Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

521–530 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#521

Post by GordonS »

labawi wrote: post #398
shadowgovt wrote: post #355

Earlier quoted context omitted.

... which is crazy unrealistic, since it's "PII" that can only stay "private" by collective agreement of every node in the network, but no accounting for the reality of network architecture in passing law, I guess. Maybe a deep expectation of anonymity while accessing a worldwide network of cooperative machines is something people should stop telling the public they should expect?

Under GDPR you can use all the PII you reasonably need to provide expected services, you don't even need separate consent. But, if you have PII, the moment you use it for other purposes, or obtain/retain/share without proper cause, you are breaking the law. IMHO, that is very reasonable. Real world example - giving your phone number and information to your car mechanic / doctor / bank teller / plumber is reasonable.…

I totally agree, and I think the GDPR is also reasonable in that it allows you to use the IP address for essential security reasons, such as blocking bad actors based on IP address - it doesn't say "thou shalt not track IP addresses", it says you need consent if you're going to use it for anything that isn't essential for security or in your end user's best interest.

Re: Google tracks individual users per Chrome installation ID

#522

Post by detaro »

shadowgovt wrote: post #406
outworlder wrote: post #405

Earlier quoted context omitted.

Or they can stay 'private' by not being stored or correlated with other user data. GDPR doesn't apply to the network itself, it applies to whoever is using it.

"Stored" is definitely the purpose of a router. "Correlated" can be necessary for debugging routing issues (or client-server connection issues that are tied to the intermediary fabric near the client doing something weird; hard to determine if an entire subnet is acting up if you aren't allowed to maintain state on errors correlated to IP address).

Where do you get the idea that GDPR doesn't allow you to process PII for the purpose of routing packets?

Re: Google tracks individual users per Chrome installation ID

#523

Post by dessant »

joshuamorton wrote: post #517
0xfffafaCrash wrote: post #511

Earlier quoted context omitted.

There has been an EU court ruling on this exact question of whether dynamic IP addresses count as personal data even in contexts where the website operator in question does not have the means to associate it with an individual but another party (such as an ISP) does. The Court of Justice of the European Union has ruled on this and it does count as personal data. [1] Furthermore, GDPR itself specifically refers to onl…

Interesting, TIL. That doesn't change the major point I was making though, which is that an anonymized identifier (such as the 13-bit ID under discussion) isn't personal info, even if it might have originally been collected along side data which is personal info. If I give you said 13 bit ID, you need other info to back out a single person, the anonymous ID corresponds to multiple IPs.

I think you're still missing the point. Google transmits personal data to their servers without user consent. The value of x-client-data is personal data, because it is associated with an IP address during transit, due to how HTTP requests work. The nature of the data, what is being done with it on the server, and the location of the server are all irrelevant in this instance, the only important part is that personal data has left the browser in the form of a request, and it reached a Google server.

This data collection would only be exempt from GDPR if the data would be required for the service to function, but that is not the case with x-client-data.

Re: Google tracks individual users per Chrome installation ID

#525

Post by thenewnewguy »

dessant wrote: post #483
joshuamorton wrote: post #478

Earlier quoted context omitted.

> GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furth…

An IP address is itself personal data, it does not have to be associated with other personal data. https://ec.europa.eu/info/law/law-topic/data-protection/refo... > Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. See my comment about consent not bei…

> > and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data.

> The transmission of data is already covered by GDPR, you don't have to store the data to be bound by the law.

This cannot be the actual correct interpretation of the GDPR, because under this logic _all_ IP packets on the public internet (made by/to EU citizens) are covered by the GDPR because you are transmitting data alongside an IP address.

Re: Google tracks individual users per Chrome installation ID

#526

Post by KCUOJJQJ »

KenanSulayman wrote: post #429

Don’t forget that even if the number is varying only in an interval of 0 and 7999, this means without cookies a unique chrome installation can be identified if multiple users are using the same IP, like residential houses with families, etc. — that way it is possible to determine the unique amount of devices inside a house.

>that way it is possible to determine the unique amount of devices inside a house.

There are exceptions I guess. Imagine 8000 households in which couples live. Both partners own the same MacBook model. In 1/8000 cases Google would think there is only one person.

Re: Google tracks individual users per Chrome installation ID

#527

Post by akersten »

chatmasta wrote: post #279
tbodt wrote: post #209

Earlier quoted context omitted.

Actual list: https://cs.chromium.org/chromium/src/components/google/core/...

This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. The Chrome codebase has special features for Google’s own web properties. I hope all these AGs suing google have some good tech advisors. It’s hard to keep track of all the nefarious things google has been up to over the past decade.

> This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there.

???

Is "Darn, their browser only gets to track me on their own websites; if Google were playing fairly, they'd send the tracking header to all websites so I can be tracked more and have less privacy" the argument you're making here?

And it's debatable that this header is actually serving a tracking purpose at all. Being limited to their own web properties cements it as a diagnostic to me. What use is a tracking header that only gets sent to domains they already know you're visiting?

Re: Google tracks individual users per Chrome installation ID

#528

Post by wuliwong »

jariel wrote: post #514
aidos wrote: post #481

Earlier quoted context omitted.

While I agree with some of your comment, I feel like it’s harsh to paint the whole chrome enterprise with that brush. Chrome was about freeing the world of a truly terrible web browser and a lot of devoted devs have spent a lot of time working on it. There’s an advertising aspect that it’s right to call out, but I think on the whole it was done to make the internet better, because the internet is google’s business to…

"Chrome was about freeing the world of a truly terrible web browser " Chrome is about establishing more control over the web to further the business objectives of Google and Alphabet. The problem with this belief of Google as some kind of 'benevolent actor' is a function of the new kind of branding they helped introduce, something that an entire generation of particularly young people are being duped by. 'Brand' used…

> The problem with this belief of Google as some kind of 'benevolent actor'

You put 'benevolent actor' in quotes as if the comment you are replying to contained that. It didn't.

Re: Google tracks individual users per Chrome installation ID

#529

Post by KCUOJJQJ »

janpot wrote: post #4

Not endorsing this, but according to https://www.google.com/chrome/privacy/whitepaper.html#variat... > We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations he…

Couldn't the Chrome installations receive a request from Google that says "Do you want to try out a new thing?", and couldn't the Chrome installations say yes with a certain probability? The only difference I can see is that the subset of users that are guinea pigs couldn't be the same in each test (if Google wanted that the subset is always the same).
Post reply on HN