Photo by Simon Ray on Unsplash
In a recent lawsuit settlement, Google agrees to delete the incognito browsing data they keep about you. Yes, why are we not surprised?
Summary
Google has agreed to delete billions of records of users' private browsing activities collected while using its Chrome browser's Incognito mode as part of a settlement to a class-action lawsuit filed in 2020. The settlement, which was filed in April 2024, requires Google to delete or de-identify historical data and implement changes to improve transparency about data collection during private browsing. The company also agreed to block third-party cookies by default for Incognito users for the next five years.
Google will delete "billions" of data records reflecting private browsing activities, including search history and web activity, from users who used Incognito mode.
The settlement mandates that Google rewrite its disclosures to clearly inform users that data is still collected during Incognito sessions, including updates to the Privacy Policy and the Incognito Splash Screen.
Google agreed to prevent future tracking of users' choices to browse privately, a change that has already been implemented.
The settlement does not include any monetary damages from Google; instead, individuals can pursue their own claims for damages in U.S. state courts, with over 50 such claims already filed.
The agreement is subject to approval by a California federal judge, with the case currently pending.
Background Before the Lawsuit
Before the 2020 lawsuit, Google launched Incognito mode in Chrome in 2008, promoting it as a way to browse more privately. While it prevented the browser from saving search history, cookies, and site data locally, Google continued collecting user data through its advertising tools, analytics services, and cookies during these sessions.
Internal company communications later revealed in court showed growing concerns:
A 2015 internal email referred to Incognito as "a lie."
In 2019, Google’s marketing chief, Lorraine Twohill, told CEO Sundar Pichai that the company couldn’t strongly promote Incognito because "it’s not truly private," requiring "fuzzy, hedging language."
A 2018 engineer suggested updating the Incognito splash screen to say: "You are NOT protected from Google."
Despite these internal warnings, Google did not clearly disclose to users that it still collected browsing data during private sessions. This lack of transparency led to the class-action lawsuit filed in 2020, alleging violations of federal wiretapping and privacy laws.
Photo by Maxim Hopman on Unsplash
Key Terms of the Settlement
Data Deletion and Remediation:
Google must delete or de-identify vast amounts of historical data reflecting users' private browsing activities. This includes search queries, visited websites, and other online behavior collected during Incognito sessions.
Improved Transparency:
Google agreed to update its disclosures to clearly inform users that:Websites, employers, schools and internet service providers can still see browsing activity.
Google itself may still collect data during Incognito sessions via its services embedded on websites.
Default Third-Party Cookie Blocking:
For the next five years, Google will block third-party cookies by default for Incognito users, reducing cross-site tracking.
No Direct Compensation:
The settlement does not provide monetary payouts to users. However, individuals retain the right to file separate lawsuits for damages in state courts.
Internal Company Concerns Revealed:
Court documents revealed internal Google communications:A 2018 engineer email questioned calling the mode "Incognito" and suggested the motto: "You are NOT protected from Google."
Marketing chief Lorraine Twohill told CEO Sundar Pichai that the company couldn’t strongly market Incognito because "it’s not truly private."