Revised on January 11 to include additional details regarding Google’s latest mobile privacy issues in U.S. courts, as well as comparisons to its contentious digital fingerprinting practices that are resurfacing.

An ironic spat this week in the world of big tech. Google attacked Microsoft for “its long history of tricks to confuse users and limit choice,” less than than three weeks after it was accused of “reducing people’s choice and control over how their information is collected,” in response to its new plan to digitally fingerprint users’ devices, not just Android and Chrome — the usual targets of such criticism. That tracking is now just six weeks away.

Two seemingly disconnected narratives occurring just two weeks apart—yet they are intertwined in a significant way. The shared thread is the portrayal of users as mere pawns, at the mercy of the vast and intricate ecosystems they depend on daily.

Google slammed Microsoft after the Windows maker was caught “spoofing” the Google homepage when users searched for Google on Bing.com. Windows Latest was first to spot the spoof and described it as a “a genius move to keep you from Google search.” Bing has featured before in the Microsoft versus Google stakes playing out across Windows PCs, but it has mostly been Chrome versus Edge. Search is the prize, as should have been pretty clear when Apple went to court to help Google defend its default search spot on a billion iPhones. It’s not too many months ago that the iMaker released a video inspired by Hitchcock’s The Birds that essentially warned those iPhone users to steer clear of Chrome.

This was “a clear attempt from Microsoft to make Bing look like Google for this specific search query,” reported The Verge. “The Google result includes a search bar, an image that looks a lot like a Google Doodle, and even some small text under the search bar just like Google does. Microsoft even automatically scrolls down the page slightly to mask its own Bing search bar that appears at the top of search results.”

Chrome and Google Search are distinct entities, though both pose privacy concerns. This is why iPhone users might find it preferable to utilize Google Search through Safari rather than Chrome, especially if they are not signed into a Google account while doing so. However, Chrome is not at the forefront of the recent Google tracking alert that made news just prior to the holiday season. Despite Chrome's prominence in discussions about Google's tracking practices over the past few years—often involving cookies, incognito mode, and the privacy sandbox—this latest warning does not center around it.

The latest issue started when Google pushed out an update to its advertising ecosystem. The changes, it said, have been prompted by “the broader range of surfaces on which ads are served (such as connected TVs and gaming consoles),” and mean they will be “less prescriptive with partners in how they target and measure ads.”

Fingerprinting has evolved beyond being solely a concern for browsers now.

“This is digital fingerprinting across connected devices,” the UK’s information regulator was quick to point out. “Fingerprinting involves the collection of pieces of information about a device’s software or hardware, which, when combined, can uniquely identify a particular device and user... The ICO’s view is that fingerprinting is not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected. The change to Google’s policy means that fingerprinting could now replace the functions of third-party cookies.”

And given the nature of these other devices and that users won’t realize what’s taking place, there are serious implications. Identity Week warns that “organizations using Google’s advertising tech can implement fingerprinting without violating Google’s policies and complying with the requirements of data protection law... Fingerprinting is so hindering to privacy expectations because it relies on signals that are not easy to wipe. Even if data is ‘permanently’ deleted, fingerprinting biometrics could detect and recognize your identity.”

There are intriguing similarities between the resurgence of digital fingerprinting—known for being notoriously hard for users to notice—and a groundbreaking leak of user location information that reveals numerous applications gathering data from users' devices. The Gravy Analytics breach underscores the immense scope of the location data market, representing yet another behind-the-scenes user tracking system that is challenging to identify and that most users would probably opt out of if given the choice.

As 404Media neatly puts it, “the [Gravy Analytics] news is a crystalizing moment for the location data industry. For years, companies have harvested location information from smartphones, either through ordinary apps or the advertising ecosystem, and then built products based on that data or sold it to others. In many cases, those customers include the U.S. government... But collecting that data presents an attractive target to hackers.”

What I suspect will prompt users to sit up and take notice more than the scale of the leak is the number of popular apps contributing the data in the first place. “Candy Crush, Tinder [and] MyFitnessPal,” Wired reports, are amongst “the thousands of apps hijacked to spy on your location... Some of the world’s most popular apps are likely being co-opted by rogue members of the advertising industry to harvest sensitive location data on a massive scale.”

