Is Chrome Spying on You?

The nonprofit Consumer Watchdog
has called on Google to amend several features in its new browser that,
they claim, seriously compromise your privacy on the Web. You may have
noticed that whenever you start typing into Google’s search field, the
site starts suggesting topics for you. Google is, in fact, recording
and storing every keystroke you type, regardless of whether you hit the
search button or not. The company also stores your IP address, which
can narrow your physical location down to within a block or two. In
short, Google has compiled a profile of who you are and what you’re
like, along with a damn good idea of where you live. If the government
would like to know as well, and can get their hands on a subpoena,
there’s not much you can do about it.

This isn’t exactly news; Google’s been doing this for quite some
time. But everyone knows Google is doing this, so if you’re planning to
surf the Web with Google, you’re at least forewarned that your Internet
privacy is a joke. With Chrome, it’s a different story. Chrome has an
"incognito mode," which theoretically preserves your anonymity. But as
Consumer Watchdog points out, the mode often switches off automatically
without your knowledge. You may think you’re surfing the Web without
someone looking over your shoulder, but the reality is considerably

Consumer Watchdog has called on Google to display the incognito
button prominently and remove any chance of hiding it behind pages of
irrelevant text. It has also demanded that the incognito become a
toggle switch, staying on until users explicitly choose to discontinue
it. In fact, Consumer Watchdog wants an incognito button for all of the
company’s applications, including Gmail. At a minimum, they insist,
Google must more prominently warn users that their keystrokes are being
stored somewhere.

Needless to say, Google hasn’t exactly agreed. Consumer Watchdog has
now launched a campaign to pressure the company into complying, and
they have created an online form letter for
users to send to the company. They’ve also produced a short film on how
Google is keep tabs on what you do—which, of course, they’ve posted on

Google Chrome Privacy Issues Prompts Plea To Google Execs

Chief among the group’s complaints is Google Suggest, a
feature found in Chrome and other Google applications like Google

In an effort to publicize what it claims are the privacy failings of Google’s new Chrome browser, Consumer Watchdog is airing its grievances through Google’s YouTube
and urging viewers to use its e-mail form to submit a message to
Google’s board of directors demanding better privacy protection.

Google’s new Chrome browser presents a privacy risk for
consumers, the consumer advocacy group contends, because it sends
information about users’ searches "without users’ full understanding,
consent or control."

Google launched its open source Chrome browser, now in its third beta iteration (version, in early September to provide a better experience and better security for browser-based applications.

Chrome’s Incognito mode, like Microsoft Internet Explorer 8 Beta
2’s InPrivate mode and Apple Safari’s Private Browsing mode, creates a
window in which, as Google puts it, nothing "is ever logged on your computer."

Consumer Watchdog argues that Chrome’s Incognito mode does not confer
the privacy that the mode’s name suggests and that Chrome’s blurring of
local and remote computing "creates confusion in the consumer’s mind
about the privacy and security of confidential information."

Chief among the group’s complaints is Google Suggest, a feature
found in Chrome and other Google applications like Google Toolbar. It
is effectively a keystroke logger than sends every character typed to
Google. Google uses this information to provide search suggestions that
it refines with every subsequent letter.

Google doesn’t see the harm in this. "Just as E.T. needs to
phone home in order to get a spaceship to pick him up, Google Suggest
needs to talk to Google while you type in order to offer suggestions to
you," the company explains on its Web site. "Everything you type, though, is protected by Google’s privacy policy."

Earlier this month, Consumer Watchdog in a letter urged the U.S.
Department of Justice to reject Google’s proposed advertising deal with
Yahoo. The group cited the lack of user control over Google’s data
collection, particularly through Chrome, as the impetus for its
opposition to the deal.

Now the organization wants the various State Attorneys General
to force Google to let consumers choose to use its services

"Google’s role is now unprecedented because the Internet goliath is no
longer merely collecting some data about how we search and surf the
Web," said Consumer Watchdog president Jamie Court in a statement. "Its
new browser and software are actually sending information from inside
our computers to its servers. If Google won’t solve its own privacy
problems, the company must be prepared for regulators to put the brakes
on its unprecedented growth. State Attorneys General need to take
action to protect consumers’ privacy and make sure that computer users
have the ability to opt-out of Google’s web and browse anonymously."
The group wants Google to affix a single prominent button on the main
Chrome page that allows the user to enter Incognito mode instantly and
to maintain Incognito mode through subsequent sessions until the user
chooses to revert to unprotected browsing.

