Google Chrome is Google’s own browser, launched in 2008 and built on the open-source Chromium project. Its Android app alone lists more than 10 billion downloads on Google Play, and it is reviewed here on the same five criteria as every other browser in this section, as a point of contrast rather than a recommendation. The result is lopsided: Chrome scores at the top on compatibility and platform coverage, and near the bottom on what it shares by default and on how hard it is to tell one user’s browser from another’s. It works everywhere and protects little out of the box.

Privacy Defaults

Google’s privacy overview says Chrome “strives to set safe defaults” and that “privacy is a personal choice and not one size fits all.” The defaults themselves lean toward sending data to Google. Usage statistics and crash reports are on from the first launch. Google’s help page says the setting “is enabled by default” and can be turned off during installation or later in settings. Usage statistics cover how the browser is used, system information, performance, settings and preferences; crash reports “may include site URLs, your activity before the crash, and the contents of the memory at the time of the crash.” If you are signed in, Google says usage statistics may also include the age and gender entered on your Google Account. A separate setting, “Make searches and browsing better”, sends the URLs of pages you visit to Google.

The address bar is a second channel. With “Improve search suggestions” on, what you type is sent to the default search engine along with your IP address and cookies, and if Google is that search engine and “Make searches and browsing better” is also on, the URL of the current page goes with it. Google’s help page says Google Search is the default in some countries, while in others you may be asked to choose.

Third-party cookies are allowed in a normal window. Google’s cookie help page says they are blocked by default in Incognito, and the setting to block them everywhere exists but is not switched on. That is a settled decision rather than a transition: in April 2025 Google’s Privacy Sandbox lead wrote that Chrome would “maintain our current approach to offering users third-party cookie choice” and would not roll out a new standalone prompt. In October 2025 Google said it had decided to retire ten Privacy Sandbox technologies, including Topics, Protected Audience, Attribution Reporting and IP Protection, citing low adoption. CHIPS, FedCM and Private State Tokens continue. The same post announced no replacement tracking protection. For what Incognito does and does not hide, see is Incognito mode actually private; Google’s own help page puts it plainly, saying Incognito “doesn’t make you invisible” to the sites you visit, including Google sites, or to whoever manages your network.

Safe Browsing is the part of Chrome where privacy engineering is visible. In the default Standard mode, which Google’s help page says is on by default, Chrome checks a list stored on the device first, and for URLs it does not recognize it “sends an obfuscated portion of the URL to Google through a privacy server that hides your IP address.” Enhanced protection, which the user has to turn on, sends the URLs you visit, a small sample of page content, downloads, extension activity and system information to Google in real time, and when you are signed in it links that data across your Google Account. Standard mode is a real attempt to limit what Google learns from each check; Enhanced trades that for more data sent in real time, and both report to Google.

The independent default-settings tests at PrivacyTests.org, a supplementary cross-check updated on 29 September 2026, put numbers on this. Chrome 154 at default settings passed 0 of 19 tracking-cookie protection tests, 5 of 19 tracker content-blocking tests, 0 of 23 tracking query-parameter tests, 17 of 27 state-partitioning tests and 0 of 16 cross-session first-party and 0 of 16 cross-session third-party tracking tests, which check whether cookies and cached storage persist across sessions. Global Privacy Control and ECH are not enabled by default. Other browsers on the same page pass all 19 tracker-blocking and all 19 tracking-cookie tests on the same date. There is no built-in ad or tracker blocker in Chrome.

Anti-Fingerprinting

Chrome has no fingerprinting defense at default settings. On the same PrivacyTests.org page, the fingerprinting section lists a single test, system font detection, and Chrome does not resist it. The page records no other fingerprinting result for Chrome, so this assessment rests on that one data point.

The one feature Google built to hide part of a user’s identity at the network level never reached normal browsing. IP Protection, according to its own repository, limited the availability of a user’s original IP address in third-party contexts, with its scope “limited to Chrome’s Incognito mode”, using a two-hop proxy in which Google ran the first hop and external CDNs the second. Google listed IP Protection among the technologies it retired in October 2025, and the repository was archived on 3 November 2025. PrivacyTests.org records IP address hiding as not enabled by default. IP masking is scored here deliberately as part of how identifiable a user is, since a site sees the same address across visits.

