Google Chrome is the most popular browser in the world. Chrome routinely leads the pack in features for security and usability, most recently helping to drive the adoption of HTTPS. But when it comes to privacy, specifically protecting users from tracking, most of its rivals leave it in the dust.

Users are more aware of, and concerned about, the harms of pervasive tracking than ever before. So why is Chrome so far behind? It’s because Google still makes most of its money from tracker-driven, behaviorally-targeted ads. The marginal benefit of each additional bit of information about your activities online is relatively small to an advertiser, especially given how much you directly give Google through your searches and use of tools like Google Home. But Google still builds Chrome as if it needs to vacuum up everything it can about your online activities, whether you want it to or not.

In the documents that define how the Web works, a browser is called a user agent. It’s supposed to be the thing that acts on your behalf in cyberspace. If the massive data collection appetite of Google’s advertising- and tracking-based business model are incentivizing Chrome to act in Google’s best interest instead of yours, that’s a big problem—one that consumers and regulators should not ignore.

Chrome is More Popular Than Ever. So is Privacy.

Since Chrome’s introduction in 2008, its market share has risen inexorably. It now accounts for 60% of the browsers on the web. At the same time, the public has become increasingly concerned about privacy online. In 2013, Edward Snowden’s disclosures highlighted the links between massive, surreptitious corporate surveillance and the NSA’s spy programs. In 2016, the EU ratified the General Data Protection Regulation (GDPR), a sweeping (and complicated) set of guidelines that reflected a new, serious approach to data privacy. And in the U.S., this year’s Cambridge Analytica scandal sparked unprecedented backlash against Facebook and other big tech companies, driving states like California to pass real data privacy laws for the first time (although those laws are under threat federally by, you guessed it, Google and Facebook).

Around the world, people are waking up to the realities of surveillance capitalism and the surveillance business model:  the business of “commodifying reality,” transforming it into behavioral data, and using that data and inferences from it to target us on an ever-more granular level.  The more users learn about this business model, the more they want out.

That’s why the use of ad and tracker blockers, like EFF’s Privacy Badger, has grown dramatically in recent years. Their popularity is a testament to users’ frustration with the modern web: ads and trackers slow down the browsing experience, burn through data plans, and give people an uneasy feeling of being watched. Companies often justify their digital snooping by arguing that people prefer ads that are “relevant” to them, but studies show that most users don’t want their personal information to be used to target ads.

All of this demonstrates a clear, growing demand for consumer privacy, especially as it relates to trackers on the web.

As a result, many browser developers are taking action. In the past, tracker blockers have only been available as third-party “extensions” to popular browsers, requiring diligent users to seek them out. But recently, developers of major browsers have started building tracking protections into their own products. Apple’s Safari has been developing Intelligent Tracking Protection, or ITP, a system that uses machine learning to identify and stop third-party trackers; this year, the improved ITP 2.0 became the default for tens of millions of Apple users. Firefox recently rolled out its own tracking protection feature, which is on by default in private browsing windows. Opera ships with the option to turn on both ad and tracker blocking. Even the much-maligned Internet Explorer has a built-in “tracking protection” mode.

Yet Google Chrome, the largest browser in the world, has no built-in tracker blocker, nor has the company indicated any plans to build one. Sure, it now blocks some intrusive ads, but that feature has nothing to do with privacy. The closest thing it offers to “private” browsing out-of-the-box is “incognito mode,” which only hides what you do from others who use your machine.  That might hide embarrassing searches from your family, but does nothing to protect you from being tracked by Google.

Conflicts of Interest

Google is the biggest browser company in the world. It’s also the biggest search engine, mobile operating system, video host, and email service. But most importantly, it’s the biggest server of digital ads. Google controls 42% of the digital advertising market, significantly more than Facebook, its largest rival, and vastly more than anyone else. Its tracking codes appear on three quarters of the top million sites on the web. 86% of Alphabet’s revenue (Google’s parent company) comes from advertising. That means all of Alphabet has a vested interest in helping track people and serve them ads, even when that puts the company at odds with its users.

Chrome and Edge are the only two major browsers without a built-in tracker blocker. Source: "Desktop Browser Market Share Worldwide - StatCounter Global Stats.”

