New Privacy Threat from Google? Full Analysis of the Tracking Infrastructure

YouTube Video

Summary

This YouTube transcript explains the recent news about Google “bringing back” digital fingerprinting, arguing that fingerprinting never actually went away and the panic is largely misplaced. The speaker clarifies that fingerprinting is just one piece of the larger online tracking puzzle, with deterministic tracking via Google and Facebook IDs being the most significant threat.

Here’s a breakdown of the key points:

• Fingerprinting Never Left: The speaker emphasizes that browser fingerprinting, a technique to identify users based on unique browser and device configurations (like IP address, time zone, fonts, extensions), has always been present and used for tracking. Google’s attempts to remove it were not primarily for user privacy.
• Google’s Motives: Google’s efforts to phase out third-party fingerprinting were aimed at consolidating tracking power within Google itself. They initially proposed solutions like FLoC and Topics to control how advertisers could target users, but these were rejected by both advertisers and privacy advocates.
• Deterministic vs. Non-Deterministic Tracking:
  • Deterministic Tracking: This is the most accurate and concerning type of tracking, where platforms like Google and Facebook directly identify you because you are logged into their services. They use your Google/Facebook ID, which is validated by login and 2FA, and can track you across the internet via embedded code like Google Analytics and Facebook Pixel on countless websites. This is the “real tracker” and the primary privacy concern.
  • Non-Deterministic Tracking: This includes techniques like cross-site cookies and fingerprinting used by third-party advertisers. These methods are less accurate and can be mitigated. They rely on guessing your identity based on patterns and browser signatures.
• The Role of Cookies: Cross-site cookies are used by advertisers to track users across different websites, but they can be cleared. Fingerprinting bypasses cookies by using browser characteristics to identify users.
• Mitigation Techniques (Browser Isolation, VPNs, etc.): The speaker argues that completely evading tracking is very difficult for normal users and might not be necessary. He suggests focusing on mitigating the impact of tracking, particularly from third parties. His recommended mitigation techniques include:
  • Browser Isolation: Using separate browsers for different purposes. Dedicate one browser (like Chrome) solely for Google services and logged-in activities, and use another browser (like Brave) for general browsing without logging into Google.
  • VPN: Using a VPN masks your IP address, making fingerprinting less accurate by grouping you with many other users sharing the same IP.
  • Stock Browser Configuration: Keeping your browser configuration as standard as possible (no unusual extensions, settings, or disabled JavaScript) to blend in and avoid creating a unique fingerprint.
  • Multiple Browsers: Utilizing different browsers (Chrome, Brave, Firefox, etc.) to further partition browsing activities and create separate fingerprints.
• Mobile Tracking: Mobile devices have advertising IDs (on Android and iOS) that are persistent trackers. However, Google phones, according to the speaker, do not have a Google ID in the same way and lack advertising IDs, making them harder to track deterministically (except when logged into Google in a browser on the phone).
• Focus on Deterministic Tracking: The speaker concludes that while fingerprinting and cookies are irritating, the real privacy threat is deterministic tracking by Google and Facebook due to their pervasive reach across the web. Mitigation efforts should primarily focus on limiting the impact of this deterministic tracking.
• Brax 3 Phone and Privacy Products: The video promotes the speaker’s privacy-focused products, including the Brax 3 phone designed to prevent deterministic tracking, and other services like Bra Virtual Fone, Bmail, and BVPN, available on their privacy-focused social media site, brme.

Accuracy

The information provided in the transcript is largely accurate in its overview of online tracking techniques and the roles of cookies, fingerprinting, and deterministic tracking. However, some points require nuanced understanding and could be slightly oversimplified for a general audience.

Here’s a breakdown of accuracy points:

