Browsing in “Incognito mode” while using Google’s Chrome browser may give the illusion of privacy, but the fact is that it does not prevent others, including Google, from tracking you.
However, a 2020 class-action lawsuit claimed Google misled users into thinking they had more privacy than Incognito mode actually afforded, leading to a settlement where Google agreed to destroy or de-identify billions of web browsing records collected in Incognito mode.
What is Chrome’s Incognito mode?
When you browse the web with Chrome, users may choose to use an “Incognito” window, also known as “privacy browsing mode.” In Incognito mode, Chrome does not save browsing history, cookies and site data, information entered in forms, and permissions you give to websites. This means that your activity is not saved on your device, thereby preventing others with access to your device, such as family members, from seeing your searches and stopping cookies from identifying you.
However, what you do in Incognito mode on Chrome can still be traced back to you, including by Google itself. For example, Incognito sessions are recorded in Google Analytics and provided to website administrators.
Read more: What doesn’t Incognito mode protect against?
Why did Chrome users sue Google over Incognito mode?
In June 2020, a lawsuit titled Brown v. Google was launched by three Google users in California. They accused Google of falsely advertising the privacy capabilities of Incognito mode. Despite assurances that Incognito mode would keep their web activities private, Google allegedly continued to harvest data on their browsing habits. The plaintiffs argued they were led to believe that using Incognito mode would protect them from Google’s data collection practices. They expected a level of privacy that, according to the lawsuit, Google failed to deliver.
“Google’s practices infringe upon users’ privacy; intentionally deceive consumers; give Google and its employees power to learn intimate details about individuals’ lives, interests, and internet usage; and make Google ‘one-stop shopping’ for any government, private, or criminal actor who wants to undermine individuals’ privacy, security, or freedom,” the complaint said.
The case aimed to challenge Google’s data collection methods, seeking damages for privacy breaches and demanding greater transparency and accountability in Google’s practices.
What were the claims against Google in the Incognito mode lawsuit?
The lawsuit raised several serious concerns about the privacy assurances associated with Google’s Incognito mode. While we won’t go into great detail about each one, here are the main points:
- Misleading privacy promises: At the heart of the lawsuit was the accusation that Google gave users a false sense of security about their privacy in Incognito mode. Users believed their web activities would be private and unseen by Google, an expectation that was not met. The plaintiffs contended that Google continued to track and collect user data through various tools like Google Analytics and Ad Manager, even when users were in Incognito mode seeking privacy.
- Violation of wiretap laws: Google was accused of breaking federal and state wiretap laws by allegedly intercepting users’ electronic communications without consent, especially troubling for users who chose Incognito mode expecting confidentiality.
- Invasion of privacy: By collecting data during Incognito sessions, Google was accused of intruding into users’ personal lives, learning details about their interests and behaviors without permission.
- Intrusion upon seclusion: This claim refers to intentionally intruding into a private place, conversation, or matter. The plaintiffs claim that Google intentionally intruded on their solitude or seclusion by placing itself in the middle of conversations while they were using Incognito mode.
- Breach of contract: According to plaintiffs, the Chrome Privacy Notice, Google’s Privacy Policy, the “Search & Browse Privately” page, and the Incognito “splash” screen promised that if plaintiffs visited websites in private browsing mode, Google would not collect their data.
How did Google respond to the lawsuit?
The complaint was heavily contested by Google. The tech giant defended itself against the claims, insisting on the clarity and transparency of its data collection practices as disclosed in its privacy policy. The company stated that Incognito mode is intended to prevent information from being stored on the user’s device, but it doesn’t shield online activities from the web at large. This means that while using Incognito mode, the websites one visits, along with any third-party analytics or advertising services they use, could still track the user’s activities.
Google argued that there’s a common misconception about what Incognito mode is designed to do. It provides privacy from other users of the same device by not saving browsing history, cookies, site data, or information entered in forms, but it does not guarantee anonymity online. This important distinction is often missed or misunderstood.
To drive home this point, Google stated, “Google also makes clear that ‘Incognito’ does not mean ‘invisible,’ and that the user’s activity during that session may be visible to websites they visit, and any third-party analytics or ads services the visited websites use.”
Google also quickly added wording to its Incognito mode start screen to add clarity. As of April 2024, the start screen includes the explicit wording that the mode “won’t change how data is collected by websites you visit and the services they use, including Google.”
What was the verdict?
In December 2023, Google reached a settlement in its lawsuit over Incognito mode, without going to trial. To resolve the accusations against them, Google agreed to delete or de-identify billions of web browsing records collected from users in this mode, as well as a few other terms.
Amid the settlement, Google asserts that the lawsuit lacked merit, but they’re content with the resolution—stating that data collected during Incognito mode was never used for user-specific content personalization.
The settlement aims to enhance transparency and protect user data more effectively. It’s important to note, however, that the settlement doesn’t include direct compensation to users. But, individuals do retain the right to pursue their own legal action against Google for damages within the state of California.