Transparency & Audits

Chrome is partly open. Chromium is an open-source project, and Chrome’s terms of service, last updated on 30 September 2025, say “most source code for Chrome is available free of charge under open source software license agreements” and point to chrome://credits. The executable Chrome build you download is Google’s proprietary product, distributed under those separate terms, so what you run is not the same thing as what anyone can inspect.

No independent audit report of Chrome is published in the sources reviewed. The offsetting signal is a long-running public bug bounty: in August 2024 Google wrote that “Chrome Browser turns 16 this year and, following closely behind, the Chrome VRP is turning 14”, in a post that restructured reward tiers for memory-corruption and other vulnerability classes. A bug bounty finds security flaws; it is not a review of what the browser collects.

The trust history has two entries. In September 2018, Chrome 69 began signing users into the browser automatically when they signed into Gmail or another Google service, and Computerworld reported “there was no overt notification that the user was auto-signed into Chrome.” Matthew Green, a Johns Hopkins professor described by Computerworld as a well-known cryptographer and privacy expert, wrote a post titled “Why I’m done with Chrome,” and his objection was consent; sync was not turned on automatically. Google’s Zach Koch then announced a control in Chrome 70 to turn off linking web-based sign-in with browser-based sign-in, saying the change came from feedback by users on shared devices.

The second is Incognito. In 2020 users filed a class action, Brown v. Google in the Northern District of California, alleging that Google’s analytics, cookies and apps tracked them “even when they set Google’s Chrome browser to Incognito mode.” The suit covered users since 1 June 2016 and sought at least US$5,000 per user, and in August 2023 the judge rejected Google’s bid to dismiss it. A preliminary settlement followed in December 2023. Under the terms filed in April 2024, Google would update its disclosures about what it collects in private browsing, let Incognito users block third-party cookies for five years and destroy billions of data records; it paid no damages, and individual users kept the right to sue on their own. Plaintiffs’ lawyers valued the accord at more than US$5 billion. A Google spokesperson said: “We never associate data with users when they use Incognito mode.” The terms required the judge’s approval, and final court approval is not confirmed in the sources reviewed here.

Usability & Compatibility

This is Chrome’s strongest category. The sources reviewed document no site-compatibility problems, extensions install through the Chrome Web Store, and setup can ride on an existing Google Account. Installation is free, with desktop builds for Windows 10 and later on Intel, Windows 11 and later on ARM, macOS 13 Ventura and later, and 64-bit Linux on Ubuntu 18.04+, Debian 10+, openSUSE 15.5+ and Fedora 39+. The Android app lists 10B+ downloads and a 4.2 rating from 49.4 million reviews on Google Play, where the listing is marked “Contains ads”; the iPhone and iPad app holds a 4.7 rating from 3.9 million ratings on the App Store.

The extension platform changed underneath users in 2025. Google’s developer timeline shows Manifest V2 extensions disabled by default on 31 March 2025 with an option to turn them back on, then disabled for all users with no way back on 24 July 2025 in Chrome 138. On 31 August 2026 the remaining Manifest V2 extensions were removed from the Chrome Web Store. A Manifest V2 extension can no longer be turned back on in Chrome.

Gemini is now part of the browser. Google’s homepage says Gemini in Chrome uses “the context of your open tabs and browsing history” to help with content on the web, and its sign-in help page mentions AI Mode side-by-side browsing of open tabs. Neither page describes how that data is handled.

Cross-Platform & Sync

Chrome covers Windows, macOS, Linux, Android and iOS, and sync runs through a Google Account. Signing in saves bookmarks, passwords and other Chrome data to the account; without signing in, Google says this data is “saved only to your device.” Once signed in, Google’s help page says you can be signed in automatically to Gmail, YouTube, Search and other Google services. With Web & App Activity on, Chrome history saved to the account “may be used to help personalize your experience across Google products and services,” and synced browsing history is kept for up to one year depending on Google Account settings.

The privacy question is who can read the synced data. Google’s help page says “you can choose to encrypt certain data with your own passphrase, so Google cannot read this data,” and that information sent to Google is encrypted in transit. The passphrase is an option you have to set up, not the default, so a standard signed-in Chrome profile syncs data that Google can read. Google’s wording also limits it to certain data, not everything the account syncs.

