Featured Article : Google Deleting Millions Of Users’ Incognito Data

As part of a deal to resolve a class action lawsuit in the US dating back to 2020, Google has said it will delete the incognito mode search data of millions of users.

What Lawsuit? 

In June 2020 in the US, three Californians named Chasom Brown, Christopher Castillo, and Monique Trujill (along with William Byatt of Florida and Jeremy Davis of Arkansas) brought a lawsuit against Google’s Incognito mode. They filed the class-action lawsuit on behalf of themselves and potentially millions of other Google users who believed their data was being collected by Google despite using Incognito mode for private browsing.

The plaintiffs accused Google of capturing data despite assurances that it would not, thereby misleading users about the privacy level provided by Incognito mode. For example, internal Google emails highlighted by the lawsuit appeared to show that users using incognito mode were actually being tracked by Google to measure web traffic and sell ads.

The original lawsuit was seeking at least $5 billion in damages from Google.

What’s Been Happening? 

Since the lawsuit was originally filed, some of the main events of note between the plaintiffs and Google have included:

– Google attempting to have the lawsuit dismissed, arguing that it never promised complete privacy or non-collection of data in Incognito mode. At the time, Google pointed to the disclaimers presented to users when opening an Incognito tab, which stated that activity might still be visible to websites, web services, and employers or schools.

– A judge then rejected Google’s request to dismiss the case. The judge emphasised that Google didn’t explicitly inform users that it would collect data in the manner alleged by the plaintiffs. This decision meant that the lawsuit could again move forward.

– Finally, back in December last year, with the scheduled trial due to begin in February 2024, the lawyers for Google and the plaintiffs announced that a preliminary settlement had been reached, i.e. Google had agreed to settle the class-action lawsuit. In doing so, Google acknowledged that it needed to address the plaintiffs’ concerns (but without admitting wrongdoing).

– In January, however, following the preliminary settlement announcement, Google updated its disclosures, clarifying that it still tracked user data even when users opted to search privately or used its “Incognito” setting.

– Google also said it was trialling a new feature that could automatically block third-party cookies (to prevent user activity being tracked) for all Google Chrome users and had made the block automatic for Incognito just after the lawsuit was filed. It’s also understood that as part of the settlement deal, this automatic block feature will stay in place for 5 years.

Mass Deletions 

Under the terms of the final settlement, the full details of which are not publicly known, Google has agreed to delete hundreds of billions of the private browsing data records that it collected (with incognito).

Google Says…

A Google spokesperson has been quoted as saying that the company was pleased to settle the lawsuit which it “always believed was meritless” and that it is “happy to delete old technical data that was never associated with an individual and was never used for any form of personalisation”. 

What Does This Mean For Your Business? 

This agreement came after extensive legal battles and discussions, which in themselves highlight the complexities surrounding user privacy and data collection practices in the digital age. Part of the complexity in the case appeared to be trying to decide whether, as the plaintiffs’ lawyers argued, Google was misleading users and violating privacy and wiretapping laws or, as Google’s lawyers said, Incognito mode was designed to allow users to browse without saving activity to their local device but not to entirely prevent Google or other services from tracking user activities online.

Google has consistently denied wrongdoing and maintained its stance. However, Google (and its parent company Alphabet) are already facing two other potentially painful monopoly cases brought by the US federal government and had to pay £318m in 2022 in settlement of claims brought by US states over it allegedly tracking the location of users who’d had opted out of location services on their devices. It’s not surprising, therefore, that Google has opted to settle in this most recently concluded case although, in addition to having to delete hundreds of billions of browsing records, there are no public details yet of what else it’s cost.

The settlement, therefore, will be seen by many as a victory in terms of forcing dominant technology companies to be more honest in their representations to users about how they collect and employ user data. For big tech companies such as Google, privacy and tracking have become a difficult area. Google had already moved to free itself from other volatile privacy matters around browsing by announcing back in 2020 that it would be looking to eliminate third-party cookies within two years anyway (which has been delayed) and cookies have been subject to greater regulation in recent years.

This latest settlement is bad news for Google (and advertisers) however it is likely to be good news for the many millions of Google Chrome users whose interests were represented in the class-action lawsuit.

Tech Insight : What Does Incognito Mode Actually Do?

Following news that Google may need to pay $5 billion over tracking millions of people who thought they were browsing privately through incognito mode, we look at what incognito mode actually does.

Incognito Mode 

Different browsers have different names for ‘private browsing mode’ including ‘InPrivate browsing’ (Edge), ‘Private’ for Firefox (Mozilla) and Safari, and ‘Incognito’ for Google Chrome.

