Google quietly logs users into Chrome without consent

Users of Google services such as Gmail have noticed they have been automatically synced to Chrome, without expressly logging into Google’s browser.

The search engine updated its web browser recently and, according to reports, it has an unannounced syncing feature. Indeed, the only inclination users will have of being logged into Chrome is that their avatar will be in the top corner of the browser, despite not directly logging into the service.

Matthew Green, a cryptocurrency professor at John Hopkins University was one of the first to spot the change, calling it a “user-unfriendly forced login policy” and approached Google for an explanation.

“A few weeks ago Google shipped an update to Chrome that fundamentally changes the sign-in experience,” he wrote in a blogpost. “From now on, every time you log into a Google property (for example, Gmail), Chrome will automatically sign the browser into your Google account for you. It’ll do this without asking, or even explicitly notifying you.

“The Chrome team has offered a single defence of the change. They point out that just because your browser is ‘signed in’ does not mean it’s uploading your data to Google’s servers.”

In a series of Twitter posts addressing privacy concerns, Google Chrome engineer and manager Adrienne Porter Felt explained that the change did not mean that Chrome would automatically send user browser history to associated Google accounts

“My teammates made this change to prevent surprises in a shared device scenario,” she tweeted. “In the past, people would sometimes sign out of the content area and think that meant they were no longer signed into Chrome, which could cause problems on a shared device.

“The new UI clearly reminds you whenever you’re logged in to a Google account. Plus, you now only need to sign out in one place before you share your computer with someone else.”