What changes has Google agreed to make in the settlement?
In the terms of the settlement, Google committed to several changes to enhance privacy and transparency for Incognito mode users:
- Destroying or de-identifying data: Google will either destroy or anonymize billions of records of web browsing data collected from users in Incognito mode dating back to June 2016, up to December 2023. This step is intended to eliminate or reduce the privacy risks associated with the retention of this data.
- Greater disclosure about data collection: The company will update its disclosures on the Incognito mode “splash” page to provide clearer information about how it collects and uses data from Incognito sessions. This aims to ensure that users have a better understanding of the privacy implications of using Incognito mode and what data may still be collected by Google and third parties.
- Blocking third-party cookies by default: For the next five years, Google will enable users to block third-party cookies by default in Incognito mode. Google had long been planning on blocking third-party cookies, but the settlement made it happen more quickly. This change will prevent websites, as well as Google, from collecting data on users’ browsing activities via third-party cookies.
- Transparency and user education: Part of the agreement includes initiatives to educate users about the privacy features and limitations of Incognito mode. Google has already begun rolling out changes to how it communicates the functionality of Incognito mode to users, aiming to clarify that while it offers a level of privacy from other users on the same device, it does not provide complete anonymity online.
What broader impact might this lawsuit have?
The settlement will lead to greater privacy and transparency for Chrome users. If passed, it represents a victory in providing users more authority over their personal data, alongside a more transparent insight into Google’s data collection practices while in Incognito mode. It also paves the way for individual legal actions, empowering users to actively participate in the safeguarding of their privacy rights.
Here are some of the settlement’s broader implications:
Heightened transparency standards
The lawsuit establishes a new benchmark for transparency in the tech industry. It challenges other tech giants to be more upfront about their privacy features and data collection practices, fostering a culture of trust and openness between users and technology providers.
Reevaluation of private browsing
The revelations from the case encourage a critical reassessment of what private browsing modes actually offer versus what users expect. It signals the need for tech companies to enhance their privacy protections to genuinely align with user expectations of anonymity and data security.
Increased regulatory and legal focus
The high-profile nature of this lawsuit draws increased attention to the importance of data privacy, potentially catalyzing more stringent regulatory oversight and legal scrutiny on how companies collect, use, and protect user data.
User empowerment
It highlights the powerful role that user-driven legal action and advocacy can play in influencing privacy practices among tech giants. It serves as a reminder that users are not powerless and can demand accountability and change from the platforms they use.
Innovation in privacy technologies
As laws and regulations evolve in favor of greater privacy protections, we may see accelerated development in technologies that enhance privacy. This could include more sophisticated data encryption methods, improved tools for anonymous browsing, and features that give users more control over their data.
Shift in business models
The constraints on data collection posed by the settlement could prompt a rethink of business models heavily reliant on data harvesting and targeted advertising. It may encourage the exploration of alternative revenue models that prioritize user privacy and data protection.
Global impact on privacy practices
Although the Google settlement is rooted in U.S. law, its implications are likely to reverberate globally. It sets a precedent for privacy standards that could influence how companies around the world approach user privacy and data protection, encouraging a shift towards more user-centric privacy practices.
Are there any remaining legal challenges for Google regarding privacy?
Even though Google has settled its notable class-action lawsuit concerning Incognito mode, the tech giant remains embroiled in various legal battles that highlight significant concerns over privacy, data practices, and competition. Here are a few of the key legal hurdles currently dogging Google:
Canadian class-action lawsuit on tracking and surveillance
Google is the subject of a class-action lawsuit in Canada, accused of invasive tracking and surveillance practices. The lawsuit claims Google has breached consumer protection and competition laws through deceptive privacy and data practices. Awaiting a decision in British Columbia, this case emphasizes the ongoing scrutiny over Google’s extensive data collection methods and the clarity of its privacy policies.
Antitrust lawsuit related to online advertising
Google faces a private antitrust lawsuit from the administrator of a sweepstakes website, alleging that Google has misused its dominant position in online advertising to suppress competition. While the lawsuit primarily addresses antitrust issues, it indirectly raises questions about privacy practices, considering the integral role of data collection in digital advertising.
Ongoing and future legal scrutiny
In addition to these specific cases, Google is under continual examination by global regulators, and legal authorities. This scrutiny is largely concentrated on the company’s handling of data, its market power, and the implications for consumer privacy and competitive fairness. The expectation is that Google, alongside other tech behemoths, will persist in facing legal and regulatory challenges as efforts intensify to tackle the intricate dilemmas of privacy, data security, and corporate dominance in the digital sphere.
How can users protect their privacy while browsing?
Given Google’s current scrutiny from its recent settlements and ongoing privacy cases, it’s clear there’s much work to be done to ensure user privacy. In light of this, it’s prudent for users to take matters into their own hands to protect their digital privacy. Here’s how:
- Select privacy-oriented browsers: Choosing browsers that prioritize your privacy, such as Mozilla Firefox, Brave, or Tor, is a step in the right direction. These browsers are designed with privacy features that help reduce tracking and increase encryption.
