Privacy Review: Google Chrome

Ever since its initial release in 2008, Google Chrome has come under a lot of scrutiny due to its sometimes misleading privacy policy. Right after the beta release on September 2, 2008, CNET news brought to the public’s attention a passage from the Terms & Conditions “which seemed to grant to Google a license to all content transferred via the Chrome browser.” [source] They have since removed that passage, but it did make people question just how much information Google was tracking and what exactly they were doing with it.

I think one of the main concerns people have is that Google is mixing two worlds with their browser, the world of their consumers (the public) and the world of their advertisers – which is where the skepticism and suspicion comes in.

In hopes of bringing some light to the privacy concerns in Google Chrome, and fulfilling my curiosity, I’ve read the initial download Terms & Conditions and scoured the Privacy Policies of both Google Services and Google Chrome – below is a summary of what I found.

Google Chrome Terms of Service

This agreement doesn’t seem to have anything that explicitly states that Google Chrome stores or sends personal data, usage tracking, or other information to Google. It does however say that addons such as Google Toolbar and Google Web Accelerator do have settings that will allow for the transmission of information to Google, which can include personal information. Both the toolbar and the Web Accelerator send information about the URL you’re requesting to the Google servers. The possibility of sending personal information is directly tied to the website you’re visiting in that Google collects the URL – thus, if the URL contains any personal information (typically variables after the ‘?’,) this information will be sent and stored by Google.

It appears that Google Toolbar has an opt-out feature that will disallow the transfer of URL information to Google; however, Google Web Accelerator does not allow the user to opt-out of this service. I would suggest reading the Privacy Policy for both Google Toolbar and Google Web Accelerator if you have any privacy concerns related to either of those products. The Web Accelerator is no longer available and has been completely deprecated by Google; however, for anyone using the product from a earlier release, the link to their most up-to-date (2005) privacy policy is listed below.

Useful Links:

1. Google Toolbar: Opt-Out of sending URL information
2. Google Toolbar: Opt-Out of sending usage statistics
3. Google Toolbar: Terms of Service
4. Google Toolbar: Privacy Policy
5. Google Web Accelerator: Privacy Policy

Google Chrome & Third-Party Addons

This is where the privacy policy becomes very consumer-beware. Google takes no action on protecting you from third-party applications and addons, and their privacy policy does not extend past the use of the application as-is from the first download. This is pretty typical as with any software application, so you should make sure to read the privacy policy and terms of any application or addon you install on your browser, whether you’re using Google Chrome or not.

Google Web Usage Storing Without Google Chrome

As you might know, Google dominates the web search world; however, they didn’t get to where they are without a little help from you… whether you know it or not.

Google stores all information that is typed into its search engine and yes, this does include information you type into Google Search without pressing Enter. Every keystroke is logged and reported to the Google servers. You realize this now since Google released its ‘Live Search’ feature that starts returning results before you’re finished typing – but they were storing this information long before the feature hit market. Don’t (or do?) fear though, everything that Google collects in terms of personal information is the same information that someone can get on any website using the handy built-in HTTP Headers. The information that gets transmitted to Google is as follows: IP Address (supplied by your Internet Service Provider), URL requested, User-agent (ie. Firefox 4), and Operating System (ie. Windows NT.) The information they receive looks something like this:

123.45.67.89 – 25/Mar/2003 10:15:32 –
http://www.google.com/search?q=cars –
Firefox 1.0.7; Windows NT 5.1 – 740674ce2123e969

As you can tell it’s not an insanely personal look into your life or internet usage, but it is enough to track where you’re going and what browser you’re doing it on. One thing to note is that an IP address is not a reliable way to track usage because they change out so often and that’s why I’ve bolded the most important part of that entire tracking log above. It’s a unique identifier for you that was generated when you downloaded Chrome. It’s the one identifier that they have so that everything you do on the web can be tracked back to you. Keep in mind though, this is only tracked on the Google Search site and once you transition to a new site, that’s where Google loosens its rains on your personal data.

Google Web Usage Storing With Google Chrome

The rules for Google tracking is exactly the same as when you’re using Google Search; however, when you’re using Chrome, it tracks this information for all websites and searches you do on the web, regardless of whether you’re on the Google Search site or not. This is an opt-out feature that be changed by unchecking “Use a prediction service to help complete searches and URLs typed in the address bar” in the settings panel through “Under the hood”. This feature unfortunately does not have an opt-out option when using the Google Search website.

Google/Google Chrome Privacy Policy

Just like all Google Products and Services, Google Chrome inherits the Google Privacy Policy, but extends the policy by creating a separate one specifically for the product. I think one thing you need to keep in mind about the Google Privacy Policy is that they constantly say that the information that is sent to them is used to “operate and improve Google Chrome and other Google services.” What’s important to take from this passage is the “other Google Services” portion – this does and always will include Google Adwords and all Google advertising products. This means that the data that they receive about your internet usage is used to affect their advertisers and the content they supply. The specifics of this can’t be found in the Google Chrome Privacy Policy, but can be found in the Google Privacy Policy, which is adopted by all Google Products – it is best describe in the passage from their main policy, “[we use the information collected to] provide, maintain, protect, and improve our services (including advertising services) and develop new services.”

Next under the microscope is cookies. Google uses cookies to store personal information about your browsing and web history. This information is used in the “display of more relevant ads.” – take that how you want, whether you mind or not. Cookies aren’t a feature exclusive to Google Chrome, but to all browsers, and can be turned off by altering your security preferences to disallow all cookies; however, this can affect your browsing in many ways, such as the “remember me” features for logins will no longer work.

Although their privacy policy doesn’t explicitly state that they sell your information to third-party applications or advertisers, they do use your information to effectively target ads, which in turn is basically the same as selling your information.

Conclusion

Although I made the choice a long time ago that Google Chrome wasn’t made for me, it isn’t a terrible browser. Beyond it’s privacy controversy, it does get some good reviews. However, personally I would avoid trusting a product that is made or distributed by a company that is responsible for advertising of any sort. We would all be a little to naive to believe that your information won’t make its way into the hands of their advertisers. So, consumer beware.

Other Useful Links

1. Google: Full Privacy Policy
2. Google: Advertising and Privacy
3. Google Chrome: Privacy Policy