Google Updates Chrome’s Incognito Warning to Admit It Tracks Users in ‘Private’ Mode

Google is updating the warning on Chrome’s Incognito mode to make it clear that Google and websites run by other companies can still collect your data in the web browser’s semiprivate mode.

The change is being made as Google prepares to settle a class-action lawsuit that accuses the firm of privacy violations related to Chrome’s Incognito mode. The expanded warning was recently added to Chrome Canary, a nightly build for developers. The warning appears to directly address one of the lawsuit’s complaints, that the Incognito mode’s warning doesn’t make it clear that Google collects data from users of the private mode.

Many tech-savvy people already know that while private modes in web browsers prevent some data from being stored on your device, they don’t prevent tracking by websites or internet service providers. But many other people may not understand exactly what Incognito mode does, so the more specific warning could help educate users.

Ars Technica

This story originally appeared on Ars Technica, a trusted source for technology news, tech policy analysis, reviews, and more. Ars is owned by WIRED’s parent company, Condé Nast.

The new warning seen in Chrome Canary when you open an incognito window says: “You’ve gone Incognito. Others who use this device won’t see your activity, so you can browse more privately. This won’t change how data is collected by websites you visit and the services they use, including Google.” The wording could be interpreted to refer to Google websites and third-party websites, including third-party websites that rely on Google ad services.

The new warning was not yet in the developer, beta, or stable branches of Chrome as of Tuesday. It also wasn’t in Chromium. The change to Canary was previously reported by MSPowerUser.

“Now You Can Browse Privately”

Incognito mode in the stable version of Chrome still says: “You’ve gone Incognito. Now you can browse privately, and other people who use this device won’t see your activity.” Among other changes, the Canary warning replaces “browse privately” with “browse more privately.”

The stable and Canary warnings both say that your browsing activity might still be visible to “websites you visit,” “your employer or school,” or “your Internet service provider.” But only the Canary warning currently includes the caveat that Incognito mode “won’t change how data is collected by websites you visit and the services they use, including Google.”

The old and new warnings both say that Incognito mode prevents Chrome from saving your browsing history, cookies and site data, and information entered in forms, but that “downloads, bookmarks and reading list items will be saved.” Both warnings link to this page, which provides more detail on Incognito mode.

ADVERTISEMENT

We asked Google when the warning will be added to Chrome’s stable channel and whether the change is mandated by or related to the pending settlement of the privacy class-action suit. Google didn’t provide specific answers but offered this statement: “We’re pleased to resolve this case which we’ve long disputed, and provide even more information to users about Incognito mode. Incognito mode in Chrome will continue to give people the choice to browse the Internet without their activity being saved to their browser or device.”

The litigation in US District Court for the Northern District of California began in June 2020. On December 26, 2023, Google and the plaintiffs announced that they reached a settlement that they planned to present to the court for approval within 60 days. A jury trial was previously scheduled to begin on February 5.

Lawsuit: Google Failed to Disclose Tracking

A fourth amended complaint filed in March 2023 alleged violations of federal wiretap law, California’s Invasion of Privacy Act, California’s Comprehensive Computer Data Access and Fraud Act, and California’s Unfair Competition Law. It also alleged invasion of privacy, intrusion upon seclusion, and breach of contract.

“Google’s Privacy Policy, Privacy ‘Controls,’ and ‘Incognito Screen’ each falsely state that users can prevent Google’s collection by using ‘Private Browsing Mode,'” the lawsuit said. Describing the current Incognito screen’s promises, plaintiffs said.

“Based on these Google representations, throughout the Class Period, Plaintiffs and Class members reasonably expected that Google would not collect their data while in Incognito mode. They reasonably understood ‘You’ve gone incognito’ and ‘Now you can browse privately’ to mean they could browse privately, without Google’s continued tracking and data collection.

Google could have disclosed on this Incognito Screen that Google would track users and collect their data while they were browsing privately, but Google did not do that. Instead, Google included representations meant to assure users that they had ‘gone incognito’ and could ‘browse privately’ with only limited exceptions, none of which disclosed Google’s own tracking and data collection practices while users were in a private browsing mode.”

The lawsuit went on to say that “Google’s code continues to send the user’s browsing history and other data directly to Google’s servers during users’ private browsing sessions,” that “the session is not ‘private’ at all, and ‘other people who use this device’ will still know what preceding users did by way of targeted ads served by Google based on browsing activity that took place during the ‘private browsing,'” and that user “activities are visible to Google, which continues to track users, intercept their communications, and collect their data while they are in Incognito mode and other private browsing modes.”

“What is conspicuously absent from the Incognito screen—and any other representation by Google—is a disclosure that Google continues to track users while they are in a private browsing mode,” the lawsuit said. “Nothing in Google’s Privacy Policy or Incognito Screen leads users to believe that during private browsing Google continues to persistently monitor them, and sell their browsing history and communications to other third parties. In fact, when the Privacy Policy and Incognito Screen are read together, the user necessarily reaches the opposite conclusion.”

Google Points to Privacy Policy and Developer Tools

Google argued that plaintiffs “consented to Google’s receipt and use of the information at issue (regardless of whether they were using Chrome’s Incognito mode or some other browser’s private browsing mode).” Google said its privacy policy that users consent to when they create their accounts “discloses that Google receives the information at issue from its services installed on third-party websites.”

Users also “implicitly consented to Google’s receipt of the information because they were aware that Google receives such information when users visit websites that use Google’s services,” Google said.

Google said people can use Chrome’s Developer Tools, which can be accessed via the Chrome menu, “or similar features in other browsers to learn which third-party services (including Google services) the websites they visit are using and the data being sent to those services.”