Google reCAPTCHA service under the microscope: Questions raised over privacy promises, cookie use

guest · Nov 2, 2020

Google reCAPTCHA service under the microscope: Questions raised over privacy promises, cookie use
November 2, 2020
https://www.theregister.com/2020/11/02/google_ad_recaptcha/

Six years ago, Google revised its reCAPTCHA service, designed to filter out bots, scrapers, and other automated web browsing, and allow humans through to websites.
The v2 update in 2014 added an iframe or HTML Inline Frame, which is a way of embedding one web page in another. Then there was the v3 update in 2018, which added machine learning to the mix, to reduce the need for interaction with bot detection challenges.

Yet the Silicon Valley corp's fine-print and other disclosures stop short of saying reCAPTCHA is completely quarantined from all ad-related data collection. And privacy researchers now argue that the company needs to clarify that point.
Zach Edwards, co-founder of web analytics biz Victory Medium, found that Google's reCAPTCHA's JavaScript code makes it possible for the mega-corp to conduct "triangle syncing," a way for two distinct web domains to associate the cookies they set for a given individual.

Two different domains generally shouldn't have access to the same set of cookie data, based on the distinction between first-party and third-party resources in the web browser security model. But triangle syncing dissolves that separation.
Click to expand...

Triangle of ad success?
"Triangle syncs expand an advertising universe and make it possible to target someone across more domains," Edwards told The Register.

"So reCAPTCHA's gstatic.com domain doing a triangle sync to google.com basically ensures that a user can be found/tracked if either of those domains is embedded into a website," Edwards said.
Google's privacy disclosures may be adequate to cover reCAPTCHA's role if it were found to play a role in the company's ad business. Google does disclose that it sets advertising cookies via its gstatic.com domain.

Google maintains gstatic.com doesn't read or write cookies, but it appears the domain invites google.com to set them.
Click to expand...

Data CAPTCHA
Edwards however argues that Google hasn't been sufficiently clear that reCAPTCHA uses this domain.
"In my opinion, organizations in Europe that use reCAPTCHA for spam protection now need to move reCAPTCHA behind their consent walls," he said.
Click to expand...

Log in or Sign up

Google reCAPTCHA service under the microscope: Questions raised over privacy promises, cookie use

guest Guest

Log in or Sign up

Google reCAPTCHA service under the microscope: Questions raised over privacy promises, cookie use

guest Guest

Useful Searches