Incog-NO-To Mode - Is Your Private Browsing Really Private? Google Says No.
Ademola Adekunbi
Technology Law. Data Protection/Privacy. LLM. CIPP/E & CIPM. LinkedIn Top Voice.
Google has agreed to settle a class-action lawsuit alleging that its incognito mode in Chrome was misleading and that it processed the data of millions of people unlawfully as a result. No payment has been agreed, but Google is committing to making several changes to how the browser operates.
The key question in the case was ‘were users acting reasonably to believe Google would not track them while in incognito mode?’
Now, if you've ever used your browser's incognito or private browsing mode, you may have done so with the feeling you were browsing with a bit of extra anonymity. Maybe you were looking up birthday present ideas that you wanted to keep a surprise, or researching something slightly embarrassing. Whatever the reason, there's always been this assumption that "private" meant... well... private, right?
Wrong.
Incognito, private browsing, or whatever your chosen browser calls it, works by not saving browser data locally on your device. So, no browsing history, no cookies, generally no traces of your session once you close that incognito window. This is very useful for specific situations, like when you're using someone else's device or a public machine.
But, and this is a big but, it was never intended to make you invisible on the internet at large. Websites you visit can still see your IP address, and your activity can potentially be monitored by your internet service provider (ISP), employer, school, or network administrator.
Some people already understood that, and to be fair to Google, there has always been a detailed disclaimer stating those points on the incognito browsing start page. However, the core of the lawsuit alleges that Google went beyond these typical technical limitations associated with incognito mode. Google's tracking methods, so the lawsuit claims, were designed to gather information specifically when a user had made a conscious choice to reduce their digital footprint. This is where the perceived violation of user expectations and trust becomes a serious legal matter.
So, when you chose to hide what you were doing online, that’s when Google tried really really hard to see what you were doing and keep track of it. Allegedly.
That makes sense when you think about it - Google is in the business of matching adverts to people based on their interests. If you believe that who we are in private is our real selves, then getting details of what people do online when they believe they’re in private will likely give you more accurate insights into their personalities and interests and thus enable you to make more money from targeting relevant advertisements at them.
What’s Changing and What’s Not
As part of the lawsuit settlement, Google will update how incognito mode is described to users. This suggests better transparency for the future.
Data Deletion: Google will delete or anonymise billions of browsing records collected from Incognito mode users. This covers roughly 136 million users in the US and will likely span several years for affected users. This addresses a core point of the lawsuit – the retroactive gathering of data under the guise of greater privacy. However, it does not signal a drastic shift in Google's data collection practices going forward.
Increased Transparency: Google has already modified the Incognito mode splash screen and its privacy policy to be more transparent. The focus is on stating what information will be collected, even in Incognito mode. One change is that the wording has now been changed from "Browse Privately" to "Browse More Privately". This reflects a shift in messaging and a potential acceptance that full digital anonymity via Incognito mode was an unsustainable idea (or at least, an idea Google does not want to promote). The aim is to reduce user misunderstandings by spelling out exactly what Incognito does and does not do in terms of data collection.
Recommended by LinkedIn
One interesting thing on this point is that one of Google’s arguments was that its privacy notice discloses that its tracking is mode-agnostic, which is a fancy way of saying that incognito mode had zero effect and users should have known that because it never specified lower or no tracking for incognito mode specifically. The court wasn’t buying that though, because in the same privacy notice, the only mention of incognito mode was to highlight how it’s a private browsing mode, and so users were acting reasonably in expecting privacy from Google.
Identifying Incognito Users: Google will change how it collects browsing data and partially redact IP addresses. This is meant to counter a key allegation in the lawsuit - that Google could identify Incognito users despite the mode's privacy implications. Partial redaction reduces the specificity of this identification, making it theoretically harder to pinpoint individual Incognito users with certainty. I think this amounts to pseudonymisation (at best) and it’ll need to be combined with many other safeguards to have any real effect. I suspect this one will end up back in the courts at some point.
Litigation: On the subject of courts, it’s key to note that individual lawsuits remain possible. While the class-action settlement terms have been outlined, individuals can still choose to pursue separate lawsuits against Google, and the settlement likely won't stop users and privacy advocates from keeping a close eye on Google's data practices.
The company is facing several cases globally, including one from the Attorney General of Texas on the same subject - incognito mode. In that case, Texas is arguing that the company misled consumers by tracking their personal location without consent, and in many cases continued to track them after the feature was disabled by users, all of which allegedly constitute a violation of the Texas’ Deceptive Trade Practices Act.
Key Takeaways for Organisations
Review your own transparency practices. The Google situation underscores the consequences of misleading your users, whether deliberately or inadvertently – potential lawsuits and damage to your company's reputation. How clearly do you outline your data collection practices? Are there confusing or contradictory messages anywhere in your product and your privacy notice or T & Cs? Where there might be potential user confusion, strive for clarity.
Assess your need for user tracking. If there are scenarios where tracking is vital to your business model, it's worth considering how you can balance that need with user privacy. Are there ways to achieve your goals, such as marketing analytics, in a more transparent way? Could an opt-in approach be viable?
Consider the "private window" experience. When a user chooses a privacy-focused browsing mode, it demonstrates their desire for a more private experience. Can your website or app still deliver core functionality in a reduced tracking environment? Even partial respect for this privacy preference can go a long way in building user trust.
Stay informed about shifting expectations. Public opinion on data privacy and regulation continues to evolve. Staying ahead of the curve on these expectations will help ensure your business practices are compliant and reduce the risk of future issues.
This Google Incognito mode case is a clear reminder that even seemingly privacy-focused tools might not live up to our expectations, and that even privacy notices should not be taken at face value because what is not being said can be as important as what is said. While the settlement brings some changes and clarity for organisations on best practices, there’s still a lot of confusion that'll need to be clarified by regulation, litigation, or both. Businesses must learn from Google's example, prioritising transparent data practices and respecting user choices. As individuals, we need to stay informed and demand better control over our online footprints.
Lawyer. Data Protection Officer. LLM. CIPP/E
8moBest measure is not to treat anything on the internet as private.
Data protection, data ethics and digital privacy nerd | #ActuallyAutistic
8moGoogle’s privacy assurances always turn out to be lies….why do people keep falling for the same scam over and over?!