Is Google’s ‘Nasty’ New Technology Secretly Tracking Your iPhone?

Google’s business model was under attack again this week, with a “broad coalition” of privacy oriented tech firms asking regulators to take a stand against “the collection of data from across websites and services,” enabling “dominant platform actors to abuse their positions by giving preference to their own services.”

Google wasn’t named, but then naming Google wasn’t really necessary. The campaign was organized by Chrome rival Vivaldi, which recently described Google’s secretive new web tracking as a “nasty… dangerous step that harms user privacy.”

This has been a tough few months for Google as Apple has eroded its ability to harvest data from its billion-plus iPhone users, with “surveillance advertising” increasingly in the crosshairs. A bright light is now shining down on data harvesting, and it’s much more difficult for its leading protagonists to find new places to hide.

As I’ve commented before, while Apple Vs Facebook—Cook Vs Zuck—came to personify 2021’s privacy battle, it’s really the philosophical standoff between Apple and Google that carries most significance. Yes, Facebook put on its hard hat and took the early flak from Apple’s Privacy Labels and App Tracking Transparency, but Google is just as heavily impacted, its iOS apps just as errant.

The irony that Apple’s crackdown has upped the value of Android users to advertisers should be lost on no-one. When I advise iPhone, iPad and Mac users to switch from Google apps to alternatives, it isn’t because Android users are not equally—actually much more—impacted by Google’s data harvesting, it’s that they should take this for granted, where at least Apple’s user can exercise enlightened choice.

Back in March, when Google fired up its giant PR machine to push its “privacy-first web” message, eyebrows were quickly raised. And then came FLoC—described as “creepy,” a “terrible idea,” a “nasty” data harvesting venture. This quasi-anonymous data harvesting landed so badly it has sent Google back to the drawing board.

One of the most serious issues with FLoC has been Google’s decision to trial the technology on millions of real-life users, enabling it on their browsers without letting them know, without a warning, an opt-in or even instructions on how to opt out.

This has resulted in serious confusion around who might impacted. Those in Europe, where GDPR protections apply, are not impacted yet. But elsewhere, while it’s obvious that users of Chrome on PCs, Chromebooks and Android devices are at risk, what about Apple’s more locked-down ecosystem? Researchers have found fragments of FLoC logic in Chrome iOS binaries; so, are you at risk from FLoC on your iPhone?

Not just yet you’re not. “Due to Apple’s requirement that all browsers on iOS use their WebKit rendering engine and JavaScript engine,” Google confirmed, eventually, after I asked for clarification. “Chrome for iOS cannot use the Chromium engine. That means that it is significant additional work to port FLoC specifically for iOS.”

It’s not all good news, though. Google told me that “FLoC is supported on Chrome for macOS.” And many iPhone users have Macs, where they’re more likely to run Chrome.

For those on macOS or non-Apple devices, Google has added controls to disable FLoC. “Under settings in Chrome,” it says, “you can choose to turn off Privacy Sandbox trial features, which includes FLoC… We are working to offer even more controls and transparency in the future as we incorporate feedback.”

Privacy Sandbox Settings

Google Chrome / macOS

Google’s justification for FLoC, and for enrolling millions of Chrome users in its new trial without warning, is that their actual data doesn’t leave their browser, it is used solely to assign them to a cohort of likeminded users. But as the privacy lobby has warned, once a cohort ID is linked to other identifiers, such as an IP address, that anonymity is compromised. And given the FLoC trial runs in parallel with those devilish third-party tracking cookies, that risk is currently amplified.

FLoC was the first innovation to emerge from Google’s “Privacy Sandbox,” which it says will “provide the best privacy protections for everyone… By ensuring that the ecosystem can support their businesses without tracking individuals across the web, we can ensure that free access to content continues.”

A “sandbox” is a secure environment that stops data or code leaking out or breaking in. The problem with the Privacy Sandbox, is that it’s Google’s sandbox, which we are being told will protect our data from, erm, Google. “The Privacy Sandbox,” Brave warns, “is designed to serve advertisers as much as possible, with the hope that users will tolerate it, or not notice. This is antithetical to how privacy software should be designed, and incompatible with a user-focused web.”

Google now says it will end the FLoC trial over the coming weeks. “We must take time to evaluate the new technologies, gather feedback and iterate to ensure they meet our goals for both privacy and performance.” Back to that drawing board. The bad news for iPhone users is that we don’t know what’s next—your free pass might be short-lived.

“Google’s statement does not change any part of how FLoC works,” Vivaldi CEO Jon Von Tetzchner told me by email. “Browsers should not profile users… We believe any kind of surveillance-based tracking and advertising is harmful.”

Ironically, Google has made similar pronouncements. “People shouldn’t have to accept being tracked across the web in order to get the benefits of relevant advertising,” it said in March, promising to banish tracking cookies early next year. At the time, it was planning its FLoC alternative to meet the needs of advertisers. But now the situation is even worse, the two-year delay to its anti-cookie plan has undermined its promises.

“Chrome is the only major browser that does not offer meaningful protection against cross-site tracking,” Mozilla warned this week, “and we are concerned that this delay in phasing out third-party cookies will continue to leave their users unprotected.”

The timing could not really be worse for Google, coming just as Apple’s latest innovation presents as a direct attack on Chrome’s business model.

iCloud+ Private Relay

Apple

iCloud’s new Private Relay delivers a genuinely “privacy first web” to Safari. The split-level architecture prevents anyone in the connectivity chain gathering both IP address and DNS queries to “determine user location… fingerprinting user identity and recognizing users across different websites.”

“It is critical to note,” Apple says, “that no one in this chain—not even Apple—can see both the client IP address and what the user is accessing. The opportunities for fingerprinting have been removed.” Imagine Google saying (and meaning) the same. As I have said, you can clearly see the different philosophies at play.

Right now, your iPhone is FLoC-free, but there’s no guarantee it will stay that way—and if you run a Mac, you should disable the Privacy Sandbox setting. Google needs to find a way to appease and feed advertisers, while deflecting the flak from recent data harvesting revelations. That could be an impossible puzzle to solve.

The industry does appear ready to engage in genuinely privacy preserving initiatives that do not shut the door on targeted advertising. But we haven’t seen those as yet. Absent a serious rethink, the likes of Safari and Brave and DuckDuckGo and Firefox will simply block all tracking, with Chrome and smaller standouts left isolated.

“Although we recognize that advertising is an important source of revenue for content creators and publishers,” this broad coalition letter to regulators says, “this does not justify the massive commercial surveillance systems set up to show the right ad to the right people.” It is becoming painfully difficult for Google to argue the point.

Read More