Google's protection guarantees don't influence numerous specialists
Google's Privacy Promises: From "Theater" in 2019 to Fingerprinting and $5 Billion Settlements in 2026
In May 2019, Google's top executives took the stage at the company's annual developer conference with a clear message: we care about your privacy. CEO Sundar Pichai spoke of "always evolving client desires," and the company announced a slate of new privacy tools—Incognito mode for Google Maps, location permission controls in Android Q, and a plan to overhaul cookie tracking in Chrome. It was, on the surface, a significant moment. Google, a company built on collecting data to sell targeted advertisements, was promising to give users more control.[reference:0]
But not everyone was convinced. "Unremarkable," declared Princeton computer scientist Jonathan Mayer. "This isn't privacy leadership—this is privacy theater." Jeremy Tillman, president of the ad‑blocking company Ghostery, called the changes "peripheral enhancements" designed more for "a superior informing push" than for "making discount upgrades to client security."[reference:1][reference:2]
Seven years later, that skepticism appears more than justified. While Google has made some genuine privacy improvements—particularly in on‑device AI processing—the company has simultaneously introduced new tracking technologies, killed off its own ambitious privacy initiative, and paid billions of dollars to settle lawsuits alleging it violated users' privacy. This post, originally published in 2019, has been completely updated with the full story of what happened next.
📋 The 2019 Announcements: What Google Promised
To understand where we are in 2026, it's helpful to recall exactly what Google announced at that 2019 I/O developer conference. The company unveiled a package of privacy changes across its most popular products:
- Incognito Mode for Maps and Search: Google said it would expand the "in secret mode" feature to Google Maps and the Search app. When activated, the app would not record user searches or movements.[reference:3]
- Android Q Location Controls: The new version of Android would warn users when apps might abuse access to phone location data. Users would be able to restrict apps' access to location more broadly—for example, by only allowing apps currently in use to gather the data.[reference:4]
- Cookie Controls in Chrome: Google announced plans to give Chrome users the ability to clear "following treats"—tracking cookies used by third‑party websites and advertisers—without affecting cookies that keep users signed into sites or personalize settings.[reference:5]
- On‑Device AI Processing: The company highlighted that some of its AI capabilities, including facial recognition and voice searches, were beginning to be trained on devices rather than by sending data to company servers.[reference:6]
The backdrop to these announcements was a year of intense scrutiny. In 2018, an Associated Press investigation found that Google continued to store phone location data even when users turned off a "location history" setting in Android.[reference:7] Facebook had just concluded its own privacy‑focused developer conference, emphasizing private channels over public sharing.[reference:8] The entire tech industry was on the defensive.
💡 Analyst Perspective: The Fundamental Tension
Google's core business model—selling digital advertisements targeted based on the interests people reveal through their search queries and data collected by Google apps and services—creates an inherent tension with user privacy. As the original article noted, the company makes billions of dollars each year from this advertising business.[reference:9] Any privacy change that meaningfully reduces Google's ability to collect data also threatens its revenue. This fundamental conflict has shaped every privacy decision the company has made since 2019.
🖐️ 2025‑2026: The Fingerprinting Controversy
If 2019 was the year Google promised to improve privacy, February 2025 was the year it introduced a major new tracking technology that privacy advocates say does the opposite. Google announced that it would begin using digital fingerprinting to track users across multiple devices, including smart TVs and gaming consoles.[reference:10]
Digital fingerprinting is a technique that identifies a specific device by collecting information about its configuration—things like screen resolution, installed fonts, browser version, and operating system. Unlike cookies, which can be cleared by the user, fingerprinting is nearly impossible to block. Google itself had previously criticized the practice, calling it a threat to user privacy. Now, it was embracing it.[reference:11]
The reaction from privacy regulators was swift and sharp. Stephen Almond, the executive director of regulatory risk at the UK Information Commissioner's Office (ICO), called the move "irresponsible." Privacy campaigners and experts expressed alarm that Google was expanding tracking beyond Chrome to encompass "all devices," with no option for users to opt out. As one report stated, "users do not have the option to stop Google from tracking because Google itself and the advertising industry have openly allowed it."[reference:12]
Even as Google introduced fingerprinting, it continued to make incremental privacy improvements elsewhere. In Chrome's Incognito mode, the company now blocks third‑party cookies by default and plans to launch IP Protection in late 2025 to further obscure users' identities.[reference:13] But these changes feel modest compared to the scale of the new tracking capabilities Google is deploying across its ecosystem.
