Does the idiot Texas Attorney General have a point about Chrome’s incognito mode?

The Lone Star State comes before Incognito mode.

In a petition filed Thursday that piggybacked on a previous lawsuit against Google, Texas Attorney General Ken Paxton she described the so-called “private” search setting as misleading and “deceptive” because of its location tracking.

Paxton pulls out his dictionary and takes issue with Google’s use of the term “incognito,” which he says an everyday Texan would interpret as having “hidden his identity.” That is also the interpretation of Merriam-Webster.

“Google’s statements about incognito mode are false, deceptive, and misleading,” the lawsuit said. “Not only do users not know that Google can and will collect data about them during private browsing, there is no way for users to avoid many of Google’s data collection practices.”

Screenshot: Google Chrome

Incognito browsing hides your search history from other people using your device. It doesn’t stop Google or its advertiser friends from logging in and taking advantage of your search history. Does Paxton, an idiot election denier indicted for seven years, have a point?

A Google spokesperson denied his claims and pushed back in an email sent to Gizmodo.

“The attorney general’s case is again based on erroneous and outdated claims about our institutions,” the spokesperson said. “We have always built privacy features into our products and provide robust controls for location data. We strongly dispute these claims and will defend ourselves to set the record straight.”

The amended lawsuit is against Google for allegedly deceptively capturing user data while browsing in Incognito mode. “Google is doing this,” the indictment reads, “despite repeatedly reassuring Texans that they have control over what information generated during an incognito session is shared with Google and others.” Google explains some of these details when you launch Incognito, but only after clicking a “learn more” link and clicking another drop-down menu again.

According to Paxton, Google “deceptively suggests that incognito mode allows Texans to control what information Google sends and collects.”

I made another claim against Google for giving users control over their privacy and data. I will not allow this #BigTech company to continue to abuse Texans by taking advantage of users’ personal information when they use ‘incognito mode’.https://t.co/c7N5jIXTKk

— Texas Attorney General (@TXAG) May 19, 2022

Paxton shits lawsuits and investigations with an amazing clip. Many of them balance absurdity, cruelty, and stupidity. He filed a lawsuit to overturn the 2020 election in favor of Donald Trump, claiming an “overthrow” by Joe Biden. The state bar is suing him for that. He has been charged with fraud related to his stock transactions and investments since 2015. You can see a nightmarish, half-smiling mugshot here (trigger warning). He has ordered DirecTV to keep the election-denying cable channel One America News on the air, or else. In this lawsuit against Google, he is trying to win favor with the Republican grassroots by cracking down on the liberal specter of Silicon Valley, as evidenced by the hashtag #BigTech in a tweet from his office Thursday. At the same time, he sued Meta earlier this year over Facebook’s facial recognition software, alleging the service violated Texas privacy laws. He has filed an antitrust suit against Google alleging that the company has illegally used its market power to control the way online ads are priced, an accusation akin to the hate behind bipartisan legislation now poised to pass the bill. Reach the Senate floor. And that’s just one of five lawsuits he’s filed against Google.

So on the incognito issue, does Paxton have a point? Privacy experts and researchers who spoke to Gizmodo say: absolutely.

Private browsers: “In practice, they offer very little.”

Photo: Drew Angerer, Getty Images

Gizmodo spoke with Bennett Cyphers, the staff technologist at the Electronic Frontier Foundation, to get an idea of whether or not Paxton is full of it. While Cyphers couldn’t vouch for all of the AG’s specific claims, he agreed that Google’s privacy claims surrounding Incognito are misleading.

“For a user who isn’t that advanced or even moderately advanced, it’s really hard to understand how many different ways data about you can be collected on the web.” The nuances involved in parsing all those techniques risk being washed away by simply referring to the setting as “incognito.”

“Private modes in web browsers were never designed as a general privacy solution. In practice, they offer very little,” independent cybersecurity and privacy consultant Lukasz Olejnik told Wired in 2019. Olejnnik says that user data generated during private browsing and regular sessions is the same. Third-party sites can also detect whether or not a user is engaged in private browsing, which, Olejniks says, is why paywall news sites like The New York Times or Wired can still tell when an anonymous reader is browsing their latest Even if you only use private tanning to watch videos () on a shared device secretly, researchers say someone with enough motivation can still find traces of that browsing history on the machine’s hard drive and memory.

EFF’s Cyphers criticized Google, which along with Chrome, has the vast majority of the browser market share, for doing what it sees as significantly less for privacy than other companies.

“Google has more resources than anyone to build an advanced private browser, but their idea of ​​a private browsing mode is much less sophisticated and nuanced than their competitors,” Cyphers says. He pointed to Safari and Firefox as alternative browsers with more tailored methods that are preferable to Google’s blocking all third-party cookies.

“Your private browsing mode only blocks your browser from recording your traffic and doesn’t hide your IP,” writes Daniel Markuson of Nord Virtual Private Network. “It doesn’t encrypt or route your traffic through a remote server like a VPN. It only clears your browsing history, clears cookies when you close the browser and deletes the data you enter in online forms. Your ISP, employer, websites, search engines, governments, and other third-party snoops can still collect your data and track your IP address.”

None of this might come as a surprise to casual Gizmodo readers. Still, it doesn’t necessarily come naturally to most Chrome users who don’t have the time or interest to dig under the hood of Incognito. A 2018 study by researchers from the University of Chicago and the Leibniz University of Hanover tackled the problem and found rampant misunderstandings about what Incognito and other privately-owned tanning tools do and don’t do. 56.3% of participants in that survey believed Incognito prevented Google from seeing their search history (it doesn’t). In comparison, 37% said they thought Incognito might prevent their employer from tracking them (that can not). About a quarter felt that using Incognito would give them more protection against viruses and malware (again, no).

“Google offers a pretty decent, stupid way to protect your privacy, but it’s not very sophisticated and lacks a lot of ways that trackers can still collect data and break functionality on sites that don’t need to be broken if they use a more targeted and advanced privacy-protective approach,” said Cyphers.

Texas’ suit over Chrome’s Incognito mode isn’t the only one.

We understand if throwing Ken Paxton makes you want to lose your lunch. It’s worth noting that he’s not alone in taking Google to court over Incognito. Google was sued in 2020 as part of a class action lawsuit accusing the company of invading the privacy of millions of users by tracking them while using Incognito mode. The case, seeking damages of at least $5 ($7) billion, alleges that Google deliberately misled its users regarding Incognito’s functionality. Google tried to quash the case, but last March, a U.S. District Court judge said the company “has failed to notify users that Google is engaged in the alleged data collection while the user is in private browsing mode”. Google CEO Sundar Pichai was reportedly warned in 2019 not to list Incognito as private, but he continued to do so anyway. A broken clock like Ken Paxton is right twice a day. To put it more, a Texan, even a blind pig, can still sniff a few truffles.

Regarding what Google can do better, EFF’s Cyphers said Google could improve Incognito by following Firefox’s lead, adopting a tracker block list, restricting certain first-party cookies, and taking more active anti-fingerprinting measures. “Just try harder,” he said. Even with all these steps accomplished, Cyphers says Google’s ad-based business model is inherently inconsistent with its privacy obligations.

“The best thing Google can do is separate their advertising business into a separate company so that there isn’t a huge conflict of interest at the heart of the business model,” he said.