Data PrivacyThe Intricacies of Incognito mode and the quest for online privacy

INTRODUCTION

In exploring the area of private browsing, it is crucial to acknowledge the trade-offs involved. While the allure of anonymity attracts users to use the incognito mode, it comes with sacrifices in browser personalization. Private browsing modes are now a standard feature in nearly all major web browsers.

When a user switches to the browser’s private mode, it is like starting with a clean slate. Suggestions based on the user browsing history won’t be available, autocomplete features may not work as usual, and the user needs to sign into their accounts manually. Once the incognito window is closed, the browser clears the browsing history and any cookies generated during that session. Essentially, on the device, the browser won’t retain information about the websites visited or any data that was entered into forms.

Although the private browsing mode, known as “Incognito” in Google’s Chrome browser, has been available for almost ten years, a recent lawsuit against tracking through the said mode has resulted in an undisclosed settlement and has brought renewed attention to this widely used feature.

The Plaintiffs in the suit alleged that this mode provided users with a false sense of security, leading them to believe their online activities were not being tracked. However, internal emails from Google, unearthed during the lawsuit, painted a different picture. They revealed that despite using Incognito Mode, users were still being monitored by Google for purposes such as measuring web traffic and serving targeted advertisements.

The lawsuit, filed in a California court, accused Google of infringing on users’ privacy rights through deceptive practices associated with the Incognito Mode. By intentionally misleading users about the level of privacy afforded by this feature, Google stood accused of breaching trust and violating user expectations regarding online privacy.

UNDERSTANDING INCOGNITO MODE AND ITS FUNCTIONS

Incognito mode serves as a private window in a web browser, providing users with the ability to browse the Internet without the browser recording their browsing history on the device. Once the private browsing session in incognito mode concludes, no cookies or other remnants of the session are retained in the browser.

The use of incognito mode effectively prevents any data or browsing history associated with a specific browsing session from being stored on the user’s device. As soon as the Incognito window is opened, it is clarified that websites visited, internet service providers (ISPs), search engines, and other companies can still track user behaviour while browsing in incognito mode. However it is also said that Google’s Chrome won’t save any browsing history, cookies and site data, information entered in forms. This is the part where the Plaintiffs highlighted to be false and misleading to the users.

Benefits of Incognito mode: The benefits of incognito mode include the ability for users to browse the web as if they are new visitors to each site they visit, ensuring that no saved cookies, login information, or auto-filled web forms are present. This means that each website perceives the user as a first-time visitor, thus avoiding a personalized web experience based on browsing habits. Additionally, this mode prevents prices of items such as flight tickets from increasing based on previous searches, providing users with a more neutral browsing environment.

This type of browsing experience can be beneficial in various scenarios Users who would use incognito mode would often expect that it ensures searches on sensitive topics, such as healthcare, won’t appear in their browsing history or that, it would provide added security when browsing or logging into accounts on public computers, such as those at libraries or hotel business centres.

Following are some of the functions that would be expected of incognito mode:

A. Data Handling: In incognito mode, data handling involves certain aspects to consider. When users sign in to personal accounts, their data is saved during the session, ensuring a seamless browsing experience. However, this data won’t be retained once they leave the site, maintaining the privacy of their browsing activities. Despite the privacy measures, it is essential to note that websites and advertisers can still collect identifying information while the user is signed in, highlighting the importance of cautious browsing practices even in incognito mode.

B. Customization options: In terms of customization options, users have the ability to choose whether to enable third-party cookies before starting their browsing session. While allowing these cookies may result in fewer targeted ads, it is important to note that it could potentially impact website functionality. This option provides users with a degree of control over their browsing experience, allowing them to balance privacy concerns with their desired level of website functionality and personalized advertising.

C. Session Management: Session management in incognito mode varies across different browsers. In browsers like ioS’s Safari, each private window or tab is treated as a new session, ensuring enhanced privacy for each browsing instance. However, in Chrome, all open incognito windows belong to the same session. The session concludes either when all incognito windows are closed or when exiting incognito mode from one of the open windows.

PRESENTED ALLEGATIONS AND DEFENCES

Breach of privacy by Google

In the complaint filed by the plaintiff, the following allegations were made against Google:

A. Google’s Assurances: Google was accused of misleading its consumers by assuring them that they are in control of the information they share and that they can adjust privacy settings to control data collection.