• Fingerprinting is a real and persistent tracking technique: Accurate. Browser fingerprinting is a well-established method for tracking users online. The details about the elements contributing to a fingerprint (IP address, time zone, fonts, extensions etc.) are also accurate.
• Cookies are still used for tracking, but can be managed: Accurate. Cookies are a foundational technology for web tracking, particularly cross-site cookies. The transcript correctly points out that they can be cleared, reducing their effectiveness.
• Google ID and Facebook ID are powerful deterministic trackers: Accurate. This is a crucial and valid point. Being logged into Google or Facebook provides these companies with a persistent and highly accurate way to track user activity across the web due to their embedded services.
• Google Analytics and AdSense are widespread: Accurate. These services are indeed embedded on a vast number of websites, giving Google significant visibility into user browsing behavior.
• Google’s FLoC and Topics were attempts to control tracking but failed: Accurate. FLoC and Topics were Google’s initiatives aimed at replacing third-party cookies with a more privacy-preserving (from Google’s perspective) advertising system. Their failure and subsequent abandonment are factual.
• Deterministic tracking is more accurate and concerning than non-deterministic tracking: Accurate. Deterministic tracking, when identity is known for sure, is inherently more precise and persistent than probabilistic methods like fingerprinting.
• Browser isolation and VPNs are mitigation techniques: Accurate, but with caveats. These techniques offer some level of privacy enhancement, but they are not foolproof.
  • Browser isolation: Effectively limits cross-site tracking between different browsing contexts.
  • VPN: Hides your IP address, which is part of the fingerprint, but VPNs themselves can be tracked, and they don’t prevent all forms of fingerprinting.
• Mobile advertising IDs are used for tracking: Accurate. Advertising IDs on mobile platforms are designed for ad tracking and are more persistent than browser cookies in many cases.
• Claim about “Google phones have no Google ID and no advertising ID” is Potentially Misleading/Oversimplified. While the speaker might be referring to specific “privacy-focused” Google phones or a particular configuration, standard Android phones do have Google accounts associated with them and do have advertising IDs. Perhaps the speaker is referring to a de-Googled Android setup, which is less common for “Normy” phones as mentioned in the transcript. This point needs clarification as it could be misinterpreted as standard Android phones being inherently privacy-preserving against Google tracking, which is generally not the case.
• “Stock browser configuration” helps reduce fingerprint uniqueness: Accurate. Blending in with the majority by using default settings makes your fingerprint less unique and potentially harder to distinguish from others.
• “Privacy tabs don’t affect fingerprinting” is Accurate in the context of fingerprinting itself. Privacy tabs primarily focus on cookie and browsing history isolation within a single browser profile, not on changing the underlying browser fingerprint.

Overall Accuracy Assessment: The transcript provides a generally accurate and informative overview of online tracking. The core message about the dominance of deterministic tracking by Google and Facebook and the relative importance of mitigating this threat is valid. The explanations are simplified for a general audience, which can lead to slight oversimplifications, particularly regarding the Google phone claim. However, the fundamental concepts and mitigation strategies discussed are sound and relevant to online privacy concerns.

Resources

Here are the top 5 resources to learn more about the subjects presented in the transcript, focusing on online tracking, privacy, and digital security:

1. Electronic Frontier Foundation (EFF) - eff.org: The EFF is a leading non-profit organization defending civil liberties in the digital world. They offer extensive resources on online privacy, surveillance, tracking, and digital rights. Their website features articles, guides, tools, and campaigns related to these topics. Relevance: Covers all aspects of online tracking and privacy discussed in the transcript, from technical explanations to policy advocacy.

2. Privacy International - privacyinternational.org: Privacy International is a global organization that investigates surveillance by governments and corporations and advocates for stronger privacy protections. They provide in-depth reports, analysis, and resources on various tracking technologies, including browser fingerprinting, cookies, and data collection practices. Relevance: Offers a global perspective on privacy threats, including the corporate tracking discussed in the transcript, with a focus on research and advocacy.

3. Mozilla Foundation - foundation.mozilla.org & privacy.mozilla.org: The Mozilla Foundation, makers of the Firefox browser, is committed to internet health and privacy. Their websites offer resources, reports, and tools related to online privacy and security. They also have a dedicated privacy section explaining features in Firefox and broader privacy concepts. Relevance: Provides browser-specific privacy information and a broader understanding of online privacy from a user-centric perspective, aligning with browser-based mitigation techniques mentioned in the transcript.

4. DuckDuckGo Privacy Blog - spreadprivacy.com/blog: DuckDuckGo, the privacy-focused search engine, maintains a blog dedicated to online privacy topics. They regularly publish articles explaining various tracking techniques, privacy threats, and tips for protecting your privacy online. Relevance: Offers accessible explanations of tracking technologies and practical advice for improving online privacy, directly relevant to the concerns raised in the transcript.

5. NIST (National Institute of Standards and Technology) Cybersecurity and Privacy Program - nist.gov/cybersecurity-privacy: NIST is a US government agency that develops standards and guidelines for cybersecurity and privacy. Their website provides more technical resources, reports, and frameworks related to data privacy, security controls, and risk management. While more technical, it offers authoritative information on the underlying principles of data protection and privacy. Relevance: Provides a deeper, more technical understanding of privacy and security concepts relevant to online tracking, offering a different perspective compared to advocacy-focused resources.

These resources offer a mix of perspectives, from advocacy and user-focused guides to more technical and research-oriented information, enabling a comprehensive understanding of online tracking and privacy in the digital age.