Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google sued for secretly amassing vast trove of user data

bloomberg.com

Post reply on HN
Print view View original

61–70 of 195 posts

Re: Google sued for secretly amassing vast trove of user data

#61

Post by dvfjsdhgfv »

asdfasgasdgasdg wrote: post #29
simonw wrote: post #8

Earlier quoted context omitted.

Found the full lawsuit PDF https://www.insurancejournal.com/app/uploads/2020/06/brown-v... It looks like this is mainly about the fact that Google Analytics still works even if you are in Incognito mode.

Which there is a warning of every time you open an incognito window. It's not fine print either, it's one of about six bullet points. "Your activity might still be visible to ... Websites you visit." This one is going nowhere I suspect. Just because a lawsuit asks for big damages does not mean the plaintiffs are likely to prevail on their claims.

Yes, it's quite interesting, and it borders on semantics. I.e. someone misunderstood privacy in this context as understood in general, that you keep things for yourself. But private/incognito browsing on Chrome means privacy from other people using your computer, not from the biggest user-tracking company.

Maybe instead calling it "incognito mode", which is totally inadequate, they should call it "temporarily disable browsing history" instead.

Re: Google sued for secretly amassing vast trove of user data

#62

Post by logicslave »

hashberry wrote: post #27

I have a personal gmail and a work gmail (G Suite), each using my full name, but both run in separate browsers using the same IP address. I always wonder if Google keeps a "master record" of people and all their associations, if not for security or to work with law enforcement.

Definitely. They have logic that links data sets, all it takes is one slip up for them to know youre the same person, probably with levels of probability about whether you are the same person.

Re: Google sued for secretly amassing vast trove of user data

#63

Post by w7 »

t0mas88 wrote: post #44
oefrha wrote: post #13

Earlier quoted context omitted.

> The fact that the user uses a private window or other means to indicates they don't want to be tracked probably makes this a more clear case. That’s a very confusing statement. My server logs don’t filter incoming log entries based on user agent, and certainly not on whether you’re using a “private window” or not. In addition, the goal of a private/incognito session is to be indistinguishable from regular sessions,…

But you're not using the IP addresses in the logs to circumvent the fact that cookies are being deleted by your user's device right? Because it looks like that's what Google was doing, and that's actively circumventing the decision of the user not to be tracked which is illegal in many places.

My interpretation of this article is it's related to incognito mode.

How is it circumventing a "decision of the user not to be tracked" when "private" modes usually explicitly state they can't/don't stop websites from logging information.

Re: Google sued for secretly amassing vast trove of user data

#64

Post by user5994461 »

_0w8t wrote: post #53
t0mas88 wrote: post #5

Earlier quoted context omitted.

Server logs with IP addresses are acceptable to most European privacy regulators if you only use them for a technical purpose such as debugging. And not keep them longer than needed for that. So practically: logs are fine, delete them after a while. If you store the same information in a permanent database and use it for analysis you're in trouble and should have asked permission. The fact that the user uses a privat…

At GDPR presentation that I attended recently in Norway the message was that IP addresses must be masked if they go to a permanent storage. For IPv4 it could be OK to clear the last byte of the address, but in general the message was to save the least amount of information. For example, if IP is used for locating regions, then save the regions, not the IP itself.

Logs are not permanent storage. They're auto deleted after a few weeks.

Re: Google sued for secretly amassing vast trove of user data

#65

Post by s3r3nity »

hashberry wrote: post #27

I have a personal gmail and a work gmail (G Suite), each using my full name, but both run in separate browsers using the same IP address. I always wonder if Google keeps a "master record" of people and all their associations, if not for security or to work with law enforcement.

>...the same IP address.

In my experience in adtech, not only can Google do this pretty accurately, but other third parties as well (e.g. DMPs and the like.) Even if they couldn't make a deterministic association, they have enough data points to make a probabilistic association with high likelihood (ex: "Given all these data points, we're 95% confident that these two people are the same. Therefore we're going to attribute the actions to the same person.")

