Security

Google: You know we said that Chrome tracker contained no personally identifiable info? Yeah, about that...

Chocolate Factory clarifies its header for monitoring browser field trials following The Register report


Updated Google has seemingly stopped claiming an identifier it uses internally to track experimental features and variations in its Chrome browser contains no personally identifiable information.

In February, Arnaud Granal, a software developer who works on a Chromium-based browser called Kiwi, claimed the X-client-data header, which Chrome sends to Google when a Google webpage has been requested, represents a unique identifier that can be used to track people across the web. As such, it could run afoul of Europe's tough privacy regulations.

When The Register reported these claims, Google insisted the X-client-data header only includes information about the variation of Chrome being used, rather than a unique fingerprint. "It is not used to identify or track individual users," the ad giant said.

The Register has no reason to believe the X-client-data header was ever used to track and identify people across websites – Google has better ways of doing that. Concern about the identifier has more to do with insufficient disclosure, inaccurate description, legal compliance, and the possibility that it might be abused for identifiable tracking.

The specific language appeared in the Google Chrome Privacy Whitepaper, a document the company maintains to explain the data Chrome provides to Google and third-parties.

Last month, Google's paper said, "This Chrome-Variations header (X-client-data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation."

That language is no longer present in the latest version of the paper, published March 5, 2020.

Is Chrome really secretly stalking you across Google sites using per-install ID numbers? We reveal the truth

READ MORE

Asked why the change was made, a Google spokesperson said only, "The Chrome white paper is regularly updated as part of the Chrome stable release process."

In place of the old language, seen in this diff image, is a slightly more detailed explanation of the X-client-data header, which comes in two variations, a low-entropy (13-bit) version that ranges from 0-7999 and a high-entropy version, which is what most Chrome users will send if they have not disabled usage statistic reporting.

The Register asked whether the change was made to avoid liability under Europe's GDPR for claiming incorrectly that the X-client-data header contained no information that could be used to personally identify the associated Chrome user. But Google's spokesperson didn't address that question.

In an email to The Register, Granal said, "Knowing a bit the inner-workings on both sides (including Google's lawyers), this is certainly a sensitive issue and it can be costly to Google if the issue is not addressed properly.

"As a user, in the current state, it's important to understand that no matter if you use a proxy, a VPN, or even Tor (with Google Chrome), Google (including DoubleClick) may be able to identify you using this X-Client-Data. Do you want Google to be able to recognize you even if you are not logged-in to your account or behind a proxy? Personally, I am not comfortable with that, but each person has a different sensitivity with regards to privacy.

"I'm sure if you explain in simple words, to national data protection offices that Google can track your computer with a 'permanent cookie' they wouldn't be happy with that at all." ®

Updated to add

After this story was published, a Google spokesperson pointed out the Chrome privacy paper still says the X-client data header doesn't include personally identifiable information, but in different words. The relevant paragraph, we're told, is:

Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value

Also, we're told our claim that Chrome sends high-entropy variations in the header is incorrect: only low-entropy variations are sent.

Send us news
78 Comments

Google gooses Safe Browsing with real-time protection that doesn't leak to ad giant

Rare occasion when you do want Big Tech to make a hash of it

Why France this week fined Google €250M over web news

Google pulls a few coins from the sofa and says whatever, just clarify who needs to be paid for what

Google's AI-powered search results are loaded with spammy, scammy garbage

Be careful where you click

First the Super Bowl, now this: Kansas City getting a Google bit barn

Exact location, power source, and go-live date unknown. But don't worry, there'll be digital jobs

India's competition regulator orders Google Play payment probe

Choice of alternative payment providers labelled 'illusory' – because none existed

In-app browsers are still a privacy, security, and choice problem

Regulators reminded that longstanding concerns haven't been addressed

Sorry, Siri: Apple may be eyeing Google Gemini for future iPhones

Famous for keeping everything in-house, Apple may be carving AI-shaped door in its garden wall

The way Apple, Alphabet implemented DMA rules 'seems to be at odds' with law

European Commission says 12-month investigation could lead to fine of up to 10% of global revenue

Miscreants are exploiting enterprise tech zero days more and more, Google warns

Crooks know where the big bucks are

Chrome users – get an alert when extensions are in danger of falling into wrong hands

Under New Management is an early-warning system for potential poisoning of add-ons with malware

EU antitrust cops probe Microsoft ties between Entra ID and 365 services

Google claims rival has made an 'art and science' out of licensing

Microsoft says AI alliances are needed to compete with Google

Only the Chocolate Factory is 'vertically integrated' to win at 'every AI layer from chips to a thriving mobile app store'