Google Chrome: Why you suddenly need to delete it

Google's shocking new tracking admission should alarm Chrome's 2.6 million users. Although it hasn't made the headlines yet, it should serve as a warning. This shocking new revelation from Google should give you cause to quit if you are one of them.

Chrome is a disaster when it comes privacy and security, despite its slick marketing and frequent feature updates. Chrome has fallen behind its rivals in protecting users against tracking and data harvesting. Its plan to get rid of nasty third-party cookies was awkwardly delayed, and the replacement technology that it claimed would protect users from being profiled and tracked has only made matters worse.

Mozilla, a Firefox developer warns that ubiquitous surveillance "harms individuals and societies" and that "Chrome is still the only major browser that doesn't offer meaningful protection against cross site tracking... and will continue to leave users exposed."

Google admits, ironically, that ubiquitous web tracking has led to "an erosion in trust... 72% feel that nearly all of their online activities are being tracked by technology firms, advertisers or other parties, while 81% believe the data collection risks outweigh any benefits."

How can Google openly admit that such tracking is a breach of user privacy and still allow it by default in its flagship browser? It's simple: Follow the money. Limiting tracking will reduce ad revenue by targeting users with political messages, sales pitches, and opinions. Google has no Plan B, and its grand plan for anonymized tracking is currently in chaos.

"Research has shown up to 52 companies could theoretically observe up 91% of an average user's web browsing histories," a senior Chrome engineer said to an Internet Engineering Task Force conference. "And 600 companies can observe at most 50%."

Google's Privacy Sandbox is designed to address this issue and serve advertisers who want to target users in a more privacy-preserving way. The problem is that Google's incredible control over the internet advertising industry is not absolute. Already, there is a complex web of data brokers and trackers. Any new technology adds to this complexity and cannot be used in isolation.

This is why FLoC failed, Google's self-proclaimed attempt to use anonymized tracking across the internet. It turns out that building a wall around only half a chicken coop is not especially effective--especially when some of the foxes are already hanging around inside.

FLoC does not target you individually, but assigns you to a group of people who have similar interests and behavior, as determined by the websites that you all visit. You're not Jane Doe, 55, a sales assistant who lives at 101 Acacia Ave. Instead, you are presented as a Cohort X member, which allows advertisers to infer what you will likely do and purchase from the same websites that group members visit. Google would control the whole process and advertisers would pay to play.

FLoC came under immediate fire. Privacy lobby warned of the risks that data brokers would simply add cohort identifiers to any data they already have on users, such as IP addresses, browser identities, or first-party web IDs. This would give them more information about individuals. There was also the risk that cohort IDs might betray sensitive information--politics, sexuality, health, finances, ...

Google said that it was not, as it began its controversial FLoC trial. It told me in April that FLoC was better for privacy than individual cross-site tracking.

Google suddenly admitted that it was wrong, telling IETF "today’s fingerprinting surface even without FLoC is easily enough to uniquely identity users" but that "FLoC creates new fingerprinting surfaces." This is exactly what the privacy lobby warned about: FLoC does not make things better.

IETF presentation

GOOGLE

Google announced that the FLoC trial was ended last month. The company stated that it needed to be rethought before any production could take place. "It's clear," Google stated, "that it is necessary for more time across the ecosystem in order to get this right."

The moratorium also included a reprieve for tracking cookie--it all goes hand-in-hand. Google will continue to track and profile users using cookies through at least 2023, rival Brave said at the time. However, online privacy is becoming a rising tide. Google appears to be already in serious trouble and will need major reforms long before 2023.

Google's delay was disguised in regulatory concerns, which were also triggered by FLoC. These concerns included whether Google would have undue control over the advertising ecosystem. Chrome users, however, face a much worse reality. There is no end to fingerprinting on Chrome, not with third-party trackers in place, FLoC's failure and no clear plans for better technology.

Google said that they are constantly exploring ways to make Privacy Sandbox proposals more private while still supporting the open and free web. This was when I inquired about the surprising admission by the IETF. "Nothing has been determined yet."

