on macOS it's ~/Library/Application Support/Google/Chrome//Favicons). There's SQLite3 database named Favicons in your profile directory (e.g. That is not the case with this faveicon telemetry endpoint.Ĭhrome, according to my understanding, hardcodes a few favicon URLs for builtin search engines, and caches everything else on site visit. To be a strong privacy browser you could consider what it would take to be “NSL proof” such that if handed a national security letter with gag order, you cannot comply. Privacy policies are a patch for insufficient privacy engineering.

ISP or nation state firewall operators who are certainly not bound by your ‘just trust us’ privacy policy. The fact this browser connects to that endpoint reveals demographics (choice of privacy browser) and behaviors (when and how much web surfing) to e.g. You’re leaking browser usage telemetry to every single party to that traffic - the source IP address PII you mention is in unencrypted metadata. You knowing it means others can know it if you break trust or are required to comply with authorities.Īnd regardless of end-to-end encryption, that this user is phoning home to your fave icon endpoint, when, and from what IP, is revealed to every ISP in the chain.

Most normals think of collect as become known not as permanently store. To be more clear, your staff, and you, have said PII ‘like IP addresses’, and have said ‘thrown away’ some places and ‘not collected’ others.Ĭontrary to this framing, it’s not possible to not incidentally become aware of every single browser users’ usage timing and user IP addresses if the browsers are phoning home this way - a colloquial understanding of ‘collect’, not the James Clapper NSA dodge definition of ‘collect’.

Duckduckgo review 2020