including continuing to 'block 3rd party cookies in Incognito Mode for 5 years', partially encrypting IP addresses to prevent identification of hidden user data identify and remove certain header information that could potentially be used to identify users.

Previously, critics of Incognito Mode said that Google's protection measures were no longer effective against the sophisticated user tracking tactics of today's companies. At worst, this feature gives people a false sense of security, allowing companies like Google to passively monitor millions of users. They were fooled into thinking they were browsing alone.

Marvin Fry

Update 02 April 2024