Now, to qualify my response a bit, this isn't necessarily for security / law enforcement, but mainly for better targeting parameters. Example: frequency capping of ads (buyer specifies that you only see an ad X number of times in a given time period) or more relevant targeting (you don't see completely different ads in different browsers as if you're from two non-overlapping demographic groups.)

Re: Google sued for secretly amassing vast trove of user data

#66

Post by ipython »

How poetic. This lawsuit brought to you by Boies Schiller, the law firm that aggressively intimidated Theranos whistleblowers. I would argue that their actions contributed to the suicide of Ian Gibbons, as well as threatening his widow with legal action after his death.

Re: Google sued for secretly amassing vast trove of user data

#67

Post by guyzero »

dr_kiszonka wrote: post #43

(Disclaimer: I have a big personal gripe with Google, but I don't hate the company in general) Something has been on mind for a while. I see lawsuits against Google collecting / selling personal data and ideas to combat its monopoly in search. What I don't see is a discussion about regulating companies that have data on the majority of the population. I know for a fact that Google used search insights to inform strat…

Yes, all that data helped Google perfect its amazing chat and video calling app strategy.

Re: Google sued for secretly amassing vast trove of user data

#68

Post by a9entroy »

Apes wrote: post #7
foota wrote: post #2

This lawsuit is idiotic. They're claiming Google is doing something wrong by tracking users from websites using ad tech when someone uses their browsers private browsing mode.

There are the data privacy laws that mandate users be able to opt of tracking, and it should be pretty clear to a non-psychopathic company that a person using the private mode on their browser is opting out of any tracking. Google is one of the biggest companies in the world. Do they really need to be wringing their users as hard as they can to milk out every last drop of ad revenue potential?

That's not what incognito mode is. It literally says on the first page when you open incognito window. People want to skip reading technical details when provided but then get angry when a company does the exact thing they warned about.

Also where does this end? Should car dealerships be allowed to analyze your data? Cars you've bought, cars you test drove etc.?

Re: Google sued for secretly amassing vast trove of user data

#69

Post by ocdtrekkie »

MattGaiser wrote: post #26
t0mas88 wrote: post #5

Earlier quoted context omitted.

Server logs with IP addresses are acceptable to most European privacy regulators if you only use them for a technical purpose such as debugging. And not keep them longer than needed for that. So practically: logs are fine, delete them after a while. If you store the same information in a permanent database and use it for analysis you're in trouble and should have asked permission. The fact that the user uses a privat…

> The fact that the user uses a private window or other means to indicates they don't want to be tracked probably makes this a more clear case. What about the fact that Incognito is so that "other people who use this device won't see your activity" and it doesn't do anything about tracking?

This is actually no longer true: Google recently added third party tracker blocking when you're in incognito mode. Of course, every other browser does this even outside of incognito mode, but the point stands that Google has actively added features to prevent websites from tracking you in this mode.

Re: Google sued for secretly amassing vast trove of user data

#70

Post by s3r3nity »

Romanulus wrote: post #32
hashberry wrote: post #27

I have a personal gmail and a work gmail (G Suite), each using my full name, but both run in separate browsers using the same IP address. I always wonder if Google keeps a "master record" of people and all their associations, if not for security or to work with law enforcement.

Probably. I recall Project Veritas showing hidden video of a Twitter dev speaking about databases that link all profiles of someone (using things like IPs, fingerprints, etc. to stitch the relationships together).

You're probably getting downvoted for discussing Project Veritas (which is a silly reason for downvoting IMO) but your point is still accurate: these companies are defnitely running models to create probabilistic identity models in the absence of deterministic associations.

Deterministic = I specifically say I'm person X and am logged-in. Probabilistic = I am not logged-in on this browser, but am on the same computer, same IP, and am logged-in on a separate browser at the exact same time under name X. Therefore I'm very likely person X.

Post reply on HN