Those who use Google’s Chrome browser will know that in addition to browsing via a normal window, clicking/tapping on the three dots (top right) allows you to open another browser window in ‘incognito mode.’

Incognito mode is essentially just a setting on your web browser that allows you to go undercover (to an extent) when browsing the internet. It works by removing local data from web browsing sessions, i.e. browsing is recorded in your local search history (any cookies which a website attempts to upload to your computer are deleted or blocked). In incognito mode, other trackers, temporary files, and third-party toolbars are also disabled. An incognito window is not signed to any accounts so can’t be tracked by them. However, in incognito mode a user’s IP address can still be tracked.

Google says of incognito mode: “When you browse privately, other people who use the device won’t see your history. Chrome doesn’t save your browsing history or information entered in forms. Cookies and site data are remembered while you’re browsing, but deleted when you exit Incognito mode.” 

Therefore, when you use incognito mode:

– Your browsing history is (supposedly) private (i.e. it’s not recorded).

– Cookies are deleted, helping to keep your personal preferences private, and hopefully preventing the resulting targeted adverts.

– You can sign into multiple accounts simultaneously, e.g. you can log into a work-related account in an incognito window while also being logged into a separate personal account at the same site in a normal window.

Does Google Still Track You In Incognito Mode? 

Google can still track you in Incognito mode, however the tracking mechanisms are different from regular browsing. Although incognito mode primarily prevents your browsing history, cookies, and site data from being saved on your device, it doesn’t make you invisible online. For example, the fact that your IP address is still visible means that your activities can still be visible to websites you visit, your employer, and your ISP. This means that while Incognito mode offers more privacy from other users of your device, it does not offer complete anonymity online.

The Recent Case 

The recent case involving Google, where the company has agreed to a settlement (to be finalised on February 24) could see it pay out $5 billion following a class action lawsuit. The lawsuit claimed that Google had secretly tracked millions of people who’d been using Incognito Mode between 2016 and 2020.

It’s been reported that when the lawsuit was first submitted, even Google’s own staff joked about how ‘un-private’ the incognito mode was. The lawsuit stated that: “Through its pervasive data tracking business, Google knows who your friends are, what your hobbies are, what you like to eat, what movies you watch, where and when you like to shop, what your favourite vacation destinations are, what your favourite colour is, and even the most intimate and potentially embarrassing things you browse on the internet – regardless of whether you follow Google’s advice to keep your activities ‘private’.” 

How Can You Browse Privately? 

Given that Incognito mode is not completely private, other measures that users can take when they want to browse privately / make browsing more private include:

– Using private browsers. For example, there are now a number of private browsers available, such as DuckDuckGo, Epic, and Brave.

– Using privacy extensions for browsers. These include Privacy Badger, Ghostery, HTTPS Everywhere, Cookie AutoDelete, and more, although some of these are more focused on blocking cookies and tracking.

– Using a VPN to encrypt traffic, and hide your IP address, although they don’t protect you from being tracked, from cookies, from user-agent strings, or through the accounts they are logged into (e.g. Google).

– Adjusting browser settings to block tracking cookies, and regularly deleting browser cookies and cache to remove tracking data and browsing history stored on the device.

What Does This Mean For Your Business? 

The main point to remember is that incognito mode is not completely private because your IP address is still visible. This means that your activities can still be visible to the websites you visit, your employer, and your ISP. Also, the Google case highlights what a grey area the ‘incognito’ name seems to be, and one of the questions in the case has been whether Google actually made a legally binding promise not to collect users’ data when they browsed in private / incognito mode.

Achieving complete privacy while browsing the internet is actually quite a challenge due to the interconnected and complex nature of online services and the widespread use of tracking technologies. Most websites and online services collect user data for various purposes, such as personalising content, advertising, or analytics. This data collection is often deeply integrated into the infrastructure of the web, making it difficult to avoid entirely.

Therefore, perhaps the most realistic way for users to enhance their privacy is a multi-layered approach. Using a reliable Virtual Private Network (VPN) is a good start, as it encrypts internet traffic and masks the user’s IP address, making it harder for third parties to track online activities. Also, using privacy-focused browsers and search engines, disabling tracking cookies, and regularly clearing browsing history and caches can further reduce one’s digital footprint. However, it’s important to understand that these measures improve privacy but do not guarantee complete anonymity. For instance, a VPN hides your IP address from websites but the VPN provider itself can see your internet traffic unless it enforces a strict no-logs policy. Similarly, while privacy-focused browsers limit tracking, they don’t completely eliminate the possibility of data collection by websites or internet service providers.