Chrome tags you with a permanent ID on install. If you sign in — which it pushes hard — every site you visit is linked to your real name and fed into Google's $265B advertising machine. Google spent 5 years promising to kill tracking cookies. The entire industry rejected their alternatives. In 2025 they gave up. The cookies are still there. Five years of your browsing data that could have been protected wasn't.
What they claim: Chrome's Safe Browsing protects users from dangerous sites using a locally stored list, with an optional Enhanced mode for stronger protection.
What we found: Standard Safe Browsing checks URLs against a locally cached list — but Google pushes users toward Enhanced Safe Browsing, which sends every URL in real time to Google's servers. Enhanced mode is presented as the recommended option during Chrome setup. Once enabled, Google receives a complete log of browsing activity, downloads, and extension data. Google's own documentation confirms Enhanced mode "sends URLs to Safe Browsing for checking" and "temporarily links this data to your Google Account." The upgrade from local checking to real-time URL transmission is framed as a security improvement, not a surveillance expansion.
What they claim: Chrome requests only the permissions needed for a web browser
What we found: Chrome Android requests 27 permissions including CAMERA, RECORD_AUDIO, ACCESS_FINE_LOCATION, READ_CONTACTS, GET_ACCOUNTS, NFC, and BLUETOOTH. Exodus reports zero trackers — but Chrome IS the tracker. All telemetry is first-party Google code, invisible to third-party analysis tools.
What they claim: Chrome's privacy policy promised personal information "won't be sent to Google unless you choose to store that data by turning on sync"
What we found: On June 4, 2026, US District Judge Yvonne Gonzalez Rogers denied Google's motion to dismiss, ruling Chrome users who opted out of sync can proceed with wiretapping, invasion of privacy, and computer fraud claims. The judge found plaintiffs sufficiently allege Google intercepts browsing history without consent. An appeals court found "a reasonable user would not necessarily understand" they consented.
What they claim: Chrome sync lets you 'access your bookmarks, passwords, and more on all your devices'
What we found: Signing into Chrome sync also enables browsing history sync, autofill data sync, extension sync, and open tab sync. The password manager is the hook — once you sign in for passwords, Google gets everything else. Most users don't realise sync means Google has a complete copy of their browsing life.
What they claim: Chrome is marketed as a 'fast, secure browser' that puts you 'in control'
What we found: Chrome assigns a unique client ID on installation that persists across sessions and is sent to Google with every sync, crash report, and usage metric. Combined with Google account sign-in (prompted aggressively), this creates a permanent identity linking all your browsing to your real name, email, and Google advertising profile.
What they claim: Chrome offers 'Enhanced Tracking Protection' in its privacy settings
What we found: Chrome blocks fewer trackers than Firefox, Safari, or Brave by default. Google's business model depends on advertising — blocking trackers would undermine their own revenue. Chrome's tracking protection is designed to protect Google's tracking while limiting competitors' tracking.
What they claim: Google claims Manifest V3 makes Chrome "more secure, faster" and protects users from rogue extensions
What we found: Chrome 150-151 (June-July 2026) removes all remaining Manifest V2 flags, permanently killing uBlock Origin and all bypass workarounds. MV3's replacement API caps filtering rules and removes real-time dynamic filtering — the capability uBlock Origin depends on. uBlock Origin Lite (MV3) is significantly less effective. Approximately 40 million uBlock Origin users affected. Google's ad revenue ($307B in 2025) depends on ads reaching users — the conflict of interest is structural.
What they claim: Chrome auto-updates to keep you secure against the latest threats
What we found: Chrome had at least 8 actively exploited zero-day vulnerabilities in 2025 and 4 already in 2026. CVE-2025-14372 (Password Manager use-after-free, CVSS 9.8) could expose saved passwords. The constant stream of critical vulnerabilities means the browser holding all your data is under continuous active attack.
What they claim: Chrome's Privacy Sandbox was announced as a 'privacy-first' replacement for third-party cookies
What we found: After 5 years of promises, Google fully abandoned the plan to remove third-party cookies in October 2025. FLoC was rejected by the entire industry (EFF, DuckDuckGo, Brave, Vivaldi, Mozilla, WordPress). Its replacement Topics API was also deprecated. The Privacy Sandbox was a delay tactic that kept third-party cookies alive for 5 extra years while Google built alternatives that still track you.
What they claim: Chrome's Incognito mode promises that 'other people who use this device won't see your activity'
What we found: Google settled a $5B class action lawsuit after internal emails showed employees called Incognito mode 'effectively a lie.' Google continued collecting browsing data in Incognito mode through Safe Browsing, search suggestions, and other services. Billions of data records were ordered deleted.
What they claim: Google claims users can "control their privacy settings"
What we found: On April 24, 2026, Google launched RTB Control as part of a court-approved settlement. It lets users remove identifiers from real-time bidding ad auctions. The control is opt-in, buried in settings at adssettings.google.com/partnerads, and expires after 3 years. No monetary compensation. The judge explicitly questioned whether it would change anything. EFF called it inadequate.
What they claim: Google spent years promising the Privacy Sandbox would replace third-party cookies with privacy-preserving alternatives, positioning Chrome as moving toward a more private browsing experience.
What we found: Google officially shut down Privacy Sandbox in October 2025, abandoning the initiative entirely. Third-party cookies remain in Chrome indefinitely. The UK's CMA released Google from its Privacy Sandbox commitments. Chrome was also found to lack anti-fingerprinting protections present in Firefox, Edge, and Brave.
What they claim: Chrome is the most widely used browser with 67.7% global market share
What we found: The DOJ found Google holds an illegal search monopoly (August 2024). The DOJ proposed forcing Google to sell Chrome (November 2024). The court ruled Chrome stays but exclusive default deals are banned (September 2025). Chrome's dominance means Google's privacy defaults are the internet's defaults — 3.83 billion users affected.
What they claim: Google states Chrome respects user preferences and provides transparency about features and data usage
What we found: Chrome silently downloads and installs Gemini Nano, a 4GB AI model, on user devices without consent, notification, or opt-in. No disclosure in update notes. Users discover it only by checking storage.
What they claim: Google claims reCAPTCHA protects all users from bots and abuse
What we found: In May 2026, Google updated reCAPTCHA to require Play Services v25.41.30+, locking out every de-Googled Android device (GrapheneOS, /e/OS, LineageOS). The new QR-code verification needs a cryptographic handshake that only works with Play Services installed. iOS users face no equivalent restriction. Privacy advocates including Brave CEO Brendan Eich called it a strategy to entrench Google services. Users must choose: accept Google tracking or lose access to banking, social media, and e-commerce sites using reCAPTCHA. The move echoes Google's abandoned Web Environment Integrity proposal from 2023, which would have let tech companies decide which devices deserve web access.