Thread · 3 tweets · 6 Feb 2020

I'm not sure why people are going crazy over this identifier. That's not the most interesting GDPR issue with Chrome, IMHO. 👇

1) IANAL but there's a good case to be made that UAs are data controllers when they determine processing independently from the user and without technical justification. Chrome's decision to share cookie data broadly is one such. Articles 5 and 25 come to mind.

2) Chrome does a whole lot more data sharing, like sending Google your geolocation in headers and generating cookies on iOS. A version ID isn't great, but hardly top priority? To their credit it's all (lightly) documented at google.com/chrome/privacy….