Explainer: Google settles class-action lawsuit over Incognito mode

Privacy news
10 mins
Google logo crushed under gavel.

Browsing in “Incognito mode” while using Google’s Chrome browser may give the illusion of privacy, but the fact is that it does not prevent others, including Google, from tracking you. 

However, a 2020 class-action lawsuit claimed Google misled users into thinking they had more privacy than Incognito mode actually afforded, leading to a settlement where Google agreed to destroy or de-identify billions of web browsing records collected in Incognito mode. 

What is Chrome’s Incognito mode? 

When you browse the web with Chrome, users may choose to use an “Incognito” window, also known as “privacy browsing mode.” In Incognito mode, Chrome does not save browsing history, cookies and site data, information entered in forms, and permissions you give to websites. This means that your activity is not saved on your device, thereby preventing others with access to your device, such as family members, from seeing your searches and stopping cookies from identifying you.

Chrome Incognito mode.However, what you do in Incognito mode on Chrome can still be traced back to you, including by Google itself. For example, Incognito sessions are recorded in Google Analytics and provided to website administrators. 

Read more: What doesn’t Incognito mode protect against?

Why did Chrome users sue Google over Incognito mode?

In June 2020, a lawsuit titled Brown v. Google was launched by three Google users in California. They accused Google of falsely advertising the privacy capabilities of Incognito mode. Despite assurances that Incognito mode would keep their web activities private, Google allegedly continued to harvest data on their browsing habits. The plaintiffs argued they were led to believe that using Incognito mode would protect them from Google’s data collection practices. They expected a level of privacy that, according to the lawsuit, Google failed to deliver.

“Google’s practices infringe upon users’ privacy; intentionally deceive consumers; give Google and its employees power to learn intimate details about individuals’ lives, interests, and internet usage; and make Google ‘one-stop shopping’ for any government, private, or criminal actor who wants to undermine individuals’ privacy, security, or freedom,” the complaint said.

The case aimed to challenge Google’s data collection methods, seeking damages for privacy breaches and demanding greater transparency and accountability in Google’s practices.

What were the claims against Google in the Incognito mode lawsuit?

The lawsuit raised several serious concerns about the privacy assurances associated with Google’s Incognito mode. While we won’t go into great detail about each one, here are the main points:

  • Misleading privacy promises: At the heart of the lawsuit was the accusation that Google gave users a false sense of security about their privacy in Incognito mode. Users believed their web activities would be private and unseen by Google, an expectation that was not met. The plaintiffs contended that Google continued to track and collect user data through various tools like Google Analytics and Ad Manager, even when users were in Incognito mode seeking privacy.
  • Violation of wiretap laws: Google was accused of breaking federal and state wiretap laws by allegedly intercepting users’ electronic communications without consent, especially troubling for users who chose Incognito mode expecting confidentiality.
  • Invasion of privacy: By collecting data during Incognito sessions, Google was accused of intruding into users’ personal lives, learning details about their interests and behaviors without permission.
  • Intrusion upon seclusion: This claim refers to intentionally intruding into a private place, conversation, or matter. The plaintiffs claim that Google intentionally intruded on their solitude or seclusion by placing itself in the middle of conversations while they were using Incognito mode.
  • Breach of contract: According to plaintiffs, the Chrome Privacy Notice, Google’s Privacy Policy, the “Search & Browse Privately” page, and the Incognito “splash” screen promised that if plaintiffs visited websites in private browsing mode, Google would not collect their data. 

How did Google respond to the lawsuit?

The complaint was heavily contested by Google. The tech giant defended itself against the claims, insisting on the clarity and transparency of its data collection practices as disclosed in its privacy policy.  The company stated that Incognito mode is intended to prevent information from being stored on the user’s device, but it doesn’t shield online activities from the web at large. This means that while using Incognito mode, the websites one visits, along with any third-party analytics or advertising services they use, could still track the user’s activities.

Google argued that there’s a common misconception about what Incognito mode is designed to do. It provides privacy from other users of the same device by not saving browsing history, cookies, site data, or information entered in forms, but it does not guarantee anonymity online. This important distinction is often missed or misunderstood.

To drive home this point, Google stated, “Google also makes clear that ‘Incognito’ does not mean ‘invisible,’ and that the user’s activity during that session may be visible to websites they visit, and any third-party analytics or ads services the visited websites use.”

Google also quickly added wording to its Incognito mode start screen to add clarity. As of April 2024, the start screen includes the explicit wording that the mode “won’t change how data is collected by websites you visit and the services they use, including Google.”

What was the verdict?

In December 2023, Google reached a settlement in its lawsuit over Incognito mode, without going to trial. To resolve the accusations against them, Google agreed to delete or de-identify billions of web browsing records collected from users in this mode, as well as a few other terms.

Amid the settlement, Google asserts that the lawsuit lacked merit, but they’re content with the resolution—stating that data collected during Incognito mode was never used for user-specific content personalization.

The settlement aims to enhance transparency and protect user data more effectively. It’s important to note, however, that the settlement doesn’t include direct compensation to users. But, individuals do retain the right to pursue their own legal action against Google for damages within the state of California.

What changes has Google agreed to make in the settlement?