B. Surreptitious Tracking: Despite users activating private browsing mode, Google allegedly continues to track and collect browsing data through various means, including Google Analytics, Google Ad Manager, and other plugins.

C. Tracking Mechanism: Google’s Analytics code is embedded into websites’ existing code. When a user visits a website, their browser sends a request to the website’s servers, which then responds with the website’s code, including Google’s embedded code. This code causes the user’s browser to send personal information (such as IP address, URL address, device information) to Google’s servers.

D. Lack of Disclosure: Google does not require websites to disclose upfront that they are collecting visitors’ information using Google Analytics or Google Ad Manager. Additionally, users are not informed which websites implement these services, making it difficult for consumers to avoid being tracked.

E. Android Operating System and Mobile Applications: Google’s Android operating system and various mobile applications constantly send system and location data to Google’s servers, even when users are not actively interacting with their devices. This passive data collection extends to Google applications such as Chrome, Maps, and Google Home.

F. Persistent Identifier: Google reportedly uses a unique persistent identifier, known as the “X-client-Data Header,” for individuals using the Chrome browser. This identifier is sent to Google’s servers whenever the browser views a webpage with Google Analytics or Ad Manager, potentially even when the user is in private browsing mode.

G. Misrepresentation: While Google claims to act in the interests of users and partner websites, it primarily serves its own interests by using collected data to enhance its advertising products and generate revenue. This discrepancy between Google’s public statements and its actual activities raises questions about its true intentions regarding user privacy.

H. Egregious Breach of Social Norms: It has been claimed that Google’s actions represent an egregious breach of social norms and highly offensive behaviour, including secret monitoring of web browsing and wiretapping of communications.

Google’s defence against the allegations

Google reiterated that they told the users that they can control what information they share with Google and how that information is used. They emphasized that users can surf the web anonymously without their communications with websites being intercepted. Its Privacy Policy states that users can adjust their privacy settings to control what data Google collects and how it’s used. They also highlighted tools like “My Activity,” which allows users to review and control the data generated when they use Google services, such as searches.

Google suggests that users can browse the web privately by using private browsing mode in their web browsers like Chrome or Safari, and further implied that enabling private browsing mode will prevent their search activity from being saved to their account.

Google also stated that they repeatedly suggested that users can control their information by browsing in private browsing mode.

A Google spokesperson said in a statement “We never associate data with users when they use incognito mode. We are happy to delete old technical data that was never associated with an individual and was never used for any form of personalization.”

However, despite all the aforementioned defences, Google agreed to a settlement by agreeing to delete billions of records containing personal information collected from millions of users across the globe through its Chrome web browser, as part of a settlement agreement in a lawsuit in the United States.

The settlement further required Google to delete billions or personal records stored in its data centres, impose other controls designed to limit Google’s collection of personal information and make more prominent privacy disclosures about Chrome’s Incognito mode when it is activated. This data deletion also applies outside the US.

However, despite these recommendations, Google’s tracking tools, such as Google Analytics and Google Ad Manager, continue to track users in the present even when they are in private browsing mode.

AMLEGALS REMARKS

Personal information is considered a valuable currency in the digital age, with companies viewing it as a corporate asset. The recent legal settlement regarding Google’s Incognito Mode underscores the paramount importance of privacy in the digital realm.

While Google has consistently assured users of their ability to control shared information and maintain browsing anonymity, the allegations of clandestine tracking and data collection paint a conflicting picture. This disparity between Google’s public statements and reported tracking mechanisms raises profound concerns about user privacy and the integrity of online interactions.

At the heart of the matter lies the expectation that browsing in private mode should guarantee a degree of anonymity and protection from data collection. However, the discrepancy between Google’s assurances and alleged tracking practices erodes this expectation, leaving users questioning the true extent of their online privacy.

Such a potential breach of trust by a tech giant like Google not only undermines user confidence but also raises fundamental questions about the ethical boundaries of data collection and surveillance in the digital age. It highlights the urgent need for greater transparency and accountability from tech companies regarding their data practices, ensuring that user privacy remains paramount in an increasingly interconnected world.

– Team AMLEGALS assisted by Ms. Prishitha Saraiwala (Intern)