171–180 of 195 posts
This not from incognito that’s just one piece. It’s against the practice of fingerprinting users across products and services.
Earlier quoted context omitted.
Saying that "Google Analytics is NOT the website I visit" is the same as saying "React is NOT the UI I'm using" or "Stripe is NOT the store I'm buying from". Modern day websites use readily available modules to build out functionality. Just because those modules were originally built by someone else doesn't mean that it's not part of the website you visit. Full disclosure: I work at Google.
I am aware of this as a developer. But as a regular user, when I am told that visiting HackerNews in incognito mode won't prevent HackerNews from tracking me doesn't tell me that it won't prevent Google and Facebook and who knows how many others too. Basically, this is one of the key ideas behind the GDPR: that I should have a legally-enforced expectation that when I'm agreeing to share my data with X, I'm not implic…
Another commenter said that this wording implies that it DOES prevent Google Analytics, since it is not part of the site.
My argument was that drawing a distinction between a "site" and modules that are part of that "site" but are from other parties is dubious.
Earlier quoted context omitted.
Saying that "Google Analytics is NOT the website I visit" is the same as saying "React is NOT the UI I'm using" or "Stripe is NOT the store I'm buying from". Modern day websites use readily available modules to build out functionality. Just because those modules were originally built by someone else doesn't mean that it's not part of the website you visit. Full disclosure: I work at Google.
> Saying that "Google Analytics is NOT the website I visit" is the same as saying "React is NOT the UI I'm using" Uh, no. Using a web framework is very different from using a third party data collection tool that gives the third party access to the data. Unless the React devs are also tracking user behavior on third party sites. But that would be a separate lawsuit. Full disclosure: I buy ads from Google.
Another commenter said that this wording implies that it DOES prevent Google Analytics, since it is not part of the site.
My argument was that drawing a distinction between a "site" and modules that are part of that "site" but are from other parties is dubious (also, likely impossible).
Earlier quoted context omitted.
Interestingly absent is Google.
Google only has visibility into what you're doing as a subcategory of "websites you visit", so I'm not clear on the confusion here.
Earlier quoted context omitted.
Why is it idiotic to expect Google to respect a users wish not to be tracked? Half the world has laws that require Google to ask permission. Using private browsing mode is a very clear indication the the user does not want to give them that permission. It's really not that hard. Google and Facebook just don't want to understand it.
I was under the impression that it wasn't supposed to be possible for a website to tell that the page was loaded in incognito mode; in fact, I thought it was important that they not be able to. As such, how would the page with good analytics even know the user was incognito.
Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private
Earlier quoted context omitted.
Google only has visibility into what you're doing as a subcategory of "websites you visit", so I'm not clear on the confusion here.
The confusion is that google makes chrome. Plain and simple. A feature (incognito) with a bypass (analytics) is a non-feature since they are both done by the same company. So the practical solution is for them to be not done by the same company.
If you start from the axiom that Google should be broken up, this is a reasonable conclusion. But punishing a company for keeping separate products separate would actually undermine most anti-monopoly law.
Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private
Firefox containers does the same thing with a lot less work. If you get the multi-account-containers extension and the temporary containers extension, you won't have to log back into everything all the time but will still get isolation. https://addons.mozilla.org/en-US/firefox/addon/temporary-con... https://addons.mozilla.org/en-US/firefox/addon/multi-account... Edit: See below with a warning about using this with pr…
I.e if you use the same container to read news, google knows your news preferences.
Earlier quoted context omitted.
Which there is a warning of every time you open an incognito window. It's not fine print either, it's one of about six bullet points. "Your activity might still be visible to ... Websites you visit." This one is going nowhere I suspect. Just because a lawsuit asks for big damages does not mean the plaintiffs are likely to prevail on their claims.
That's not quite how the law works. If I tell you to get off of my property, and you stand on my lawn, you're trespassing, even if I didn't put up a military-grade wall. Or if I have a basic chain link fence, and you climb over it, you're clearly trespassing in situations where without the fence, if you were to incidentally walk across my lawn, you'd be okay. The point of digital trespass laws is very similar. Just b…
But there is no such law against collecting browsing data. So there has to be some other legal theory under which Google would be liable. One example would be deceptive practices or fraud, where Google says one thing then does another. Unfortunately, we don't have the full text of the complaint yet as far as I can tell. But your "that's not how the law works" dismissal is actually going to be totally irrelevant to the complaint, because there's no legal comparison between trespassing and collecting browsing data.
Earlier quoted context omitted.
How about: "Websites shouldn't do digital fingerprinting to intentionally circumvent incognito mode." Does this make sense to you as a legal argument? And yes, this does mean that if it comes to litigation, a lot of this will depend not just on what you did but why you did it. If you write analytics, unaware of incognito mode, you're probably okay. If you write that same exact code because your boss comes in and says…
That's the kind of feel-good law that ends up very unenforceable because it ignores technical reality. Not a fan. If the exact same action does the exact same harm and is legal or illegal based on intent, enforcing that law is going to enrich a lot of lawyers but isn't going to practically rope in many company's behaviors.
And yes, it does enrich a lot of lawyers.
Look up the CFAA cases, for a great set of example of how these laws can explode in this exact domain -- people charged with digital trespass who bypassed no or minimal technical measures. And it doesn't feel good either in most of those cases.
To be frank, though, if this gets applied to Google, it will feel pretty good.