OCTOBER 11, 2022
On International Data Privacy Day last year, an email popped into Alphabet Inc. Chief Executive Sundar Pichai’s inbox from Google’s marketing chief Lorraine Twohill full of ideas on gaining user trust.
“Make Incognito Mode truly private,” she wrote in a bullet point. “We are limited in how strongly we can market Incognito because it’s not truly private, thus requiring really fuzzy, hedging language that is almost more damaging.”
Now, billions of dollars in damages could be at stake in a consumer lawsuit targeting the private-browsing feature if a judge agrees Tuesday to let the case proceed as a class action on behalf of millions of users.
Twohill’s assessment of Incognito’s shortcomings was remarkably candid considering Google had already been sued at the time she messaged her boss, who himself had shepherded the feature through development back when the company launched its Chrome browser in 2008.
Google denies wrongdoing. “Privacy controls have long been built into our services and we encourage our teams to constantly discuss or consider ideas to improve them,” spokesman Jose Castaneda said in an email.
Court filings show that well before the search engine giant was taken to court, rank and file Googlers frankly voiced their own frustrations that Incognito didn’t live up to its name.
“We need to stop calling it Incognito and stop using a Spy Guy icon,” one engineer said in a 2018 chat among Google Chrome engineers, after sharing research that showed users misunderstood features of private browsing modes. He was referring to the image of sunglasses under a hat that pop ups with a message, “You’ve gone Incognito,” when a user opens a new tab to browse privately.
A colleague responded by posting a link to a wiki profile of a character on “The Simpsons” cartoon show called Guy Incognito, who is a doppelganger of protagonist Homer Simpson. “Regardless of the name, the Incognito icon should have always been” Guy Incognito, the employee said. “Which also accurately conveys the level of privacy it provides.”
Twohill’s memo and a transcript of the employee chat are part of a larger collection of emails, presentations and employee testimony, all buried in court records, that offers a window into the controversy within Google around Incognito.
The paper trail of criticism has been submitted as evidence in a lawsuit that accuses Google of quietly scooping up troves of user data after misleading people into thinking their privacy is protected.
Tuesday’s hearing in Oakland, California, is critical because US District Judge Yvonne Gonzalez Rogers will decide whether tens of millions of Incognito users can be grouped together to pursue statutory damages of $100 to $1,000 per violation — a potentially staggering amount.
Google argues in court filings that while it’s common knowledge Incognito doesn’t make browsing invisible, users have given consent for the company to track their data.
“Incognito mode offers users a private browsing experience, and we’ve been clear about how it works and what it does, whereas the plaintiffs in this case have purposely mischaracterized our statements,” Castaneda said in the email.
What Bloomberg Intelligence Says
“We don’t think Alphabet will prevent a suit about alleged use of data from private-browsing sessions from being ruled a class action.”
— Matthew Schettenhelm, Litigation Analyst
The Incognito litigation is among several cases by consumers and states accusing Google of privacy violations. Just last week, Google agreed to pay $85 million to resolve claims by Arizona that it surreptitiously collects data on users’ whereabouts for targeted advertising.
So far only Google knows what it’s doing with data it may be collecting from Incognito Mode searches and “some of that will come out at trial,” Serge Egelman, research director of the Usable Security and Privacy Group at University of California at Berkeley’s International Computer Science Institute.
Data on where Incognito Mode users go online, what they do on certain sites and what ads they view could be used for conversion tracking, which lets advertisers learn how users interact with ads, according to Egelman.
It’s also “probably valuable from a profiling standpoint, in terms of selling targeted advertisements,” Egelman said.
The consumers who are suing argue Google’s transparency about the data mining is woefully inadequate. In a court filing they highlighted an internal proposal by a Google Chrome product lead to change the customer-facing language on the Incognito launch screen so that it says “You are NOT protected from Google,” instead of “You are protected from other people who use this device.”
It was rejected by Google executives, according to a court filing that cites a sealed email.
The exhibits in court also include a 2020 presentation that drew from a survey on users’ experience with Incognito Mode. “Unless it is clearly disclosed that their activity may be trackable, receiving targeted ads or suggestions based on private mode may erode trust,” a slide warned.
Google has failed so far to dismiss claims in the case. But it has fended off two attempts by plaintiffs to force Pichai to submit to questioning under oath. The judge overseeing the suit has yet to set a trial date.
The case is Brown v. Google LLC, 20-3664, U.S. District Court, Northern District of California (Oakland).
