What’s the Story Behind Google’s $5 Billion Dollar Settlement Over Incognito Mode?

David Ray Chief Privacy Officer

David is an attorney and former software engineer, with over 15 years experience in the legal technology space. Prior to joining BigID, he spent six years as a director in PwC's Data Risk and Privacy practice, where he led privacy technology strategy for the firm. He is a Fellow of Information Privacy with the International Association of Privacy Professionals, and holds a BA in Political Science from the University of Rochester, a JD from Syracuse University, and an LL.M from the University of Washington in Intellectual Property.

11.01.2024 2 minute read

Data Privacy Data Protection

There have been a lot of headlines this week about Google’s settlement with the FTC this week over its Incognito mode— so what happened?

See BigID in Action

The allegations are that Google has advertised its “Incognito” mode to have much higher privacy protections than it actually provides. In a nutshell, Incognito mode spins up a browser tab in a temporary “sandbox”. Once the user closes the Incognito mode session, the following locally stored information generated during that session is deleted.

Local browsing history
New cookies and site data
Saved credentials

The catch?

File downloads and bookmarks from the Incognito session will remain on your computer after you close the Incognito session. The end result is similar to clearing your browser history. While Incognito mode helps keep your browsing private from other users on your device, it doesn’t hide your activity from your internet service provider, your employer (if you’re using a work computer), or the websites you visit. Websites can still collect data about your visit, and your IP address remains visible.

The plaintiffs alleged that Google collected data through Google Analytics, Google Ad Manager, and other applications and website plugins, including smartphone apps— regardless of whether users clicked on Google-supported ads. The allegations also stated that “approved third parties”, including those registered as data brokers in California as required under the CCPA, were allowed to place trackers, such as digital pixels, to further collect information on users.

They argued that this contradicted Google’s representations of privacy in Incognito mode and constituted a violation of federal wiretap laws.

A formal settlement is expected for court approval by February 24, 2024.