- Use privacy-focused search engines: Google is known for its data-collection practices. You do not need to use it at all, incognito or otherwise. Alternatives like DuckDuckGo don’t collect your data and allow you a high degree of anonymity.
- Adjust your browser privacy settings: Enhance your browser’s privacy by activating settings that block third-party cookies and disable tracking. While private browsing modes like Incognito prevent your device from keeping a record of your history, they don’t shield you from all forms of online tracking.
- Utilize a high-quality VPN: A VPN, especially a reputable one like ExpressVPN, encrypts your internet connection and hides your IP address, providing a significant boost to your privacy online, particularly on public Wi-Fi networks.
- Install privacy-enhancing browser extensions: Adding extensions such as Privacy Badger and uBlock Origin can further protect your privacy by securing your connections and blocking trackers and ads.
Did Google mislead users about Incognito mode? Let us know your thoughts in the comments!
Protect your online privacy and security
30-day money-back guarantee
Enjoy a safer online experience with powerful privacy protection
What is a VPN?
Comments
…um soo each person wanting to join the claim is entitled to 5K??? Do they have to be CA residents and how can I also get in on this!!? …and to think I’m the only one asking this
Why would ANYONE believe a company whose entire business model is based on extracting, assembling and selling every conceivable piece of useful and usable information about its users? “Free” is just another four-letter word meaning “screw”.
Nothing you do on the internet is private, or incognito.
I’ve always seen a notice that websites can still track you when switching to incognito mode. And if websites can, then Google can, too. Not once have I thought that incognito = private. The only people you’re incognito from are other users of the computer. I thought that was obvious. Guess not.
And for the record, I’m not defending Google here. Their privacy policies are pretty much a bunch of fancy words saying that you have no privacy. I’ve been a longtime Google user but am in the process of switching emails and other things away from Google to more private services. The more I learn about internet tracking, the more I realize the need for as much privacy as possible.
Yes, google did mislead users, simply by using the word “incognito”. I mean, either you’re incognito or you’re not. Clearly you’re not incognito when using incognito mode, so calling it that is definitely misleading.
Don’t trust any of those Big Tech giants. Here are some trips that I think work when combined:
1. Don’t use any Google products. That includes a Google account and using Google Chrome. Use Tor as your browser.
2. Use Firefox’s incognito mode at all times and use DuckDuckGo as your Search Engine when you can.
3. Once #1 and #2 are in-place, turn on your VPN…
And there you go. Maximum privacy…
That is party true, all of those tips will improve your internet security and privacy. To the maximum, not entirely true. One thing to note here is that all of these tips will result in a substantial decrease in internet connection speeds, even with Gigabit ethernet. Your speed may drop from 1Gbps to around 10Mbps with these protocols in place. This comes from personal experience.
That’s why I use Firefox. Also I set up Firefox to delete all cookies and history whenever I close the browser. It means I have to log into websites each time I access them, but it’s a small price to pay to limit tracking. If I have to log into Google or FB, I make sure to close my browser (logout) before I continue browsing.
I think Google did mislead incognito mode, I realized my camera was turning on,my location GPS, all by Google play services I turned them off but keeps going on I’m thinking Google keeps bringing apps up maybe to use spying on me or maybe I’m over thinking don’t know but I see in apps in background turning in by self and is all by Google microphone camera everything turning on by self when I press turn off comes back????
Privacy policy? Gimme a break. They’re unreadable.
That’s your problem tho’
“The court concludes that Google did not notify users that Google engages in the alleged data collection while the user is in private browsing mode,”
Well that certainly explains the recent notice Mozilla posted about their “private browsing” mode, apparently trying to curtail bandwagon lawsuits. I myself had no expectation of privacy just because of these private or incognito modes. I knew (or assumed) the mode does absolutely nothing more than what it says it does: doesn’t save cookies or history, the end. Gee, anyone wonder what ExpressVPN is going to do with my email address that it REQUIRED for me to post this comment? Do I EXPECT privacy? Duhhh, …no.
Not only Google Chrome’s incognito mode, but other browsers also do worse, i believe, and share to Administrators, law agencies, and Ad sites. Incognito only protects the user from browsing data from being embedded in the PC or Mac or any other device having Chrome. The primary concern of the user of Incognito is being caught by his own people or company. This being assured the danger of sharing the information to the persons, sites, administrator quite unknown to the user is deplorable privacy erosion of the user of incognito mode on any browser. Because Google is rich, people tend to leech out some share. Here money is not important. The Judiciary should evolve a strict pattern for all incognito mode which not only protect their privacy with their device or administrator but also does not share to unscrupulous sites persons, sites, administrator quite unknown to the user who are not legally entitled to possess.