> they could get the same result by sending the header to GTM
Do you mean Tag manager, or some other GTM?
I also, and this'll be seriously counterintuitive, doubt that they could be quite as conscientious of user data if they were handled via GTM. To sketch out the concern here: Chrome telemetry that is not used to identify people and personal ad preferences/data tied to an individual user probably shouldn't be sent via the same channel or logged in the same place. They're used for different purposes, by different people, and likely have different infrastructural concerns related to storage and querying. In fact, it would be rather suspicious if chrome telemetry data was sent via Google's ads logging infrastructure. That would imply an odd level of co-design and coupling.
> sent to DoubleClick explicitly
And everything else owned by Google. It's not sent to Doubleclick specifically, which you never seem to acknowledge. It's sent to stuff that Google owns (and presumably, really just a large selection of things sitting behind the GFE[0]).
> For ad networks, including Google's own ad department, Chrome is like a candy store. Firefox and Safari have tracking prevention and cookie mitigations. Chrome on the other hand has undisclosed, impossible to disable ad network tracking headers being sent to DoubleClick explicitly. Chrome's cookie security is similarly a joke, designed for the benefit of ad networks.
Firefox does the same thing as chrome (via Firefox Telemetry). There's privacy tradeoffs between the two approaches, Firefox's allows the telemetry holder to reconstruct browsing data for a particular user (assuming the browser sends the data out of band to some central server). Google's approach doesn't allow that. There's also some technical advantages to Google's approach in terms of telemetry (both for Chrome and for Google sites), but those don't affect the privacy tradeoffs of how the telemetry is ultimately reported.
> Google didn't ever disclose this fact
You mean except in the Chrome whitepaper.
> "Just trust us, we won't abuse this!" is not good enough, considering the way it was implemented is already cloak-and-dagger suspicious.
But, like, it's not. The lengths you have to go to to make it appear suspicious (including lying repeatedly about how Google didn't disclose the feature) demonstrate how it's not in fact that suspicious. Yes, when you misrepresent the facts, it begins to sound suspicious. But that's because you're misrepresenting what was actually done.
The disconnect here seems to be that your position is that burying it in an obscure highly technical document is "disclosure", whereas 99.9999% of Chrome users don't even know this document exists, let alone how to find it or even how to read it.
That practice is worse than Facebook. Facebook at least makes some effort to explain privacy implications to users in human readable text that most people can understand.
So I still feel comfortable calling it an undisclosed and impossible to disable feature. Because for the vast majority of users, this is the case. It's not disclosed to them unless they go digging through websites for highly technical whitepapers they don't understand and can't read.
It's also mentioned explicitly, in plain language, in the privacy policy[0], which links to the whitepaper. This section, or something functionally equivalent has been present since (at least, that's as far back as you can check) 2014, still in plain language. The 2014 version links to a 2012 chromium blog post announcing that announced the fancy new field trials infrastructure[1]. Please stop lying about this it was not, and has not ever been "buried" or "undisclosed".
Of course, the privacy policy doesn't explain the precise methodology of how the telemetry is sent, so there's no "oh its done via an http header", because it's a nontechnical explanation with the goal of informing users how their data is being used, and not of giving them details of the method.
Do you mean Tag manager, or some other GTM?
I also, and this'll be seriously counterintuitive, doubt that they could be quite as conscientious of user data if they were handled via GTM. To sketch out the concern here: Chrome telemetry that is not used to identify people and personal ad preferences/data tied to an individual user probably shouldn't be sent via the same channel or logged in the same place. They're used for different purposes, by different people, and likely have different infrastructural concerns related to storage and querying. In fact, it would be rather suspicious if chrome telemetry data was sent via Google's ads logging infrastructure. That would imply an odd level of co-design and coupling.
> sent to DoubleClick explicitly
And everything else owned by Google. It's not sent to Doubleclick specifically, which you never seem to acknowledge. It's sent to stuff that Google owns (and presumably, really just a large selection of things sitting behind the GFE[0]).
> For ad networks, including Google's own ad department, Chrome is like a candy store. Firefox and Safari have tracking prevention and cookie mitigations. Chrome on the other hand has undisclosed, impossible to disable ad network tracking headers being sent to DoubleClick explicitly. Chrome's cookie security is similarly a joke, designed for the benefit of ad networks.
Firefox does the same thing as chrome (via Firefox Telemetry). There's privacy tradeoffs between the two approaches, Firefox's allows the telemetry holder to reconstruct browsing data for a particular user (assuming the browser sends the data out of band to some central server). Google's approach doesn't allow that. There's also some technical advantages to Google's approach in terms of telemetry (both for Chrome and for Google sites), but those don't affect the privacy tradeoffs of how the telemetry is ultimately reported.
> Google didn't ever disclose this fact
You mean except in the Chrome whitepaper.
> "Just trust us, we won't abuse this!" is not good enough, considering the way it was implemented is already cloak-and-dagger suspicious.
But, like, it's not. The lengths you have to go to to make it appear suspicious (including lying repeatedly about how Google didn't disclose the feature) demonstrate how it's not in fact that suspicious. Yes, when you misrepresent the facts, it begins to sound suspicious. But that's because you're misrepresenting what was actually done.
[0]: https://sre.google/sre-book/production-environment/