There are various lists of these apps now doing the rounds — suffice to say it’s extensive. Per Wired, it includes “dating sites Tinder and Grindr; massive games such as Candy Crush, Temple Run, Subway Surfers, and Harry Potter: Puzzles & Spells; transit app Moovit; My Period Calendar & Tracker, a period-tracking app with more than 10 million downloads; popular fitness app MyFitnessPal; social network Tumblr; Yahoo’s email client; Microsoft’s 365 office app; and flight tracker Flightradar24.... religious-focused apps such as Muslim prayer and Christian Bible apps, various pregnancy trackers, and many VPN apps, which some users may download, ironically, in an attempt to protect their privacy.”

Forbes: Gmail Upgrade from Google—Protect Your Account!

Users don’t like being tracked behind the scenes. That’s why the Gravy leak has made headlines and it’s why digital fingerprinting is doing the same. And there’s another new twist as reported by Reuters: “Google has failed to persuade a federal judge to dismiss a privacy class action claiming it collected personal data from people's cellphones after they switched off a button to stop the tracking.” This may lead to a trial in the summer. It follows Google’s destruction of billions of data records last year, in the wake of a similar lawsuit relating to data collection while using Chrome’s incognito mode.

As ArsTechnica explains, Google “purports to treat user data as pseudonymous by creating a randomly generated identifier that ‘permits Google to recognize the particular device and its later ad-related behavior... Google insists that it has created technical barriers to ensure, for (s)WAA-off users, that pseudonymous data is delinked to a user's identity by first performing a 'consent check' to determine a user's (s)WAA settings.’ Whether this counts as personal information under the law is a question for a jury, the judge wrote.”

Per CNBC, “in a 20-page decision on Tuesday, [Chief Judge Richard Seeborg of the federal court in San Francisco] said reasonable users could view Google’s conduct as ‘highly offensive,’ because the company collected data despite fielding concerns from several employees and knowing its disclosures were ambiguous. He cited internal communications suggesting that Google, a unit of Alphabet, was intentionally vague in distinguishing between data collected inside and outside Google accounts because users might find the truth ‘alarming’.”

And so it comes down to reasonable expectations and what’s reasonably understood or not, on which there are some fairly clear parallels to digital fingerprinting. Google says that “advances in privacy-enhancing technologies (PETs) such as on-device processing, trusted execution environments, and secure multi-party computation, are unlocking new ways for brands to manage and activate their data safely and securely. PETs also give people the privacy protections they expect... We see an opportunity to set a high privacy bar on the use of data like IP. We can do this by applying privacy-preserving protections that help businesses reach their customers across these new platforms without the need to re-identify them.”

But as EFF says of this type of tracking, “as an individual uses their device, a specific third-party tracker may be loaded on multiple apps installed or sites visited. This allows that company to track an individual across their usage of multiple sites they visit or apps they have installed. These trackers get unprecedented insight into the daily activities of the user, including information that is often specific enough to know what a user is doing at any moment and even where they are using their device... Fingerprinting can use all sorts of seemingly mundane details about your device or browser, such as screen resolution, your time zone, operating system version, remaining battery life, and more. The reason why fingerprinting exists is to circumvent the normal controls users have that enable them to control their own browsers. In order to take control of our browsers and devices back, we have to use special tools that resist fingerprinting.”

Forbes Reports Microsoft Alert: Foreign Hackers Breach Accounts—AI-Driven Attacks Evade Security Measures

And so, given such fingerprinting is notoriously difficult to detect, what do users really understand? And what can they be reasonably expected to understand? As the UK information regulator noted in its response, “we think this change is irresponsible. Google itself has previously said that fingerprinting does not meet users’ expectations for privacy, as users cannot easily consent to it as they would cookies. This in turn means they cannot control how their information is collected. To quote Google’s own position on fingerprinting from 2019: ‘We think this subverts user choice and is wrong’.”

Google emphasizes that “despite evolving technologies, our commitment to privacy principles stays constant. We prioritize providing users with options regarding personalized advertisements. Additionally, we mandate that advertisers and publishers maintain full transparency with users regarding the data they gather and its usage. Our policies must keep pace with technological progress, placing privacy at the forefront. Through this update, we aim to assist businesses, both large and small, in seizing the opportunities presented by the changing digital environment, all while aligning with user privacy expectations.”

Regardless, it's quite a notable coincidence that within just a few weeks, users are faced with two warnings, a legal decision, and a concerning data breach. The consequences of these events undoubtedly impact the vast number of users across platforms like Chrome, Edge, Android, and Windows. I reached out to both Google and Microsoft for their insights on these developments, but I haven't received any responses so far.

Digital fingerprinting will start on February 16; until then, please remember to keep all of this in consideration.