It has been determined that third-party cookie are here to stay for at least the next few years. If Google doesn't find a way out, it will likely be longer. Brave claims that Google is "hiding" and "buying time to regroup" in order "to consolidate control over web tracking."

Chrome users who continue to use Chrome can make sure they are not secretly enrolled in the next FLoC-like trial. You can either block third-party cookies manually or disable the Privacy Sandbox trial feature in Chrome privacy settings. Google claims it will increase transparency and control in the future but has not yet said whether it will ask users to enroll in future trials. This is in contrast with FLoC V1.

Illustrative report of top-10 web trackers over 30 days on Safari

 APPLE SAFARI / @UKZAK

It's not as simple as just deleting Chrome. Google's browser is and its search engine are different things. Google has trackers installed at 75% of the top-ranked websites, more than Facebook. Just look at recent reports that Google will pay Apple $15 billion to be its default search engine for its devices.

Chrome's problem is that Chrome's browser, search engine, and trackers all come from the same source. You don't want all the trackers sporting the same logos if your browser is privacy-oriented and your browser is data poachers.

Google has stated that it is exploring options for a more watered-down solution to FLoC, Privacy Sandbox and other issues. Users are assigned to topics and not to cohorts. Manual auditing of topics can be used to hide sensitive areas. Bogus topics can also confuse profiles. Google stated that they believe these mitigations can dramatically reduce the utility of FLoC cross-site fingerprinting. There are many whats, ifs, and maybes to consider, so "nothing has yet been determined."

Cyjax CISO Ian Thornton Trump told me that FloC was a new attempt to 'target digital marketing' within Google's browser system. Instead of a third party cookie, he said that FloC would allow 'no escape' to being'mostly if certainly completely' tracked. It is a deeply troubling situation for any company trying to improve your privacy but making billions through digital media and requiring your data.

Google Chrome is the primary platform for user data profiling. However, you can also add Maps and Mail, Android, YouTube, and many other apps and platforms to the mix. Google cannot make user privacy a priority in the browser market until it finds a way to sell these ads.

My STC colleague Kate O'Flaherty warns that Chrome can make you give up your privacy. "There won't be anything that is privacy-preserving but still services advertisers. They must know information about you.

Safari, an Apple user, is the better choice. It prevents cross-site tracking by default, offers more private browsing options, and is not an advertisement giant. Apple's Private Relay is a significant step forward in privacy. It breaks the identity chain between your device, and the websites you visit. This beta version of iOS 15 will be available with some teething issues.

iCloud+ Private Relay

 APPLE

Brave, Mozilla, and DuckDuckGo offer more private, better-looking options if you aren't on an Apple platform. You can still use Chrome Incognito Mode, but you need to be aware of the limitations. It's not an alternative to a browser with a more private design.

Chrome is an excellent browser--technically. As with all apps, platforms and services, it is important to understand the financial implications. When you start asking yourself if this is a product that I paid for, or if I it, who else is paying to have access to me, you will be able to make better decisions. Only by making these choices with privacy in your mind, will you communicate that your data is not being harvested at will.

This is best illustrated when you compare Chrome's privacy label with the privacy labels for other browsers in Apple's App Store. Chrome is clearly out of sync with all the other browsers in terms of the amount of data it collects, and how it links back to users' identities.

Privacy Labels: Chrome Vs Rivals

 APPLE / @UKZAK

Google stated to IETF that fingerprinting, regardless of FLoC is real and they're witnessing it happen. We'd like to end this widespread tracking of users on the internet. It's easy to stop it. Follow Safari's example. You can disable tracking by default and reduce data harvesting tied to user identities. Then, if you find a privacy-preserving option, you will be able to add it back in. You won't, there's too much involved. Users will make that decision.

Is it too dramatic to suggest that you switch to Chrome? It all depends on how you view it. Millions of people were enrolled in the FLoC trial without you having to opt-in or off. This secretive trial, which Google now admits has additional fingerprinting surfaces, was open to all. This means that you could be identified more easily and profiled. This is unacceptable. Google also changed its mind after promising to get rid of tracking cookies. This is not okay.

Yes, Google needs to find a way to present your data to its paying customers--advertisers, if its surveillance business model is to survive. You don't.