🧱 The Death of the Privacy Sandbox
Perhaps the most telling story of Google's privacy journey is the fate of the Privacy Sandbox. Announced in 2019 as a grand vision to replace third‑party cookies with a more privacy‑preserving advertising system, the initiative was supposed to be Google's answer to growing regulatory pressure and public concern about online tracking. After six years of development, countless delays, and intense regulatory scrutiny, Google officially ended the Privacy Sandbox initiative in October 2025, citing "low adoption rates and continued regulatory pressure."[reference:14]
The Privacy Sandbox's demise is significant for several reasons. First, it was Google's flagship privacy project—the centerpiece of its argument that it could balance advertising revenue with user privacy. Its failure suggests that this balance is harder to achieve than Google initially claimed. Second, it leaves the advertising industry without a clear replacement for third‑party cookies, which Google has now decided to keep (in a modified form) rather than phase out entirely.
As one analysis noted, "With cookies still on the menu, can marketers afford to wait on privacy reform?"[reference:15] The answer, it seems, is that Google is no longer waiting—it's moving forward with other tracking technologies like fingerprinting while leaving the cookie question unresolved.
💰 Legal Settlements: Billions in Penalties
While Google has been making privacy promises, it has also been paying billions of dollars to settle lawsuits alleging that it violated those very promises. The scale of these settlements tells a story that the company's marketing cannot obscure.
The $5 Billion Incognito Mode Settlement
In late 2025, Google agreed to pay $5 billion to settle a class‑action lawsuit alleging that it tracked users even when they were browsing in Chrome's Incognito mode—the very "in secret mode" feature Google had touted at its 2019 developer conference. The lawsuit revealed that despite Google's assurances that Incognito mode would not record user searches or movements, the company continued to collect data through Google Analytics and other tools.[reference:16]
As part of the settlement, Google updated Chrome's Incognito disclaimer to explicitly acknowledge that "websites collect data in ways that won't be changed" by using the private browsing mode—a stark admission that the feature does not provide the level of privacy many users assumed it did.[reference:17]
The $135 Million Android Data Collection Settlement
In January 2026, Google agreed to pay $135 million to settle a class‑action lawsuit alleging that its Android operating system collected users' cellular data without permission. Eligible Android users may receive up to $100 each as part of the settlement, with a final approval hearing scheduled for June 23, 2026.[reference:18][reference:19]
The $68 Million Google Home Hub Settlement
In March 2026, Google agreed to pay $68 million to settle a lawsuit claiming that Google Home Hub devices recorded household conversations while on standby mode—without users' knowledge or consent. The settlement was filed in federal court in San Jose, California, with final approval granted on March 19, 2026.[reference:20]
The $30 Million Children's Privacy Settlement
In August 2025, Google and YouTube agreed to pay $30 million to settle a class‑action lawsuit alleging that YouTube collected personal information from children under age 13 for targeted advertising without parental consent, violating the Children's Online Privacy Protection Act (COPPA).[reference:21]
💡 Analyst Perspective: The Cost of Doing Business?
When a company pays over $5 billion in privacy‑related settlements in a single year, it raises a fundamental question: are these penalties a deterrent, or simply a cost of doing business? For Google, which generated over $300 billion in revenue in 2024 (primarily from advertising), these settlements represent a small fraction of its income. The question is whether the reputational damage and regulatory scrutiny will eventually force more substantive change.
📱 On‑Device Processing: Genuine Progress
Not all of Google's privacy efforts have been "theater." The company has made genuine progress in one area it highlighted in 2019: on‑device AI processing. The Nest Hub Max, Google's flagship smart display, now performs a significant portion of its processing locally on the device rather than in the cloud. This includes facial recognition (Face Match) and other AI‑driven features.[reference:22]
According to a 2025 review, 87% of Nest Hub Max 3 functions now work without internet connectivity—a "game‑changer for privacy‑conscious users and those with unreliable internet."[reference:23] This means that sensitive data, like video feeds and voice commands, never leaves the device, reducing the risk of unauthorized access or data breaches.
Google has also expanded tools that give users more control over their data. In February 2026, as part of Safer Internet Day, the company updated its "Results about you" tool to allow users to remove search results containing sensitive information like driver's license numbers, passport numbers, or Social Security numbers. Previously, the tool only covered phone numbers, email addresses, and home addresses.[reference:24][reference:25]
These are meaningful improvements. But they exist in tension with Google's broader tracking infrastructure, which continues to collect vast amounts of data about users' online and offline behavior.
🏠 Smart Home Surveillance: The "Pervasive Surveillance Network"
A March 2026 study from researchers examining the smart home ecosystem reached a stark conclusion: Amazon, Google, and Ring are converting smart‑home devices into a "pervasive surveillance network." The study found that voice assistants and cameras collect "detailed personal data across households," with Google's Nest ecosystem treating thermostats, cameras, and smart speakers as "interchangeable sensors" feeding a central data‑collection infrastructure.[reference:26]
This finding is particularly troubling because smart home devices are, by their nature, placed in the most intimate spaces of people's lives—their living rooms, kitchens, and bedrooms. A thermostat that learns when you're home, a camera that recognizes family members, a speaker that listens for commands: all of these devices generate data that can reveal a great deal about a person's daily routines, relationships, and habits.