Pros and Cons

Free on Windows, macOS, Linux, Android and iOS, with desktop builds for Windows 10 and later, macOS 13 Ventura and later, and four 64-bit Linux distributions
Extensions install through the Chrome Web Store, and setup can ride on an existing Google Account
Standard Safe Browsing sends only an obfuscated portion of unknown URLs to Google, through a privacy server that hides your IP address
Google's help page offers a sync passphrase that encrypts certain synced data so Google cannot read it, and synced data is encrypted in transit
Usage statistics, crash reports and third-party cookies can all be switched off in settings, and usage statistics can be declined at install
Most of Chrome's source code is available under open source licenses through the Chromium project
A public Chrome bug bounty that Google said was turning 14 in August 2024

Usage statistics and crash reports are on by default, and Google says crash reports may include site URLs and the contents of memory at the time of the crash
Third-party cookies are blocked by default only in Incognito, and in April 2025 Google said it would keep the current approach with no new standalone prompt
PrivacyTests.org default-settings results on 29 September 2026: 0 of 19 tracking-cookie tests, 5 of 19 tracker-blocking tests and 0 of 23 tracking query-parameter tests
No fingerprinting resistance recorded at default settings: system font detection, the one fingerprinting test listed on PrivacyTests.org, is not resisted
0 of 16 cross-session first-party and 0 of 16 cross-session third-party tracking tests passed at default settings
Gemini in Chrome uses the context of open tabs and browsing history, and Google's pages read do not describe how that data is handled
IP Protection, limited to Incognito, was retired in October 2025 along with Topics and other Privacy Sandbox technologies
The shipped Chrome build is proprietary, and no independent audit report is published in the sources reviewed
Sync passphrase is optional, so by default Google can read synced data, and with Web & App Activity on Chrome history may personalize other Google products
Chrome 69 signed users into the browser automatically in 2018 without an overt notification; a control to turn it off arrived in Chrome 70
The 2020 Incognito class action ended in filed settlement terms in April 2024 under which Google would destroy billions of data records and update its disclosures

Our Rating

Chrome fits someone whose priority is that every site and extension works, on every device, with sync that needs nothing more than the Google Account they already have. For that person the 9.0 in Usability & Compatibility and the full platform list are real, and a few settings changes (turning off usage statistics, blocking third-party cookies, setting a sync passphrase) reduce what leaves the browser.

It fits poorly if the goal is a browser that limits tracking on its own. Third-party cookies allowed in normal windows, no fingerprinting defense at default settings and the retirement of the one Incognito-only IP feature leave the two heaviest categories at 2.0 each, and together they carry 55% of the weight. That is what pulls Chrome’s overall score down to 4.0.

Privacy Defaults2.0/10
Usage statistics and crash reports are on by default, third-party cookies are blocked only in Incognito, Google Search is the default in some countries, and Chrome history can feed personalization across Google products; the Safe Browsing privacy server is a real design effort but the independent default-settings tests show 0 of 19 on tracking-cookie protection and 5 of 19 on tracker blocking.
Anti-Fingerprinting2.0/10
The independent tests record no fingerprinting resistance at default settings (the only fingerprinting test listed, system font detection, is not resisted), and the one IP-masking feature Google built, limited to Incognito, was retired in October 2025.
Transparency4.0/10
Most of Chrome's source code is open under Chromium, but the shipped build is proprietary, and the history includes automatic sign-in in 2018 and the Incognito class action; the long-running public bug bounty is the offsetting signal, and no independent audit report was found.
Usability & Compatibility9.0/10
Free installers on Windows, macOS, Linux, Android and iOS, extension support through the Chrome Web Store, setup through an existing Google Account and no site-compatibility problems documented in the sources reviewed.
Cross-Platform & Sync7.0/10
Full platform coverage and sync through a Google Account, but Google's help page offers a passphrase to encrypt certain synced data so Google cannot read it, which makes that protection optional rather than the default.

Overall4.0/10

Privacy Defaults 30% · Anti-Fingerprinting 25% · Transparency 20% · Usability & Compatibility 15% · Cross-Platform & Sync 10%

See our rating methodology →