Security

Google: You know we said that Chrome tracker contained no personally identifiable info? Yeah, about that...

Chocolate Factory clarifies its header for monitoring browser field trials following The Register report

By Thomas Claburn in San Francisco

78 SHARE

Updated Google has seemingly stopped claiming an identifier it uses internally to track experimental features and variations in its Chrome browser contains no personally identifiable information.

In February, Arnaud Granal, a software developer who works on a Chromium-based browser called Kiwi, claimed the X-client-data header, which Chrome sends to Google when a Google webpage has been requested, represents a unique identifier that can be used to track people across the web. As such, it could run afoul of Europe's tough privacy regulations.

When The Register reported these claims, Google insisted the X-client-data header only includes information about the variation of Chrome being used, rather than a unique fingerprint. "It is not used to identify or track individual users," the ad giant said.

The Register has no reason to believe the X-client-data header was ever used to track and identify people across websites – Google has better ways of doing that. Concern about the identifier has more to do with insufficient disclosure, inaccurate description, legal compliance, and the possibility that it might be abused for identifiable tracking.

The specific language appeared in the Google Chrome Privacy Whitepaper, a document the company maintains to explain the data Chrome provides to Google and third-parties.

Last month, Google's paper said, "This Chrome-Variations header (X-client-data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation."

That language is no longer present in the latest version of the paper, published March 5, 2020.

Is Chrome really secretly stalking you across Google sites using per-install ID numbers? We reveal the truth

READ MORE

Asked why the change was made, a Google spokesperson said only, "The Chrome white paper is regularly updated as part of the Chrome stable release process."

In place of the old language, seen in this diff image, is a slightly more detailed explanation of the X-client-data header, which comes in two variations, a low-entropy (13-bit) version that ranges from 0-7999 and a high-entropy version, which is what most Chrome users will send if they have not disabled usage statistic reporting.

The Register asked whether the change was made to avoid liability under Europe's GDPR for claiming incorrectly that the X-client-data header contained no information that could be used to personally identify the associated Chrome user. But Google's spokesperson didn't address that question.

In an email to The Register, Granal said, "Knowing a bit the inner-workings on both sides (including Google's lawyers), this is certainly a sensitive issue and it can be costly to Google if the issue is not addressed properly.

"As a user, in the current state, it's important to understand that no matter if you use a proxy, a VPN, or even Tor (with Google Chrome), Google (including DoubleClick) may be able to identify you using this X-Client-Data. Do you want Google to be able to recognize you even if you are not logged-in to your account or behind a proxy? Personally, I am not comfortable with that, but each person has a different sensitivity with regards to privacy.

"I'm sure if you explain in simple words, to national data protection offices that Google can track your computer with a 'permanent cookie' they wouldn't be happy with that at all." ®

Updated to add

After this story was published, a Google spokesperson pointed out the Chrome privacy paper still says the X-client data header doesn't include personally identifiable information, but in different words. The relevant paragraph, we're told, is:

Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value

Also, we're told our claim that Chrome sends high-entropy variations in the header is incorrect: only low-entropy variations are sent.

Sign up to our NewsletterGet IT in your inbox daily

78 Comments

Keep Reading

Google to appeal against €7m fine from Swedish watchdog for failing to remove search results under GDPR

Right to be forgotten? We forgot...

Google reveals the wheels almost literally fell off one of its cloudy server racks

Crushed rollers sent rack into the red until techies solved wheely obscure problem

Campaigners cry foul play as Oracle funds conservative lobby group supporting its court case against Google

Google-funded think tanks need to sit back and, er, have a think

Virtual reality: Now even the online Google Cloud Next event is postponed

No, this is not business as usual as the C-virus continues to wreak havoc

Google Takeout a bit too true to its name after potentially 1000s of private videos shared with complete strangers

1% of 1% of users affected, but as it's Google that's still in the six figures

I/O, I/O, no work from home for show: Google will not hold 2020 event 'in any capacity'

Developers advised to check blogs and forums for product news

Artful prankster creates Google Maps traffic jams by walking a cartful of old phones around Berlin

Silent geolocation-dependent services are so reliable

From Gmail to Gfail: Google's G-Suite topples over for unlucky netizens, rights itself

Updated East Coast looks to be hardest hit. C'mon, Chocolate Factory, we're relying on you to pull us through

Devs invited to bake 'Run on Google Cloud' button into git repos... By Google, of course

An offer you can refuse?

Low code? Low usage, more like: Add G Suite's App Maker to the Google graveyard, it's switching off next year

Dun-dun-dun, another one bites the dust

Tech Resources

Why you need managed detection and response

How do you go about implementing MDR securely and manageably? Dave Martin from Open Systems has promised to tell us. He’s talking to the Reg’s Tim Phillips, and he will explain why your organization needs MDR, how to convince the business that it needs it too, and how to implement it.

KEMET Customer Story

KEMET chooses Open Systems to optimize performance of cloud apps, secure cloud connectivity and reduce costs by 50%

Faster Response with CrowdStrike and MITRE ATT&CK

Today’s threat landscape has created new challenges for security analysts and incident responders.

A Definitive Guide to Understanding and Meeting the CIS Critical Security Controls

The CIS Critical Security Controls are the industry standard for good security. Are you up to par?