It wants Google users to have a way to extend the Incognito
mode to avoid sending information to Google when searching or invoking
another action that transmits data.

And it wants Incognito mode to actually hide the user’s
identity with a default SSL connection, automatic IP anonymization,
invisibility to all Google servers including Google Analytics, and the
termination of auto-saving, of search suggestions and of external calls
to desktop apps and plug-ins related to browsing.

"You should provide the privacy the name implies or stop calling it Incognito mode," the group said in its letter to Google’s board.

In response to Consumer Watchdog’s complaint, Google said in an e-mailed statement that the organization has misunderstood its products and practices.
Google said it only stores 2% of requests received through Google
Suggest, that it anonymizes the IP address of received Suggest data
within 24 hours, and that users can turn Suggest off by visiting the
Chrome Options menu and clicking the Manage button.

Incognito, according to Google’s statement, is intended to
prevent information from being left on the user’s computer. It is not,
in other words, an anonymization service. Google also said that
Incognito does not default to SSL (Secure Sockets Layer) "because these
connections are provided by Web sites, not browsers, so it is
technologically impossible for Google Chrome to behave this way."

The company said that while it disagreed with Consumer
Watchdog’s video and letter, it remains open to user feedback,
particularly with regard to Chrome as it progresses through beta

If you haven’t seen Chrome in action yet, take a spin through our Google Chrome image gallery and have a look at the browser that’s being touted as a game-changer.

Consumer Watchdog Exposes Google Privacy Problems & Calls For Attorneys General Investigation

Online Video Targets Google’s  New “Chrome” Browser, Websites And Software Revealed

SANTA MONICA, CA — Consumer Watchdog has created a You Tube video showing how your computer could be having an unnoticed conversation about you with Google. The nonprofit group has called on Google’s founders and directors to adopt new privacy safeguards that allow for anonymous internet and software use.  Watch the video here and read the letter to Google’s founders here.

Earlier this month Consumer Watchdog wrote the Justice Department to block Google’s proposed advertising alliance with Yahoo based on these privacy concerns; an announcment about the deal is expected later this week.  The letter notes that the introduction of Google’s new browser, known as “Chrome,” without new privacy protections, poses an unprecedented threat to consumers. (Read it by clicking here.)

“Google’s role is now unprecedented because the Internet goliath is no longer merely collecting some data about how we search and surf the web,” said Consumer Watchdog president Jamie Court. “Its new browser and software are actually sending information from inside our computers to its servers. If Google won’t solve its own privacy problems, the company must be prepared for regulators to put the brakes on its unprecedented growth.  State Attorneys General need to take action to protect consumers’ privacy and make sure that computer users have the ability to opt-out of Google’s web and browse anonymously.”
Consumer Watchdog spoke with Google’s team last month about its concerns, but the company agreed to address only one of the smaller privacy problems uncovered in the video. Google claims users do not expect to be able to navigate the web anonymously, only to have anonymous moments, which is why Google does not have an easy to use privacy mode for its products. The consumer group’s concerns center on creating a simple anonymizing button across Google’s products and websites so that there is transparency and easy opt-out for those who did not wish to share their private data. (Google users can join the campaign and send a free message to the company by clicking here.)

Most computer users do not focus on the huge amounts of data sent to Google’s servers, Consumer Watchdog said. The introduction of Chrome, unless the privacy concerns are addressed seriously and quickly, could mark the end of real user control and choice online because: 

(1) New asynchronous communications are occurring without users’ full understanding, consent or control;
(2) Many Chrome features blur the distinction between the desktop and cloud computing, where a computer user’s software, documents, data and personal information exist not on the consumer’s hard drive but on Google’s servers on the Internet. This creates confusion in the consumer’s mind about the privacy and security of confidential information;
(3) Chrome’s Incognito mode lulls consumers into a false sense of security that their actions are completely private and free from prying eyes when in fact they are not.
“Chrome provides Google unprecedented dominance over the transmission of computer data and warrants higher privacy standards,” wrote Consumer Watchdog President Jamie Court and Policy Advocate John Simpson. “Chrome represents a once-in-a decade opportunity to raise the consumer privacy bar to new heights that will benefit consumers, content providers, and ultimately Google itself.”
To protect user privacy Consumer Watchdog said Google should:

