Google sucks up consumer data in ways users might find surprising—such as when browsers are in "incognito" mode—according to an analysis of the company's data collection by a researcher from Vanderbilt University.
The study, released Tuesday and commissioned by the trade org Digital Content Next, looks at how data is gathered from all Google products, including Android mobile devices, Chrome web browsers, YouTube and Photos. In addition to incognito data collection, the study looked at other "passive" means of collection, where "an application is instrumented to gather information while it's running, possibly without the user's knowledge," the report says.
Many users assume that when they're in the incognito setting, their online footprints are hidden. But Google could retroactively link the private browsing to specific consumers, the report points out.
As the reports puts it: "While such data is collected with user-anonymous identifiers, Google has the ability to connect this collected information with a user's personal credentials stored in their Google Account."
Here's how it works: A person fires up a private browser session in Chrome. On websites that run ads from Google's online ad marketplace, anonymized cookies are dropped on the browsers associated with the user. If the same person logs into a Google service like Gmail or YouTube, the act of signing into Google makes it possible to connect the earlier web activity to the now identified user. (Unless, that is, the cookies expired or were manually deleted by the user.)
"That's not well understood by consumers," says Douglas Schmidt, author of the study and professor of computer science professor at Vanderbilt University. "But if you read the fine print on 'incognito' mode it brings up a whole lot of disclaimers."
The study could not tell if Google takes the steps necessary to link the anonymous data from private browsing to the de-anonymized data when the person logs into its services.
"Google collects all the information necessary to make that connection," Schmidt says. "It would give them a relative advantage to anyone else who can't do that correlation."
"If a user is 'incognito' they think they're being as private as possible, and they're not realizing they gave that all up because they logged in," says Jason Kint, CEO of Digital Content Next, a trade group known for its opposition to the major internet companies' online dominance. "It's reasonable to think the average user does not expect that to be happening."
According to an email from a Google spokeswoman, the company does not "join signed-out activity with your Google account information. We do not associate incognito browsing with accounts you may log into after you've exited your Incognito session. And our ads systems have no special knowledge of when Chrome is in incognito mode, or any other browser in a similar mode (ex: Safari Private Browsing, Firefox Private Browsing). We simply set and read cookies as allowed by the browser."
The Google spokeswoman says the company takes issue with the report in general, citing the fact that Schmidt, the Vanderbilt University professor, once was used as an expert witness on behalf of Oracle in a case against Google, and Digital Content Next's involvement.
"This report is commissioned by a professional DC lobbyist group, and written by a witness for Oracle in their ongoing copyright litigation with Google," the spokeswoman said in an e-mail statement. "So, it's no surprise that it contains wildly misleading information."
Location, location, location
The study also says that Google gets a sense of a person's location every time they log into WiFi or their phone pings a cell tower and that this, in turn, can even help it figure out a person's mode of transportation.
"Google can ascertain with a high degree of confidence whether a user is still, walking, running, bicycling, or riding on a train or a car," the report says. "It achieves this by tracking an Android mobile user's location coordinates at frequent time intervals in combination with the data from onboard sensors [such as an accelerometer] on mobile phones."
Google Photos is another vast reservoir of data thanks to image recognition, according to the report. By default, Google analyzes photos and detects landmarks, logos, animals and other features, and it even registers the emotional state of people's faces.
"Google's face detection capabilities even enable the detection of emotional states associated with faces in photos," the report says.
The report was particularly concerned with the amount of passive data collected by Google, including information gotten through ads and third-party web and app activity not directly owned by Google. The report claims two-thirds of data collected by Google would be considered "passive."
"While such information is typically collected without identifying a unique user," the report says, "Google distinctively possesses the ability to utilize data collected from other sources to de-anonymize such a collection."
The study comes just as lawmakers in Washington consider more stringent privacy regulations. The EU already enacted its stricter General Data Protection Regulation in May, and Facebook and Google are facing similar pressure in the U.S. to account for how they track consumers online.
In April, Facebook CEO Mark Zuckerberg testified to Congress about Cambridge Analytica, the third-party data firm that was accused of misusing data on 87 million Facebook users to unduly influence elections in the U.S. and U.K.
A major concern of some U.S. lawmakers during those hearings focused on how Facebook tracks consumers that don't even use its services by gathering data through third-party websites with Facebook "like" and "share" buttons.
The Vanderbilt report raises similar questions about Google. There are 15 million websites using Google's ad services and 30 million use Google Analytics, which is the platform that lets them track traffic and other site performance metrics. Also, Chrome accounts for 60 percent of all web browsing with a billion monthly users, the report says.
An Associated Press report just last week showed how the company can record people's locations even when they turn off location tracking in their settings. Google is still able to log a person's location through its phones and other devices when a person fires up Google Maps or searches weather, the AP reported.
CORRECTION: An earlier version of this story mischaracterized how the study describes the potential for data collecting from people browsing the internet in "incognito" mode. According to the study, Google could potentially tie data gathered while in " incognito" mode to the user if that user logs into a Google service before exiting the private browsing session. Exiting an "incognito" session before logging into a Google service would delete any data associated with that session.