And that may explain why Chrome lacks real tracking protections. The only other major desktop browser without a built-in tracker blocker is Edge, Microsoft’s replacement for Internet Explorer. This is bad news and a worrisome step. In moving from Explorer to Edge, Microsoft seems to be abandoning its interest in helping users protect their privacy in order to race to the bottom against Google.

Google has come under fire in the past for using its power in one arena, like browsing or search, to drive revenue to other parts of its business. Yelp has repeatedly claimed that Google uses its search engine to favor its own business reviews. Last year, the EU levied a record $2.7 billion fine against the company for using search to drive users towards its comparison shopping site; then it outdid itself with a $5 billion fine for using Android to drive web searches. And earlier this this year, Mozilla complained when a YouTube update made the video service five times slower in Firefox than in Chrome.

Chrome’s lack of tracker controls represents a different kind of harm, one that hurts its users more than its competition. Often, Google’s interests align with those of Chrome’s users. It wants people browsing, searching, and watching as much as possible, and that means providing a buttery-smooth interface with fast loading times and secure infrastructure. But it also wants them feeding back data about all their online activity to Google. Google has an incentive not to protect Chrome users’ privacy, and it appears that it sees no balancing that incentive to accommodate users’ desires.

With Great Power...

Many of the criticisms in this post apply to Microsoft Edge as well, but we’re picking on Chrome for a reason. The Chrome team’s actions affect more than just their users. Because Chrome controls such a massive part of the browser market, decisions its developers make have an outsized impact on the rest of the ecosystem. Companies that make money by tracking users need browser makers to permit these business models. If everyone used Tor Browser or Brave, many data brokers’ and trackers’ current business models would cease to be viable.

Apple’s efforts with ITP have already forced some tracking companies to change their behavior. Facebook recently announced its intention to move away from using third-party cookies to power Pixel, its third-party analytics product. And French ad-targeter Criteo announced that it was expecting an ITP-related revenue hit while promising to invest in tracking methods that would work around Apple’s system.

Google is by far the largest player in both the desktop and mobile browser markets, and it has access to engineering resources unmatched by its competitors. As long as most Chrome users remain susceptible to tracking, trackers will keep making money. On the other hand, if Chrome were to introduce an optional tracker-blocking mode—or better yet, to block trackers by default—the ramifications would be enormous. Overnight, an entire industry built on surreptitious tracking would have a lot fewer people to track.

And there lies the catch. Users don’t like tracking. For Chrome to serve its users, it needs to help them block trackers. But for Alphabet to keep making as much money as possible on ad retargeting, it needs web browsers—especially Chrome—to allow tracking.

Do The Right Thing

One way for Google to deal with this kind of criticism without truly changing its approach would be to have Chrome block certain kinds of “low-hanging fruit” tracking, like third-party cookies, while purposefully leaving the door open for more sophisticated methods. Google could then adjust its own tracking strategies to work within the rules Chrome would set. The company has already done something similar in the ad space, configuring Chrome to block egregiously annoying ads (but leaving its own ads alone).

This might look like a win-win at first: Google could claim to provide better privacy for its users, at least in the short term, while simultaneously undermining its competitors in the targeted-ad space. However, beyond being a potential abuse of its market power, this would actually hurt users in the long run. If Google can cement its dominance in both the browser and ad industries while continuing its tracking practices, it will ensure that users are tracked on Google’s terms for years to come. Google cannot both be the umpire of what tracking ads are allowed and the pitcher of most of the ads.

Google could take the lead on solving this problem. Trackers are not necessary to make the Web work, and they shouldn’t be necessary for Google to make lots (and lots) of money.  As we noted above, Google has mountains of direct information about what you want to buy through its various services, from search to Maps to Google Play. Ads don’t need to be targeted using every little bit of information about us that Google has access to via our use of its browser. A sustainable Web needs to be built on consent, not subterfuge.

The change could start by making sure that Chrome’s features and settings always look out for the user first, blocking trackers by default. Beyond that, Chrome’s developers should have the freedom to design the best “user agent” they can, without caving to the imperatives of Google’s advertising business. If this simply isn’t possible for the company, then the consumer harms of having these two conflicting business priorities under one roof may be cause for an intervention by antitrust or other legal authorities.