Court documents allege Google cultivated privacy misconceptions of Chrome's Incognito mode

Cal Jeffrey

Posts: 3,713   +1,162
Staff member
A hot potato: Chrome's Incognito Mode is not private. *gasp* Seriously, we all know private browsing modes don't hide us from anything other than our spouse. However, many less tech-savvy people think it is more private than it really is, and this belief has spawned a new lawsuit against Alphabet.

Google faces a potential privacy case as a class of millions of users filed to sue it for billions of dollars over Chrome's Incognito mode lack of genuine privacy protections. While user ignorance is never a great argument in front of a judge, court documents first filed in March of 2021 paint a picture that Google has been complicit in cultivating user misconceptions on privacy.

According to the filings, Google Marketing Chief Lorraine Twohill emailed CEO Sundar Pichai last year, warning that they need to consider making Incognito "truly private." Even more concerning is her indirect admission that they have had to use misleading language when marketing the feature.

"We are limited in how strongly we can market Incognito because it's not truly private, thus requiring really fuzzy, hedging language that is almost more damaging," Twohill said.

"Fuzzy" and "hedging language" would denote that the marketing department knows that users misunderstand what Incognito provides, and Google is intentionally dancing around the issue to perpetuate that misconception. While Twohill did not outright state the company's awareness of the confusion, other employees have expressed more explicit concerns for years, indicating that Google knew about Incognito's false image.

In a 2018 chat conversation between Google engineers, one stated, "We need to stop calling it Incognito and stop using a Spy Guy icon." Spy Guy is the Incognito icon/mascot with a hat and glasses.

The engineer also shared a 2018 study showing that 56.3 percent of respondents think Incognito prevents Google from seeing their search history. Another 37 percent believe the privacy mode can prevent their employer from tracking their web browsing. Both of these are misconceptions. The only thing Incognito mode does is automatically delete that session's browsing history and cookies, which users could do manually.

Another engineer in the same thread responded by posting a link to a Guy Incognito wiki and saying, "Regardless of the name, the Incognito icon should have always been [Guy Incognito], which also accurately conveys the level of privacy it provides." Guy Incognito is a character on The Simpsons who sounds like and resembles Homer Simpson but has a mustache causing other to think he is Homer wearing a poor mustache disguise.

Another damaging piece of evidence is a slide from a 2020 internal presentation stating, "Unless it is clearly disclosed that their activity may be trackable, receiving targeted ads or suggestions based on private mode [browsing] may erode trust." This slide cited a user survey on the Incognito experience and suggested that Google was keenly aware of the feature's image among users.

Google's Chrome product lead even said that the wording on the Incognito splash page is not transparent enough, stating that they should change it from "You are protected from other people who use this device" to "You are NOT protected from Google." That is not precisely what the home screen says, but unsurprisingly, company execs flatly rejected the idea.

The plaintiffs in the class-action request are using the documentation as evidence that Google knowingly cultivated users' confusion in thinking that Incognito protects their privacy. Of course, plaintiffs brush over the fact that the Incognito home screen explicitly states the mode's function and that security experts have been shouting about its faux privacy for years.

"[Incognito] only blocks your own browser from recording your traffic. It doesn't hide your IP," said Nord VPN's Daniel Markuson in a blog post just last month. "Your ISP and employer, websites, search engines, governments, and other third-party snoopers can still collect your data and track your IP address."

Google used this widespread criticism to respond to the allegations, saying in the filing that it is common knowledge that Incognito is not invisible to the internet and that users give Google their consent to view their browsing history even in Incognito mode. It has also publically defended itself, denying any wrongdoing.

"Privacy controls have long been built into our services, and we encourage our teams to constantly discuss or consider ideas to improve them," Google spokesman Jose Castaneda told Bloomberg. "Incognito mode offers users a private browsing experience, and we've been clear about how it works and what it does, whereas the plaintiffs in this case have purposely mischaracterized our statements."

Google tried getting the case dismissed twice but failed. However, it did succeed in getting CEO Sundar Pichai off the hook. The plaintiffs had asked to have the top exec testify on the development of Incognito when he was head of Chrome development. The judge denied that motion.

Permalink to story.

 

ZedRM

Posts: 1,404   +978
As of 2018, 56.3 percent of respondents think Incognito prevents Google from seeing their search history
For the record, I never thought this... But then again, I don't use Chrome. However, I also don't go to places on the internet where I shouldn't be.
 

kiwigraeme

Posts: 1,389   +1,036
Incognito was only to stop others in your household knowing you watch My little ponies .
Or searches like what does pain down left arm and tightness in chest mean .

Number one rule there is no privacy on the internet - yes an exaggeration - but it's what we tell our kids - you post something - assume it's there for life.
Government Depts, Corps you are dealing with - will rather blank you than email a confession or damning info
 

brucek

Posts: 1,344   +2,022
Some hedging language is inevitable because there's too many factors beyond the browser's control.

That said it speaks to Google's culture that even in the face of internal resistance they insisted on doing less than they could have. Really what would have been the harm in the letting the tiny fraction of browsing that is incognito not be recorded anywhere? Was it just too antithetical to what they stand for?
 

Tom Yum

Posts: 195   +460
I'm no Google apologist, but nowhere in the landing page of an incognito page does it say or even imply that Google can't see what you are searching for. It is not like Google implied it but weasled out in legalese, it says that your search history is only private to people using your device, and that while Chrome won't save your history, websites you visit may see you. And given Google is the largest ad provider, that means Google will see you, because the website you are visiting will serve an ad from the Google Ad network.

If you want privacy, use Tails/ToR. If you just don't want your GF to see the weird porn you are into, incognito is fine.