* Place a single prominent button on the main Chrome interface that can’t be hidden or removed and that allows a user to enter Incognito mode instantly without interrupting the user experience.  Once in Incognito mode, the application should assume we want to stay incognito, essentially treating Incognito as a default preference once a user has selected it.  
* Provide clear disclosure on the Google search engine home pages so that users can easily prevent communication with Google before pressing the search button or affirmatively requesting an action.  This could be an extension of an omni-present “Incognito mode” button.  This disclosure needs to be made clear throughout all the Google applications including GMail, Google Talk, and the Google Toolbar.  This disclosure needs to be more than a confusing warning a few clicks away. It should be a convenient, actionable feature so that the user can exercise informed choice.
* Ensure that Incognito mode has the full meaning the word implies when users opt for it.   Incognito mode should default to SSL  (Secure Sockets Layer) connections, provide an automatic IP anonymizing service, enforce a no-log policy on all Google servers including Google Analytics, as well as disable auto-saving, suggestions, and all other feature that use asynchronous event handlers other than button and link click.  Incognito should disable all external calls to desktop applications and plug-ins whose applications fail to meet equivalent standards

“We look forward to your response and to working with Google to make the company the standard bearer for privacy on the Internet,” Consumer Watchdog’s letter concluded.
 – 30 –

Consumer Watchdog, formerly known as The Foundation for Taxpayer and Consumer Rights, is non-profit and non-partisan consumer advocacy group.  For more information visit

Google’s Growth Makes Privacy Advocates Wary

NEW YORK (NY) — Perhaps the biggest threat to Google Inc.’s increasing dominance of Internet search and advertising is the rising fear, justified or not, that Google’s broadening reach is giving it unchecked power.

This scrutiny goes deeper than the skeptical eye that lawmakers and the Justice Department have given to Google’s proposed ad partnership with Yahoo Inc. Many objections to that deal are financial, and surround whether Google and Yahoo could unfairly drive up online ad prices.

A bigger long-term concern for Google could be criticisms over something less tangible – privacy. Increasingly, as Google burrows deeper into everyday computing, its product announcements are prompting questions about its ability to gather more potentially sensitive personal information from users.

Why does Google log the details of search queries for so long? What does it do with the information? Does it combine data from the search engine with information it collects through other avenues – such as its recently released Web browser, Chrome?

Data gathered through most of the company’s services "disappears into a black hole once it hits the Googleplex," said Simon Davies, director of London-based Privacy International, referring to Google’s headquarters. "It’s impossible to track that information."

Google – whose corporate motto is "Don’t Be Evil" – generally sees such concerns as misinformed. For instance, the company says it stores the queries made through its popular search engine primarily so it can improve the service.
But whether the criticisms are valid or not, they are likely indicative of the battles Google will face as it, like Microsoft Corp. in the 1990s, moves from world-wowing startup to the heart of the technology establishment.

The September release of Chrome illuminated the budding conflicts.

To Google, the new browser is a platform on which future Web-based software applications might run most efficiently. It also is a sign that Google understands its growing power, since launching a browser is a direct challenge to Microsoft.

In other circles, Chrome provoked suspicion. One group, Santa Monica, Calif.-based Consumer Watchdog, argues that the browser crosses a new line.

In a mid-October letter to Google directors, Consumer Watchdog said it had "serious privacy concerns" about the browser and the transfer of users’ data through Google’s services without giving people what it sees as "appropriate transparency and control."

One of Consumer Watchdog’s complaints surrounds Chrome’s navigation bar, which can be used to enter a Web site address or a search query. The group points out that as users type in the navigation bar, Chrome relays their keystrokes to Google even before they click "Enter" to finalize the command.

"The company is literally having this unnoticed conversation with itself about you and your information," Consumer Watchdog President Jamie Court said.

This "conversation" stems from the "Google Suggest" feature, which is built into the browser and other Google products, including its basic Internet search engine.

