https://www.theregister.com/2023/11/11/google_proxy_plan_cma/ # # Sign in / up The Register(r) -- Biting the hand that feeds IT # # # Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal TechCxOPublic Sector (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Special Features Special Features All Special Features Cloud Infrastructure Week Cybersecurity Month Blackhat and DEF CON Sysadmin Month The Reg in Space Emerging Clean Energy Tech Week Spotlight on RSA Energy Efficient Datacenters Vendor Voice Vendor Voice Vendor Voice All Vendor VoiceAmazon Web Services (AWS) Business TransformationDDN Google Cloud Data TransformationGoogle Cloud InfrastructureGoogle WorkspaceHewlett Packard Enterprise: AI & ML solutionsHewlett Packard Enterprise: Edge-to-Cloud PlatformIntel vProVMware (X) Resources Resources Whitepapers Webinars & Events Newsletters [personalte] Personal Tech 48 comment bubble on white Google dragged to UK watchdog over Chrome's upcoming IP address cloaking 48 comment bubble on white Marketers tell antitrust cops privacy proxy will make it harder to protect kids online, etc etc icon Thomas Claburn Sat 11 Nov 2023 // 09:53 UTC # Exclusive Google's plan to prevent marketers from tracking Chrome users across different websites by anonymizing IP addresses is being challenged by, surprise surprise, a marketing advocacy group. The Movement for an Open Web (MOW), an organization that has lobbied against Google's Privacy Sandbox initiative by claiming it's harmful to rival internet advertising businesses, has filed a complaint with the UK's Competition and Markets Authority (CMA) over Google's IP Protection proposal. IP Protection, previously referred to as "ip-blindness" or "Gnatcatcher," is a proxy system similar to Apple's Privacy Relay. It's designed to run Chrome browser connections through two proxies, one operated by Google and one operated by a third-party (eg, Cloudflare), so that the true public IP address of the user is obscured, hopefully thwarting attempts to track them around the web using that address. [personalte] IP Protection is expected to appear in a future version of Chrome, possibly as soon as January 2024 with the debut of Chrome 122. [personalte] [personalte] The Google-run proxy can observe the user's IP address but not the websites being visited and the third-party proxy can see the web servers being visited but not the IP address of the visitor. By separating the user's IP address from the user's destination through Google's service, websites and intermediaries cannot (without additional information) link people's IP addresses to their browsing habits to create marketing profiles. Initially, IP Protection will be opt-in, but Google intends to make it the default setting for the Chrome browser. [personalte] MOW objects to this project as a violation of Google's commitments to the CMA, a set of promises the ad biz made to the UK competition watchdog to win approval for its plan to replace third-party cookies with Privacy Sandbox technologies. "Google's IP Protection means ISPs will no longer have visibility of data via an IP address whist leaving Google with the ability to monitor and process data at all times," says a letter from MOW's London-based legal representative Preiskel & Co LLP to the CMA and to UK telecom regulator Ofcom, which was provided to The Register. "This will make the provision of child protection services more difficult for ISPs." [personalte] The CMA did not immediately respond to a request for comment and subsequently acknowledged receipt of MOW's complaint. * Google - yes, that Google - testing proxy scheme to hide IP addresses for privacy * Online tracking is alive and well in link decoration * EFF urges Chrome users to get out of the Privacy Sandbox * Google Chrome Privacy Sandbox open to all: Now websites can tap into your habits directly for ads The need to protect children has become a common rationale for efforts to weaken encryption in Europe, the UK, and the US. And marketers, like law enforcement agencies, fear that privacy technologies will leave them in the dark and without the lucrative data they've come to depend upon. Such concerns have already surfaced in the IP Protection GitHub repo. For example, one pseudonymous individual who claims to help advertising clients optimize Google AdWords campaigns