Chrome tags you with a permanent ID on install. If you sign in — which it pushes hard — every site you visit is linked to your real name and fed into Google's $265B advertising machine. Google spent 5 years promising to kill tracking cookies. The entire industry rejected their alternatives. In 2025 they gave up. The cookies are still there. Five years of your browsing data that could have been protected wasn't.
What they claim: Chrome's Safe Browsing protects users from dangerous sites using a locally stored list, with an optional Enhanced mode for stronger protection.
What we found: Standard Safe Browsing checks URLs against a locally cached list — but Google pushes users toward Enhanced Safe Browsing, which sends every URL in real time to Google's servers. Enhanced mode is presented as the recommended option during Chrome setup. Once enabled, Google receives a complete log of browsing activity, downloads, and extension data. Google's own documentation confirms Enhanced mode "sends URLs to Safe Browsing for checking" and "temporarily links this data to your Google Account." The upgrade from local checking to real-time URL transmission is framed as a security improvement, not a surveillance expansion.
What they claim: Chrome requests only the permissions needed for a web browser
What we found: Chrome Android requests 27 permissions including CAMERA, RECORD_AUDIO, ACCESS_FINE_LOCATION, READ_CONTACTS, GET_ACCOUNTS, NFC, and BLUETOOTH. Exodus reports zero trackers — but Chrome IS the tracker. All telemetry is first-party Google code, invisible to third-party analysis tools.
What they claim: Chrome sync lets you 'access your bookmarks, passwords, and more on all your devices'
What we found: Signing into Chrome sync also enables browsing history sync, autofill data sync, extension sync, and open tab sync. The password manager is the hook — once you sign in for passwords, Google gets everything else. Most users don't realise sync means Google has a complete copy of their browsing life.
What they claim: Chrome is marketed as a 'fast, secure browser' that puts you 'in control'
What we found: Chrome assigns a unique client ID on installation that persists across sessions and is sent to Google with every sync, crash report, and usage metric. Combined with Google account sign-in (prompted aggressively), this creates a permanent identity linking all your browsing to your real name, email, and Google advertising profile.
What they claim: Chrome offers 'Enhanced Tracking Protection' in its privacy settings
What we found: Chrome blocks fewer trackers than Firefox, Safari, or Brave by default. Google's business model depends on advertising — blocking trackers would undermine their own revenue. Chrome's tracking protection is designed to protect Google's tracking while limiting competitors' tracking.
What they claim: Chrome auto-updates to keep you secure against the latest threats
What we found: Chrome had at least 8 actively exploited zero-day vulnerabilities in 2025 and 4 already in 2026. CVE-2025-14372 (Password Manager use-after-free, CVSS 9.8) could expose saved passwords. The constant stream of critical vulnerabilities means the browser holding all your data is under continuous active attack.
What they claim: Chrome's Privacy Sandbox was announced as a 'privacy-first' replacement for third-party cookies
What we found: After 5 years of promises, Google fully abandoned the plan to remove third-party cookies in October 2025. FLoC was rejected by the entire industry (EFF, DuckDuckGo, Brave, Vivaldi, Mozilla, WordPress). Its replacement Topics API was also deprecated. The Privacy Sandbox was a delay tactic that kept third-party cookies alive for 5 extra years while Google built alternatives that still track you.
What they claim: Chrome's Incognito mode promises that 'other people who use this device won't see your activity'
What we found: Google settled a $5B class action lawsuit after internal emails showed employees called Incognito mode 'effectively a lie.' Google continued collecting browsing data in Incognito mode through Safe Browsing, search suggestions, and other services. Billions of data records were ordered deleted.
What they claim: Chrome is the most widely used browser with 67.7% global market share
What we found: The DOJ found Google holds an illegal search monopoly (August 2024). The DOJ proposed forcing Google to sell Chrome (November 2024). The court ruled Chrome stays but exclusive default deals are banned (September 2025). Chrome's dominance means Google's privacy defaults are the internet's defaults — 3.83 billion users affected.
What they claim: Google states Chrome respects user preferences and provides transparency about features and data usage
What we found: Chrome silently downloads and installs Gemini Nano, a 4GB AI model, on user devices without consent, notification, or opt-in. No disclosure in update notes. Users discover it only by checking storage.
What they claim: Google claims reCAPTCHA protects all users from bots and abuse
What we found: In May 2026, Google updated reCAPTCHA to require Play Services v25.41.30+, locking out every de-Googled Android device (GrapheneOS, /e/OS, LineageOS). The new QR-code verification needs a cryptographic handshake that only works with Play Services installed. iOS users face no equivalent restriction. Privacy advocates including Brave CEO Brendan Eich called it a strategy to entrench Google services. Users must choose: accept Google tracking or lose access to banking, social media, and e-commerce sites using reCAPTCHA. The move echoes Google's abandoned Web Environment Integrity proposal from 2023, which would have let tech companies decide which devices deserve web access.