Google Chrome's AI API actively used for device fingerprinting and profiling
In order to conduct the research I carried out forensic audits of 100 of the top english language content websites (no B2B or SaaS - just consumer content sites) monitoring all browser events and capturing payloads.
Even though I was not specifically looking for AI API events, the results are quite alarming.
Around 30% of the sites audited are using the AI API for either device fingerprinting, profiling (Google Advertising) or both.
This is despite Google assuring the world that the API would not create any privacy risks after concerns we raised when they announced their plan to add the API.
The rest of the findings are equally shocking and out of the 100 sites audited - every single one of them is in breach of EU law (tort, regulatory and criminal) and almost definitely in breach of various US and other laws across the world.