says that IP addresses play a critical role in fraud prevention. "By monitoring individual IP address activity for each campaign and those IP addresses clicking on keywords 10+ times per day, we have been able to exclude these IP addresses," the purported marketer wrote in early August. "The result is that we have maintained the performance of each campaign but significantly reduced the monthly spend for our clients. If we do not have access to granular IP addresses, we will no longer be able to help our clients save money, this will lead to reduced campaign performance and will no doubt lead to us turning off a number of campaigns as the economics will no longer work." For MOW, the concern is that Google would still have data denied to rivals. IP Protection is an anti-competitive technology that Google is attempting to impose upon the web under the veil of privacy "This is a blatant and egregious breach of the commitments made by Google to the CMA to prevent it acting in an anti-competitive fashion," said Tim Cowen, co-founder of MOW, in a statement provided to The Register. "They have started to roll out a clearly self-preferencing technology as part of Privacy Sandbox without adequate notice or testing. "As with all aspects of the Sandbox, IP Protection is an anti-competitive technology that Google is attempting to impose upon the web under the veil of privacy. It removes an important piece of data from Google's competitors whilst they can continue to make use of it." MOW's letter to the CMA cites specific objections as to why IP Protection contravenes Google's promises to the agency. IP Protection, it's claimed, makes it more difficult for VPN operators to compete; restricts access to data that Google's ad systems rely on; lacks the testing Google promised to do; and removes functionality without proof of its effectiveness. The missive also notes that Google has not sought a design review from the W3C's Technical Architecture Group (TAG). According to MOW, the likely reason is to avoid criticism "for the feature's anticompetitive impact and its blatant attempt to privatize the Open Web." Spokespeople for Google were unavailable for comment. (r) Updated to add In a statement provided to The Register after this story was published, a Google spokesperson said: Critics claiming that our IP Protection proposal is self-preferential to Google are either knowingly misrepresenting the facts, or simply don't understand what is being proposed.The IP Protection proposal includes a two-hop proxy system, with one proxy being operated by a third-party. This means that Google, along with the rest of the industry, will not be able to see both the client IP address and user destination. Currently, we are testing IP Protection internally at Google, and in Chrome pre-stable builds, on traffic for Google Ads. So any claims that this feature is being 'rolled out' to the broader web without 'notice or testing' are untrue. Get our Tech Resources # Share More about * Competition and Markets Authority * Google * Security More like these x More about * Competition and Markets Authority * Google * Security * Software Narrower topics * 2FA * AdBlock Plus * Advanced persistent threat * Android * App * Application Delivery Controller * App stores * Audacity * Authentication * BEC * Black Hat * BSides * Bug Bounty * Chrome * Chromium * Common Vulnerability Scoring System * Confluence * Cybercrime * Cybersecurity * Cybersecurity and Infrastructure Security Agency * Cybersecurity Information Sharing Act * Database * Data Breach * Data Protection * Data Theft * DDoS * DEF CON * Digital certificate * Encryption * Exploit * Firewall * FOSDEM * FOSS * Google AI * Google Cloud Platform * Google I/O * Google Nest * Grab * Graphics Interchange Format * G Suite * Hacker * Hacking * Hacktivism * IDE * Identity Theft * Incident response * Infosec * Jenkins * Kenna Security * Kubernetes * Legacy Technology * LibreOffice * Map * Microsoft 365 * Microsoft Office * Microsoft Teams * Mobile Device Management * NCSAM * NCSC * OpenOffice * Palo Alto Networks * Password * Phishing * Pixel * Privacy Sandbox * Programming Language * QR code * Quantum key distribution * Ransomware * Remote Access Trojan * Retro computing * REvil * RSA Conference * Software bug * Software License * Spamming * Spyware * Surveillance * Tavis Ormandy * TLS * Trojan * Trusted Platform Module * User interface * Visual Studio * Visual Studio Code * Vulnerability * Wannacry * WebAssembly * Web Browser * Wordpress * Zero trust Broader topics * Alphabet * Antitrust * Government of the United Kingdom * Search Engine More about # Share 48 comment bubble on white COMMENTS More about * Competition and Markets Authority * Google * Security More like these x More about * Competition and Markets Authority * Google * Security * Software Narrower topics * 2FA * AdBlock Plus * Advanced persistent threat * Android * App * Application Delivery Controller * App stores * Audacity * Authentication * BEC * Black Hat * BSides * Bug Bounty * Chrome * Chromium * Common Vulnerability Scoring System * Confluence * Cybercrime * Cybersecurity * Cybersecurity and Infrastructure Security Agency * Cybersecurity Information Sharing Act * Database * Data Breach * Data Protection * Data Theft * DDoS * DEF CON * Digital certificate * Encryption * Exploit * Firewall * FOSDEM * FOSS * Google AI * Google Cloud Platform * Google I/O * Google Nest * Grab * Graphics Interchange Format * G Suite * Hacker * Hacking * Hacktivism * IDE * Identity Theft * Incident response * Infosec * Jenkins * Kenna Security * Kubernetes * Legacy Technology * LibreOffice * Map * Microsoft 365 * Microsoft Office * Microsoft Teams * Mobile Device Management * NCSAM * NCSC * OpenOffice * Palo Alto Networks * Password * Phishing * Pixel * Privacy Sandbox * Programming Language * QR code * Quantum key distribution * Ransomware * Remote Access Trojan * Retro computing * REvil * RSA Conference * Software bug * Software License * Spamming * Spyware * Surveillance * Tavis Ormandy * TLS * Trojan * Trusted Platform Module * User interface * Visual Studio * Visual Studio Code * Vulnerability * Wannacry * WebAssembly * Web Browser * Wordpress * Zero trust Broader topics * Alphabet * Antitrust * Government of the United Kingdom * Search Engine TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like Help, Android 14 ate my Pixel! Bug causes endless reboots, loss of storage access Fix on the way but for those trapped in boot loop hell, data recovery isn't certain OSes30 Oct 2023 | 11 Alphabet CEO testifies in Google Search trial: We pay billions to keep Apple at bay As Uncle Sam releases internal docs on Chrome strategy, MSN, more Personal Tech30 Oct 2023 | 17 Android VPNs to get audit badges in Google Play Store if they aren't comically crap No promises it's actually secure, just that it doesn't do anything obviously dumb Applications4 Nov 2023 | 26 Automating generative AI development GenAI and powerful server hardware supports quick design, build and delivery of new AI applications and models Sponsored Feature [personalte] Google Bard AI contractors unionize amid anger over 'retaliatory' layoffs Not actually our problem, says Chocolate Factory, but watchdog decides otherwise - again AI + ML8 Nov 2023 | 3 Google mulled offering paid-for no-logging private Search subscription Also: Antitrust trial exhibits signals Incognito mode isn't truly private and 100M users may be underage Personal Tech8 Nov 2023 | 23 Google - yes, that Google - testing proxy scheme to hide IP addresses for privacy Plan for Chrome echoes Apple iCloud Private Relay Software23 Oct 2023 | 26 Theora video codec to be coded out from Chrome and Firefox Usage barely measurable so ax will swing on compression dinosaur Software2 Nov 2023 | 25 Epic Games, Google head to court over epic Play Store cut Fortnite-maker largely lost against Apple, but can it beat the Chocolate Factory? Software6 Nov 2023 | 4 Apple slams Android as a 'massive tracking device' in internal slides revealed in Google antitrust battle Whinges about Chrome maker's privacy stance while taking billions to, er, use its search engine Personal Tech3 Nov 2023 | 41 Now Russians accused of pwning JFK taxi system to sell top spots to cabbies Big Apple unlikely to get a bite out of them at this rate, though Cyber-crime31 Oct 2023 | 6 Bug bounty hunters load up to stalk AI and fancy bagging big bucks Google offers AI-specific rewards, HackerOne sees more specializations Cybersecurity Month27 Oct 2023 | 1 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * T's & C's * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2023 no-js