"Google Suggest" sends Google searches as you type, in hopes of anticipating your desires. So if you’re keying in "Electoral College 2008 election," Google will offer multiple search queries along the way. First you’d be given results related to the term "electoral," then ones on the Electoral College in general, and finally you’d get links pertaining to Tuesday’s presidential vote.

This is what worries Consumer Watchdog: Say you key in something that could be embarrassing or deeply personal, but reconsider before you press "Enter." The autosuggest feature still sends this phrase to Google’s servers, tied to your computer’s numeric Internet Protocol (IP) address.

Brian Rakowski, the product manager for Chrome, said Consumer Watchdog’s fears stemmed from confusion about the role a Google Web browser plays.

"There was some concern that, given a very naive way of how browsers work, you may think, ‘Now I’m using a Google browser – Google must know everything on their servers about me,’" he said.

Rakowski said queries sent to Google through the autosuggest feature do include data like a user’s IP address and the time at which the queries were made. But Google logs just 2 percent of the information brought in through "Google Suggest," in order to improve the feature, Rakowski said, and anonymizes this data within 24 hours. The anonymization is accomplished by stripping off the last four digits of the IP address associated with the query.

"You’re flying blind without that information, so we have to collect a little bit," he said. "But we’re really (collecting) the bare minimum we can to provide that service."

The autosuggest function can be shut off in the browser or when using Google’s search engine through its home page, but it is not immediately evident how to do so.

One way is through Chrome’s "incognito" tab, which turns off the autosuggest feature and lets users surf the Web without revealing their activities to people who have access to the same computer. However, Consumer Watchdog objects to the design of "incognito." The group claims the feature makes users feel that their Web surfing is totally private, while in fact Google is still sending some information back and forth between users’ PCs and the company’s servers.

Google takes issue with that complaint, too. The "incognito" function lets users surf without leaving a trail of pages visited or "cookie" data-tracking files behind, but can’t entirely cloak someone’s Internet activity from the outside world.

"We try to be very upfront with users when they enter this mode about what it provides and what it doesn’t provide," Rakowski said.

Although Chrome is new, Consumer Watchdog is not waiting to see whether it gets too little use to worry about. In October, Court’s group wrote U.S. Attorney General Michael Mukasey to caution him about Google’s plans to sell ads for Yahoo, saying that its fears about Google’s market power have been exacerbated by Chrome’s release.

"It’s about having a monopoly over our personal information, which, if it falls into the wrong hands, could be used in a very dangerous way against us," Court said.

Google’s senior product counsel, Michael Yang, said the company is not using any data from Chrome to make improvements to its ad services.

But that doesn’t mollify privacy critics, who fear Google might start doing that someday to best capitalize on its vast audience. Some 650 million people use Google’s search engine and panoply of Web services.

"The way Google has fashioned Chrome, it’s a digital Trojan horse to collect even more masses of consumer data for Google’s digital advertising business," said Jeff Chester, executive director for the Center for Digital Democracy, a consumer rights organization.

For now, at least, Google is planning to adopt just one change suggested by Consumer Watchdog. When users spell a Web site’s address incorrectly, Chrome sends a request to Google to help determine the actual site the user is trying to visit. This happens even when users are surfing "incognito," and Rakowski said it was an oversight.

"It’s something we’re prioritizing now that we want to fix," he said.

This is not to say that Google is avoiding other privacy-related changes. In July, the company began linking to its privacy policy on its home page. It also recently began its anonymization of the data it stores through the "Google Suggest" feature.

But one other privacy-related move might say more about how Google is perceived than anything.

In September, to placate European Union data protection officials, Google said it would maintain its search logs – which track search queries and the IP addresses they came from – for nine months instead of 18, as it had been doing.
After that time, Google will alter IP addresses to mask their source. (That probably won’t provide true anonymity, since an aggregated list of search queries over time will likely reveal clues about who made them.)

Google hoped the move would win it favor. After all, Microsoft waits 18 months before it anonymizes its search engine logs, and Yahoo does so after 13.

Even so, the EU’s justice and home affairs commissioner said Google should shorten its logs further, to six months. Davies, of Privacy International, says the change from 18 to nine months was "not meaningful."

Court says that with all its products, Google has more opportunities than its peers to capture personal information without users realizing it.

"Google’s founders may say, ‘We’re going to protect that information,’ but no other company," he said, "is positioned to exploit that information in the way Google is."