> The X-Client-Data header is still described as non-identifying.
That's a false description. 13 bits of entropy is more than most existing fingerprinting vectors. This header allows clients behind NAT to be identified with significantly greater precision.
> There's no rational basis for Google doing what people suggest it's doing.
There is. Their business lives and dies on their ability to track web users, and tracking methods are gradually being eliminated from web standards, therefore Google has a rational basis for adding new tracking methods that it can leverage - especially ones that only it can leverage.
> If you start from the assumption that Google is acting unethically and is entirely untrustworthy
I think the base assumption is less dramatic: that Google is simply acting in its own best interests by prioritizing growth over user privacy.
> If you're logged in, the entire conversation is moot. If they wanted to track you, they have your google account. So this only matters for logged out users, and even then, the value is marginal even if you assume Google isn't using any other form of nefarious tracking.
This is (obviously) about the hundreds of millions of Chrome users who are not logged in, and as I said above, 13 bits of entropy isn't marginal.
> And again that all assumes Google is openly lying. If you don't include that in your threat model, well, then, Google probably isn't lying.
Not necessarily. All it takes is a policy change. It looks like this:
1. Privacy regression is introduced and a restrictive policy is established, e.g. "we won't use that to track people".
2. 6-12 months go by; maybe a new VP gets hired, or a bizdev team discovers that this data could be leveraged for a significant bump in revenue.
3. The policy is relaxed to allow existing & future data to be used for fingerprinting.
Nobody "lied" per se, but the end result is the same.