As I warned about months ago now, I can confirm that Google Chrome's #AI API is now actively being used for device fingerprinting and tracking purposes.
Out of 100 of the top global english language content sites - around 30% are actively using the API for fingerprinting, Google Advertising (profiling) or both) without the legally required consent (EU law).
This is CNN doing it (unlawfully, without consent)...
@thatprivacyguy I suspect everything coming in the javascript delivered in the 'gpt` url path will be interesting, and pretty universal.
@thatprivacyguy CNN is owned by Trump goon Larry Ellison and is run by his nepo baby David. They scoff at the law. They own literally all media in the USA now.
@thatprivacyguy I'm not going to assert that nothing bad is going on, but in (1), checking what JavaScript names exist gets them the same information as the version number in the User-Agent string, so it's more useful for detecting misleading clients than for fingerprinting, and in (2), generally sites need to know if they're doing really slow operations a lot, even if this can also be used to destructively read whether someone has ever visited a site that used this feature.
Oct 7, 2026, 10:44 AM^ @EUCommission [just that you knew …]
@thatprivacyguy There isn't a single piece of information that isn't actively being exploited for fingerprinting. Canvas. Browser plugins. Zoom levels. Screen resolutions. Everything.
But banning children from the internet is somehow the answer, instead of locking up these spyware fanatics.
@elricofmelnibone yes I know I have been investigating and fighting these issues for the last 20 years, it’s my job. But this is a new issue which is why I raised it - my full report on Nov 17th covers all the rest as well.
@thatprivacyguy @elricofmelnibone Shouldn't Google then be held responsible for any age identification? No need for ID. They know enough about their users and should be held responsible.
@thatprivacyguy
#yetanotherreason to #avoidChrome , I dare say
Oct 7, 2026, 11:29 AM@paoloredaelli @thatprivacyguy Is there a plugin or something that could protect Chrome users?
@evert no. That's on purpose from Google. They will actively sabotage anything that cuts into their advertising income.
Short of installing a completely different browser (ex. Firefox) you could try a "plugout," so to speak: https://github.com/ungoogled-software/ungoogled-chromium
@evert @paoloredaelli @thatprivacyguy totally unsolicited, maybe the best thing is recommending not using Chrome.
A slightly better option of you need to is using ungoogled Chromium.
Then, other browser. Maybe overkill, but I use a Firefox fork called Librewolf with very high security by default (nevertheless, most sites work!), with uBlock/ad nauseam extension and others for keeping cookies, for example, at a minimum. Reducing fingerprint and tracking at a high degree.
@precariousmind Given that I only use #Firefox, do you think it is advisable to recommend also #Brave as an alternative?@evert @thatprivacyguy
@paoloredaelli @precariousmind @evert @thatprivacyguy Firefox isn't even private anymore and us loaded with AI bloat. Use one of its more secure forks like LibreWolf or Waterfox or Tor Browser.
Brave is not remotely as secure or private as LibreWolf, but is much more so than Google Chrome or Mozilla.
It goes without saying that absolutely everyone should stop using Gmail and Outlook and Yahoo mail services. You'd have to be out of your mind to use those and claim to be concerned about privacy.
@precariousmind @evert @paoloredaelli @thatprivacyguy The main issue I find with using Firefox based browsers (Like Librewolf, which is my daily driver) is that I need to keep a Chromium browser on hand because often sites just break on FF based browsers. These aren't websites as much as they are Chrome apps - but I *have* to use them to bank, to access essential support, etc.
@precariousmind @evert @paoloredaelli @thatprivacyguy keep in mind that a distinctive browser signature (in terms of what is *not* supported, or denied) can itself be a target for fingerprinting and tracking =\
@evert @paoloredaelli @thatprivacyguy Are you telling me you actually use GOOGLE CHROME...in 2026??? Do you use Stock Android with Google Play Services, too? This is wild to me.
Not trying to sound like a dick, but if you still are we need to give you a community crash course on the horrors of Google and Apple services/ecosystems...then we can move on to the Meta Pixel. Holy mother of fuck...
@frequencyfault @evert @paoloredaelli this was a research project on browser privacy and given almos the entire world uses google chrome for their browser yes of course the research was conducted in chrome otherwise it would not be remotely relevant to the real world.
@frequencyfault @evert @paoloredaelli and as for not wanting to sound like a dick - try thinking outside the box, I am a researcher, I research based on what most people experience.
@frequencyfault @evert @paoloredaelli @thatprivacyguy What Android and App Store should we use?
@DarkAthena @evert @paoloredaelli @thatprivacyguy GrapheneOS then you can run F-Droid, Accrescent...literally tons of app marketplaces outside Google's locked playpen. They claim it's to keep users safe, but that's bullshit. You don't need them looking out for you. Just don't be stupid online. I have never paid for antivirus or internet security software...it's native to most operating systems for free. All shit like Kaspersky, Avast, Norton, Play Protect, etc. do is hog resources data mine.
@thatprivacyguy @Vivaldi @jon Maybe an opportunity to confirm that Vivaldi is unaffected?
Oct 7, 2026, 1:27 PM@jeancf @thatprivacyguy @jon As a @Vivaldi I'm also wondering if it's affected or not.
@jeancf @thatprivacyguy @Vivaldi @jon Would also be interested to know this.
@SkellySoft @jeancf @thatprivacyguy @jon Vivaldi is not affected by this. We have been disabling Gemini at compile-time for a long while. This particular API depends on a component that was already disabled.
@thatprivacyguy This further proves the importance of Tor, developing more nodes, and using anti-fingerprinting browsers utilizing the Tor network.
@thatprivacyguy
I have all of Gugul's (& others') URLs uBlocked. 🤷
I'm not aware of brilliantchap.com but Cloudflare Radar info is entirely "Unavailable", so already dubious. Then its Category is listed as "Fashion"!?!
My browser (not Chrome) reports "Server not found" for the URL yet uBlock reports 2 cookies from it!
Added to my blocklist anyway, for what it's worth.
The ironic part is that anyone who disables it now will become more uniquely identifiable as they are no longer in the mainstream crowd that just uses the defaults.
@thatprivacyguy Out of interest - do you know if this is also the case for Ungoogled Chromium?
Bitcoin anchored. Wow. No half measures there.
But this is an observation. How does one prove that it is used to fingerprint instead of for example testing feature existence for actual usage?
@thatprivacyguy We've disabled glic in debian's chromium (the built-in gemini nonsense; same patch that ungoogled-chromium uses), but I'd like to see what this looks like for myself. Do you have a link that will show what this fingerprint looks like for the browser one is using, so I can see if we need to do further work to remove AI garbage?