As one analysis noted, "Smart home devices collect unprecedented amounts of data from inside your home—voice recordings, video footage, daily routines, and environmental data."[reference:27] The terms of service for these platforms often give companies broad rights to use this data for purposes that users may not fully understand.
📊 Google Privacy: 2019 Promises vs. 2026 Reality
| Area | 2019 Promise | 2026 Reality |
|---|---|---|
| Incognito Mode | Will not record user searches or movements | $5 billion settlement for tracking users in Incognito mode; disclaimer updated to admit tracking continues |
| Location Controls | Android Q will warn users about location abuse; restrict background access | Controls implemented, but AP investigation revealed Google continued storing location data even after users disabled history |
| Cookie Tracking | Chrome will let users clear tracking cookies without affecting login cookies | Privacy Sandbox killed in 2025; Google now using digital fingerprinting across all devices |
| On‑Device AI | Facial recognition and voice searches processed on device | 87% of Nest Hub Max functions work offline; genuine progress in this area |
| Children's Privacy | Not specifically addressed in 2019 announcements | $30 million COPPA settlement for collecting children's data without parental consent |
| Smart Home Privacy | Not specifically addressed in 2019 announcements | $68 million settlement for recording household conversations; devices described as "pervasive surveillance network" |
🎙️ What Experts Say in 2026
The skepticism that critics expressed in 2019 has not diminished. If anything, it has deepened. The UK Information Commissioner's Office calling Google's fingerprinting move "irresponsible" is just one example of the ongoing regulatory and expert concern about the company's privacy practices.[reference:28]
Privacy campaigners continue to point out the fundamental conflict: Google's business model depends on collecting user data for targeted advertising, and no amount of "privacy theater" can change that. As one analysis of Google's new tracking policy noted, "users do not have the option to stop Google from tracking because Google itself and the advertising industry have openly allowed it."[reference:29]
Even the company's own actions acknowledge this tension. The death of the Privacy Sandbox—Google's most ambitious attempt to reconcile privacy with advertising—suggests that the technical and business challenges of building a truly privacy‑preserving advertising system may be insurmountable under the current model.
💡 Analyst Perspective: The Path Forward
What would genuine privacy leadership look like? It would require a fundamental rethinking of the advertising‑driven business model that has made Google one of the most valuable companies in the world. It would mean giving users real control over their data—including the ability to opt out of all tracking, not just certain types. And it would mean accepting that some data collection practices are simply incompatible with a genuine commitment to privacy. Until Google is willing to make those changes, the tension between its privacy promises and its business practices will remain unresolved.
📋 The Bottom Line: Key Takeaways for 2026
🎭 The "Privacy Theater" Critique Has Aged Well: Seven years after Google's 2019 privacy announcements, the skepticism expressed by experts like Jonathan Mayer and Jeremy Tillman appears justified. While some genuine improvements have been made, the company's core data‑collection practices remain largely unchanged.
🖐️ Fingerprinting Is the New Tracking Frontier: Google's 2025 decision to embrace digital fingerprinting—a technology it once criticized—represents a major expansion of its tracking capabilities across all devices, including smart TVs and gaming consoles.
🧱 The Privacy Sandbox Is Dead: Google's flagship privacy initiative was officially terminated in October 2025 after six years of development, leaving the advertising industry without a clear replacement for third‑party cookies.
💰 Billions in Settlements: Google has paid over $5 billion in privacy‑related settlements in the past year alone, including $5 billion for tracking users in Incognito mode, $135 million for unauthorized Android data collection, $68 million for smart home recordings, and $30 million for children's privacy violations.
📱 On‑Device Processing Is a Bright Spot: Google has made genuine progress in processing AI features locally on devices, with 87% of Nest Hub Max functions now working offline. This reduces the amount of sensitive data sent to the cloud.
🏠 Smart Homes Are Surveillance Networks: A 2026 study found that Google's Nest ecosystem, along with Amazon and Ring, has converted smart‑home devices into a "pervasive surveillance network" that collects detailed personal data across households.
⚖️ The Fundamental Tension Remains: Google's advertising‑driven business model creates an inherent conflict with user privacy. Until the company is willing to fundamentally rethink this model, its privacy promises will continue to be met with skepticism.
🔔 Enjoy evidence‑based tech policy analysis? Subscribe for free weekly updates — no spam, just insight.