“Chrome steals your data” is the version of this story that spreads fastest. It’s also the version that’s easiest to dismiss, because technically nothing is being stolen. You agreed to it. It’s in the terms. The browser is doing precisely what it says it does.
That’s the actual problem. Chrome doesn’t need to sneak anything out of your machine, because the default settings already hand over more than most people realize — and the company on the receiving end makes roughly three quarters of its revenue from advertising. Let’s look at what’s really happening.
The conflict of interest at the center of Chrome
Most software is built by companies that want you to buy the software. Chrome is built by a company that gives the software away and sells advertising. Your browser is the most detailed sensor anyone could possibly install on your digital life: every site you visit, every search, every form, every login, every minute you spend where.
Chrome is free because you are not the customer. That single sentence explains almost every design decision below.
What Chrome actually sends to Google
1. Sync uploads your browsing life to Google’s servers
When you sign into Chrome, sync turns on and your history, bookmarks, open tabs, autofill entries, addresses, and saved passwords are copied to Google’s servers. Google offers a passphrase option that encrypts most of this so Google can’t read it — but it’s opt-in, buried in settings, and almost nobody enables it. Out of the box, your browsing history is a Google-readable database.
2. Signing into Gmail signs you into the browser
Since 2018, logging into any Google property has also linked your identity to the browser itself. Google framed this as a convenience feature. Functionally, it collapsed the wall between “anonymous browser” and “identified account holder” — and it happened without a prompt.
3. A unique identifier travels with you
Chrome attaches an X-Client-Data header to requests going to Google-owned domains, describing which experimental feature groups your install belongs to. Google says it isn’t used to identify individuals. Independent researchers have pointed out that a sufficiently specific combination of those values is effectively a fingerprint. Chrome also carries an install-time identifier and phones home for update checks, feature flags, and metrics.
4. Incognito was never as private as the name suggests
Incognito stops Chrome from saving history locally. It does not hide you from the sites you visit, your employer, your ISP, or the analytics and ad scripts embedded on nearly every page. This gap was the basis of a major US class action; Google ultimately agreed to destroy billions of records of private-browsing data as part of the settlement. The mode wasn’t broken — people’s understanding of it was, and the naming did nothing to help.
5. Ad targeting moved into the browser itself
Under Privacy Sandbox, Chrome now performs interest inference locally: it watches your browsing, sorts you into advertising topics, and offers those topics to sites you visit. It’s genuinely less leaky than third-party cookies. It also means the profiling engine ships inside the browser rather than sitting on someone else’s server — and it’s on by default. Meanwhile, Google’s long-promised removal of third-party cookies was repeatedly delayed and then walked back.
6. Ad blockers got quietly weakened
Chrome’s Manifest V3 extension platform restricted the request-filtering APIs that powerful content blockers depended on. There are legitimate security and performance arguments for the change. There is also no ignoring that an advertising company reduced the capability of ad-blocking tools on its own platform.
Where “stealing” is the wrong word — and where it isn’t
To be fair to Chrome: it’s a fast, well-engineered browser with a strong security record, and its sandboxing and Safe Browsing features have protected an enormous number of people from real attacks. Every item above is disclosed somewhere in a policy document. Nobody is breaking into your computer.
But consent obtained through a 40-page policy nobody reads, on defaults nobody chose, in a product with no meaningful competitor on some platforms, is a thin kind of consent. “Stealing” is legally wrong and emotionally about right.
If you’re staying on Chrome, change these seven things
- Turn off Ad Privacy. Settings → Privacy and security → Ad privacy. Disable ad topics, site-suggested ads, and ad measurement.
- Encrypt sync with a passphrase — or turn sync off entirely. Settings → You and Google → Sync and Google services → Encryption options.
- Block third-party cookies. Still not the default in every configuration. Set it manually.
- Stop using Chrome’s password manager. Move to a dedicated manager with end-to-end encryption.
- Switch your default search engine. The address bar is the single richest data stream you produce.
- Audit your extensions. “Read and change all your data on all websites” is a browser-wide surveillance permission. Remove anything you don’t actively use.
- Review your Google activity controls at myactivity.google.com and set auto-delete to the shortest option offered.
- Firefox — the only mainstream browser not built on Google’s engine, and it still supports full-strength content blockers.
- Brave — Chromium under the hood, so your extensions and muscle memory carry over, with tracker blocking on by default.
- Safari — strong default tracking prevention if you’re already in Apple’s ecosystem.
- Add uBlock Origin and a filtering DNS resolver regardless of which browser you land on. These two changes do more than any browser swap.
If you’re willing to switch
The bottom line
Chrome isn’t a thief. It’s a business model wearing a browser costume — and the defaults are set for the business, not for you. Fifteen minutes in the settings menu buys back most of what those defaults give away. Spend the fifteen minutes.