Hacker News Reader

Comment by lamontcg | Hacker News Reader

I'd argue (and this is the point of the lawsuit) that Google being a third party spying on you on 70% of the websites that use Google Analytics is not being adequately disclosed by the warning message in Incognito mode. There is no "oh by the way we de-anonymize and geolocate you and we have your entire porn surfing history in our servers, cheers mate" notice there. The vast majority of internet users would expect that their IP would naturally leak to the porn site they visit, and that seems to be what the warning is about. It doesn't suggest at all to the average user that Google is watching all your activity across all the porn sites you visit--that doesn't become an obvious risk without a lot of specialized knowledge (which most of the readers here probably know, but which 99% of the rest of the world doesn't, which makes that interpretation highly deceptive to the average person).

View on HN

Not that I disagree with you about whether the average person realizes it, but it's not just a risk because Google has JavaScript trackers on your porn site. Google could just make a deal with the porn site to access their server logs and correlate data that way. The fact that you disclose information to the sites you visit means they may, in turn, disclose information to whomever else.

As a totally non-web example of this, as of 2017, "Google’s third-party partnerships ... capture approximately 70% of credit and debit card transactions in the United States." https://adwords.googleblog.com/2017/05/powering-ads-and-anal...

When you buy something with MasterCard, in person, with a magstripe or even an old-school carbon-copy imprinter, MasterCard can go give that data to Google.

I think the incognito warning could say "Websites you visit, and anyone those sites share data with" to draw attention to this, but I'm not sure if that's quite enough. I'm leaning towards the argument from this article that "incognito" itself is simply a poor name.

"By using Chrome or ChromeOS, you agree to the Google Terms of Service located at https://policies.google.com/terms and these Google Chrome and ChromeOS Additional Terms of Service. These Google Chrome and ChromeOS Additional Terms of Service apply to the executable code version of Chrome and ChromeOS."

Google's TOS (as you can see linked there) seems to apply to both Chrome and Google Analytics. By downloading Chrome and agreeing with their EULA, you already acknowledge that this data is being collected. I don't really get what people are objecting to, here.

>99% of people aren't capable of reading the legalese in a TOS agreement, those are all by their very nature inherently deceptive.

And Google's Privacy Policy linked to off of there is one of the subjects of the lawsuit and that it is deceptive.

What I object to, at least, is that GA could ignore incognito mode users, but doesn't. Yes, other ad networks might still get incognito users' data, but they're not the biggest spy company on Earth, Google is. It's misleading that they collect data on both ends of the HTTP call, and have a feature called "Incognito mode" that only affects one end.

I don't see the difference between that and, say, Coke selling a product called "Diet Coke" that just has regular coke in it. A disclaimer reading "Warning: this is just regular coke," might make it legal but it's still messed up, and I wouldn't blame someone for trying their luck in the courts over it.

The TOS can make data collection legal but it doesn't make data collection and implying otherwise legal. Or do they have a clause that says you accept data collection even when they say you're browsing privately?

> Google being a third party spying on you on 70% of the websites that use Google Analytics is not being adequately disclosed by the warning message in Incognito mode

That's something which should be adequately disclosed by the websites you're visiting, which the problem that GDPR tries to solve (and currently fails to solve due to poor guidance and enforcement). Ideally a GDPR "cookie banner" should simply say "This site uses Google Analytics, <other services> to track you across the web. [Allow] [Deny]" instead of the current dark patterns.

Who ever would hit Allow?

There is ONE simple answer here that is in the best interest of your user, and that's rip the invasive 3rd party analytics out of your website.

Anything else is failing to put your users first, and eventually those users will go to a competitor who does. There's so much opportunity out there right now for startups that prioritize decency.

> Who ever would hit Allow?

That's kind of the point of GDPR. But they're not enforcing the main requirements under the law - that the consequences are clear and that choosing to allow or disallow are equally as simple.

Reply on news.ycombinator.com