Security

Google: You know we said that Chrome tracker contained no personally identifiable info? Yeah, about that...

Chocolate Factory clarifies its header for monitoring browser field trials following The Register report

78 Got Tips?

Updated Google has seemingly stopped claiming an identifier it uses internally to track experimental features and variations in its Chrome browser contains no personally identifiable information.

In February, Arnaud Granal, a software developer who works on a Chromium-based browser called Kiwi, claimed the X-client-data header, which Chrome sends to Google when a Google webpage has been requested, represents a unique identifier that can be used to track people across the web. As such, it could run afoul of Europe's tough privacy regulations.

When The Register reported these claims, Google insisted the X-client-data header only includes information about the variation of Chrome being used, rather than a unique fingerprint. "It is not used to identify or track individual users," the ad giant said.

The Register has no reason to believe the X-client-data header was ever used to track and identify people across websites – Google has better ways of doing that. Concern about the identifier has more to do with insufficient disclosure, inaccurate description, legal compliance, and the possibility that it might be abused for identifiable tracking.

The specific language appeared in the Google Chrome Privacy Whitepaper, a document the company maintains to explain the data Chrome provides to Google and third-parties.

Last month, Google's paper said, "This Chrome-Variations header (X-client-data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation."

That language is no longer present in the latest version of the paper, published March 5, 2020.

Is Chrome really secretly stalking you across Google sites using per-install ID numbers? We reveal the truth

READ MORE

Asked why the change was made, a Google spokesperson said only, "The Chrome white paper is regularly updated as part of the Chrome stable release process."

In place of the old language, seen in this diff image, is a slightly more detailed explanation of the X-client-data header, which comes in two variations, a low-entropy (13-bit) version that ranges from 0-7999 and a high-entropy version, which is what most Chrome users will send if they have not disabled usage statistic reporting.

The Register asked whether the change was made to avoid liability under Europe's GDPR for claiming incorrectly that the X-client-data header contained no information that could be used to personally identify the associated Chrome user. But Google's spokesperson didn't address that question.

In an email to The Register, Granal said, "Knowing a bit the inner-workings on both sides (including Google's lawyers), this is certainly a sensitive issue and it can be costly to Google if the issue is not addressed properly.

"As a user, in the current state, it's important to understand that no matter if you use a proxy, a VPN, or even Tor (with Google Chrome), Google (including DoubleClick) may be able to identify you using this X-Client-Data. Do you want Google to be able to recognize you even if you are not logged-in to your account or behind a proxy? Personally, I am not comfortable with that, but each person has a different sensitivity with regards to privacy.

"I'm sure if you explain in simple words, to national data protection offices that Google can track your computer with a 'permanent cookie' they wouldn't be happy with that at all." ®

Updated to add

After this story was published, a Google spokesperson pointed out the Chrome privacy paper still says the X-client data header doesn't include personally identifiable information, but in different words. The relevant paragraph, we're told, is:

Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value

Also, we're told our claim that Chrome sends high-entropy variations in the header is incorrect: only low-entropy variations are sent.

Sign up to our NewsletterGet IT in your inbox daily

78 Comments

Keep Reading

Google to 'surface' friendly banks' business loans through Pay app

To help Indian small businesses cope with COVID crunch

Google Cloud cancels planned Chinese venture

Doesn't want to follow Azure and AWS by working with locals

Author of infamous Google diversity manifesto drops lawsuit against web giant

James Damore decides he doesn’t need a day in court

Google India says Play store policy, not geopolitics, behind removal of Chinese-app-deleting app

And we’d do it anywhere else, anytime, says veep

Google productises its own not-a-VPN secure remote access tool

Zero-trust access to web applications with very fine-grained access controls

Google creates $10bn 'digitisation fund' for India

Localisation and transformation plan wins prime ministerial approval, but as usual has as much upside for Google as for its generous hosts

Google+ replacement ‘Currents’ to end beta and debut in G Suite on July 6th

Admins told ‘It will not be possible to opt out’ but also promised transition should be painless

Google search trends used to calculate floating prophylactic prices

The more you worry about what's going on below the belt, the further the price drops. Now to short the market

We're suing Google for harvesting our personal info even though we opted out of Chrome sync – netizens

Browser quitters say they'll return if web goliath lives up to privacy promises

Google Cloud CEO says Istio will be handed to a foundation. The Reg: But what about..? Google: That will be all.

Analysis When? Which foundation? What about Knative?

Tech Resources

Has Recent Rapid Cloud Adoption Increased Your Threat Risk?

It’s time to embrace cloud capabilities that can help businesses address speed to market through agility, lower TCO and an increased security posture.

Simplifying Hybrid Cloud Flash Storage

According to industry analysts, a critical element for secure hybrid multicloud environments is the storage infrastructure.

Navigating the New Era of Cloud Computing

Hear from Steve Sibley, VP of Offering Management for IBM Power Systems about how IBM Power Systems can enable hybrid cloud environments that support “build once, deploy anywhere” options.

Hot Tips to Cut Cold Data Costs

This infographic shows how to quickly cut the costs of storing and managing your unstructured data with Komprise Intelligent Data Management.