In the terms of the settlement, Google committed to several changes to enhance privacy and transparency for Incognito mode users:

  • Destroying or de-identifying data: Google will either destroy or anonymize billions of records of web browsing data collected from users in Incognito mode dating back to June 2016, up to December 2023. This step is intended to eliminate or reduce the privacy risks associated with the retention of this data.
  • Greater disclosure about data collection: The company will update its disclosures on the Incognito mode “splash” page to provide clearer information about how it collects and uses data from Incognito sessions. This aims to ensure that users have a better understanding of the privacy implications of using Incognito mode and what data may still be collected by Google and third parties.
  • Blocking third-party cookies by default: For the next five years, Google will enable users to block third-party cookies by default in Incognito mode. Google had long been planning on blocking third-party cookies, but the settlement made it happen more quickly. This change will prevent websites, as well as Google, from collecting data on users’ browsing activities via third-party cookies.
  • Transparency and user education: Part of the agreement includes initiatives to educate users about the privacy features and limitations of Incognito mode. Google has already begun rolling out changes to how it communicates the functionality of Incognito mode to users, aiming to clarify that while it offers a level of privacy from other users on the same device, it does not provide complete anonymity online.

What broader impact might this lawsuit have?

The settlement will lead to greater privacy and transparency for Chrome users. If passed, it represents a victory in providing users more authority over their personal data, alongside a more transparent insight into Google’s data collection practices while in Incognito mode. It also paves the way for individual legal actions, empowering users to actively participate in the safeguarding of their privacy rights. 

Here are some of the settlement’s broader implications:

Heightened transparency standards

The lawsuit establishes a new benchmark for transparency in the tech industry. It challenges other tech giants to be more upfront about their privacy features and data collection practices, fostering a culture of trust and openness between users and technology providers.

Reevaluation of private browsing

The revelations from the case encourage a critical reassessment of what private browsing modes actually offer versus what users expect. It signals the need for tech companies to enhance their privacy protections to genuinely align with user expectations of anonymity and data security.

Increased regulatory and legal focus

The high-profile nature of this lawsuit draws increased attention to the importance of data privacy, potentially catalyzing more stringent regulatory oversight and legal scrutiny on how companies collect, use, and protect user data.

User empowerment 

It highlights the powerful role that user-driven legal action and advocacy can play in influencing privacy practices among tech giants. It serves as a reminder that users are not powerless and can demand accountability and change from the platforms they use.

Innovation in privacy technologies

As laws and regulations evolve in favor of greater privacy protections, we may see accelerated development in technologies that enhance privacy. This could include more sophisticated data encryption methods, improved tools for anonymous browsing, and features that give users more control over their data.

Shift in business models

The constraints on data collection posed by the settlement could prompt a rethink of business models heavily reliant on data harvesting and targeted advertising. It may encourage the exploration of alternative revenue models that prioritize user privacy and data protection.

Global impact on privacy practices

Although the Google settlement is rooted in U.S. law, its implications are likely to reverberate globally. It sets a precedent for privacy standards that could influence how companies around the world approach user privacy and data protection, encouraging a shift towards more user-centric privacy practices.

Are there any remaining legal challenges for Google regarding privacy?

Even though Google has settled its notable class-action lawsuit concerning Incognito mode, the tech giant remains embroiled in various legal battles that highlight significant concerns over privacy, data practices, and competition. Here are a few of the key legal hurdles currently dogging Google:

Canadian class-action lawsuit on tracking and surveillance

Google is the subject of a class-action lawsuit in Canada, accused of invasive tracking and surveillance practices. The lawsuit claims Google has breached consumer protection and competition laws through deceptive privacy and data practices. Awaiting a decision in British Columbia, this case emphasizes the ongoing scrutiny over Google’s extensive data collection methods and the clarity of its privacy policies.

Antitrust lawsuit related to online advertising

Google faces a private antitrust lawsuit from the administrator of a sweepstakes website, alleging that Google has misused its dominant position in online advertising to suppress competition. While the lawsuit primarily addresses antitrust issues, it indirectly raises questions about privacy practices, considering the integral role of data collection in digital advertising.

Ongoing and future legal scrutiny

In addition to these specific cases, Google is under continual examination by global regulators, and legal authorities. This scrutiny is largely concentrated on the company’s handling of data, its market power, and the implications for consumer privacy and competitive fairness. The expectation is that Google, alongside other tech behemoths, will persist in facing legal and regulatory challenges as efforts intensify to tackle the intricate dilemmas of privacy, data security, and corporate dominance in the digital sphere.

How can users protect their privacy while browsing?

Given Google’s current scrutiny from its recent settlements and ongoing privacy cases, it’s clear there’s much work to be done to ensure user privacy. In light of this, it’s prudent for users to take matters into their own hands to protect their digital privacy. Here’s how:

  1. Select privacy-oriented browsers: Choosing browsers that prioritize your privacy, such as Mozilla Firefox, Brave, or Tor, is a step in the right direction. These browsers are designed with privacy features that help reduce tracking and increase encryption.
  2. Use privacy-focused search engines: Google is known for its data-collection practices. You do not need to use it at all, incognito or otherwise. Alternatives like DuckDuckGo don’t collect your data and allow you a high degree of anonymity.
  3. Adjust your browser privacy settings: Enhance your browser’s privacy by activating settings that block third-party cookies and disable tracking. While private browsing modes like Incognito prevent your device from keeping a record of your history, they don’t shield you from all forms of online tracking.
  4. Utilize a high-quality VPN: A VPN, especially a reputable one like ExpressVPN, encrypts your internet connection and hides your IP address, providing a significant boost to your privacy online, particularly on public Wi-Fi networks.
  5. Install privacy-enhancing browser extensions: Adding extensions such as Privacy Badger and uBlock Origin can further protect your privacy by securing your connections and blocking trackers and ads.

Did Google mislead users about Incognito mode? Let us know your thoughts in the comments!

Read more: How to delete everything Google knows about you

Phone protected by ExpressVPN.
Protect your online privacy and security

30-day money-back guarantee

A phone with a padlock.
Enjoy a safer online experience with powerful privacy protection
What is a VPN?
I like hashtags because they look like waffles, my puns intended, and watching videos of unusual animal friendships. Not necessarily in that order.