Take your time to review Google’s privacy settings, it’s worth it.

Today I got this notice on Youtube to review (the key points of) Google’s privacy policy.

If you click on “REVIEW NOW” you get the following pop-up:

The data protection they are referring to — at least the one that I’m aware of — is GDPR. A regulation that will become effective on May 25, 2018 and with which all companies targetting EEA customers will need to comply.

The urge Google uses here, “We’ll need you to do this today”, is just a social engineering technique. They try to abuse the sense of urgency so that people want to get the job done as quickly as possible and just click the agree button. Google really doesn’t want you to read what’s in the privacy reminder pop-up. The only reason it’s there is because GDPR obliges them to do so. They sugarcoated it a bit, but it’s still pretty clear they ask your permission to keep on tracking you. So relax a bit, take your time, there’s no need to hurry. There’s nothing to lose here, they’re already tracking you at the moment. By taking a few minutes time you can ensure that you'll give up a lot less of your privacy in the future.

Other options

Ok, still with me? So you didn’t agree but you've chosen “other options”

Let’s review these one by one.

“Google Search customization”

If you're not signed in, by default the signed-out search activity is on:

As you see in the text message you can sign in to your google account to adjust what’s saved to your account. So we have to take care of both signed-in and signed-out tracking. You should verify your signed-out settings in any browser you use. So make sure you're not signed in to your Google account. Just open the link below in any other browser you use. Note it contains “optout”, and that’s exactly what we want to do.

https://www.google.be/history/optout?cb=1&hl=en

So when you turned off "the signed-out search activity" for every browser we can continue with the signed-in settings. Open now the same link after you've signed in to your Google account. It looks like this:

Here you can manage your activity. When you click the "manage activity" link you navigate to

Important settings to review here are the activity options. I just switched them all off.

You can also verify your account settings by clicking on the “My account” link.

“Ads settings”

https://adssettings.google.com/anonymous/cu?hl=en

The same story here. There are both signed-in and signed-out settings. The signed-out ones look like this:

Again, switch these off. The first one by toggling the slider and don’t forget to turn off the “Ads Personalization Across the Web”. In both cases, you’ll get the same confirmation pop-up.

Of course they’re trying to convince you not to do it. Don’t let you scare by things like “You may see more adds”. Ad blockers or browsers like Brave, with built-in ad blocking capabilities, are available to help you kill these pesky ads.

When you you switched off "Ads personalization on Google Search" you see the message below:

For "Ads personalization Across the Web", it's a slightly different pop-up:

You can chose to opt out of customized ads here. This is what that means:

To do so either click the "opt out of more ads" link or browse directly to: http://www.youronlinechoices.com/uk/your-ad-choices

You can turn off any company that "is delivering advertisements customized to your interests". Click on the "Turn off all companies" button or select individual companies to turn off. This again needs to be done in every browser. It takes some time to finish and possibly not all selected companies can be turned off. In case of errors you will see a notice on the screen with guidance about what to do. Detailed info about this opt-out can be found here: http://www.youronlinechoices.com/uk/opt-out-help

When you have switched off both settings, they should look like this:

You need to repeat this for every browser when not signed in to your Google account. For the signed-in settings, sign in by clicking on the "sign in" link. You'll see the screen below. Either you can switch off the "Ads Personalization" (disables ads for all topics) or you can manually remove items from the "topics you like".

This needs to be done in only one browser because these are the settings related to your account.

“Youtube customisation”

This one is shown in a pop-up but is also available via the following link: https://www.youtube.com/history_controls?hl=en

Note that your watch and search activity will be deleted when you turn off this features. If you decide to turn this features off you have to do it again in every browser when signed out.

You have to do this once more if you're signed-in:

“Browser-based controls”

The browser-based controls are shown in a pop-up.

You can review your cookie settings by following the described steps, or by entering the cookie settings URI directly in the address bar of your browser. In Chrome for example: chrome://settings/content/cookies. You'll see this page:

You can for instance block third party cookies here. Another option in the browser based controls is to opt-out of Google Analytics data collection. You can do so by downloading a browser add-on via the following link: https://tools.google.com/dlpage/gaoptout?hl=en

You need to repeat this again for every browser you use.

Conclusion

Even if you didn’t get the privacy policy notice that I got, think about reviewing your Google privacy settings. There are a lot of settings enabled that you absolutely don’t need and that can be switched off. If you’ve already accepted the policy without changing your privacy settings, no worries. With the links provided in this article you can change them anytime.

Update 18/08/2018:

Today I learned that Google also tracks the purchases you made. You can check what google knows about your online purchases on https://myaccount.google.com/purchases

But what is google exactly tracking? On this page you get more info.

In my case I only had orders for which I had receipts or confirmations in Gmail, but also orders placed using Google Services are tracked by Google. Only you (and Google of course) can see these orders.

My first question was, how can I stop Google from tracking my orders? As it seems this is not possible. Like explained in the screenshot above you can delete orders. In my case there was no other option than removing the order receipt or confirmations in gmail and then they disappear from the list.

It's not only online orders that Google tracks. Also online reservations (for instance flights) and subscriptions. As it seems you can't stop Google from tracking these either, but you can delete them in the same way as the orders.

John Opdenakker

John Opdenakker

Blogger | #Infosec | #AppSec | Security awareness | Occasional Public Speaker | Cycling | Running | Enjoying life