Oh yeah, it’s Google again with its new update!
This time, it is the new IP protection feature.
The feature is developed to ensure that the user leaves minimal footprints over the web and prevents their data from being tracked through IP addresses.
It is the next privacy-focused update after cookie depreciation and another impediment for marketers to collect data for personalization.
By now, you will have questions like what exactly it is and how it works. If this update closes personalization doors on one side, will it open doors for marketers on the other with optimal opportunities?
I am sure you all want to learn the answers to it. Read this post; it has all the details you need to know.
Table of Contents
Why IP Protection Feature?
The IP address is a reliable identifier that is hard to control and change by users, like browser cookies, which they can delete and modify the permissions to share with third parties.
Often, users are unaware that their IP address is tracked behind the scenes.
So, what exactly is an IP address?
The IP address is a unique, stable, and reliable cross-site identifier assigned to each internet user by the Internet Service Provider (ISP). The identifier acts as an online postal address that allows the website and server to send information back and forth.
It is easy to collect because it is sent back and forth along with information. You can’t block IP addresses like cookies because they are important to the internet. It shows where the connection request comes from and where it should go and returns the resulting data.
When this IP address is tracked for a long time, the persistent user profile can be built out of it without the user’s consent, and this type of tracking is called cross-site tracking.
Now, what is cross-site tracking?
Cross-site tracking denotes the activity of your data tracked across different websites, either by the website you visited or by the third parties associated with the visited website. Both the first and third parties collect your data and justify tracking with personalization of content and other suggestions that suit you.
Browsers are making their moves against cross-site tracking and covert tracking. Covert tracking comes under cross-site tracking. It denotes the process of tracking user data using methods such as hidden pixels, cache inspection, and fingerprinting to leverage every detail of the user’s activities in the browser.
These techniques are usually exercised without the user’s explicit consent or by giving opt-out options. Google Chrome developed the IP protection feature to prevent such privacy invasion, reduce the concern of cross-site tracking, and strengthen user privacy.
Besides being a reliable identifier, the IP address is also vital for functions in the network and operations like routing traffic and preventing fraud and abuse.
Google Chrome’s New IP Protection Feature
Google Chrome’s new feature is proposed to prevent IP address tracking by routing the traffic through a proxy server and anonymizing the IP address of qualifying traffic.
The privacy proxy is nothing but an intermediary server (according to Bleeping Computer) through which the traffic will be routed (or passed) by hiding the IP address of the users. So that the destination origins cannot see nor track the original IP addresses of the users.
Working process of IP protection feature:
- Request initiation: Suppose you type in a search query “ Top travel companies.” Google Chrome will list the results, and you click one of the links that got your attention and initiate a request,
- Eligibility checking: The IP protection feature is active on your device. Now, Chrome will check whether the request is eligible traffic or not by checking the website domain and the requested content.
- Proxying the traffic: For eligible traffic, Chrome sends the request to one of its proxies instead of sending it directly to the website.
- Proxy conceals the IP address and forwards the traffic: The proxy server removes the IP address from your request and assigns the generic one, which means it deletes the digital footprint that gives details like the device and location and forwards the request to the intended website.
- Website responds to proxy: The website receives the anonymized request without any information about the user and returns the requested content.
- Proxy responds to Chrome and you: The proxy receives and sends the content back to Chrome, which it displays on your screen.
Thus, this extensive process keeps your valuable identifier and digital traces hidden.
Goals of the new IP protection feature
- The IP address will be concealed so they won’t be used as a tracking vector.
- To minimize disruptions in the regular operations of the server, i.e., using the IP address for anti-abuse like detecting DDoS* despite the fact they are hidden (until there is an alternative approach)
*Distributed Denial of Service (DDos) is an attack where the bad actor floods the website with internet traffic, preventing eligible users from using it*
The new IP protection feature
- The destination website doesn’t see the user’s IP address
- The content of the user traffic should be private to the intermediaries and proxy servers.
The proposal prioritizes routing the eligible third-party traffic through the proxy server to meet these requirements.
The new feature will use CONNECT and CONNECT-UDP (with MASQUE) to forward traffic to the destination. Instead of the data going directly from Chrome to the destination server, it will go through an end-to-end encrypted tunnel via the Transport Security Layer (TLS).
TLS is a security protocol that prevents the data’s integrity, which is passing through the encrypted tunnel (from the Chrome browser to the website server). CONNECT and CONNECT-UDP are approaches in HTTP protocol used to pass the traffic through the server and add an extra security layer.
Plans for Upcoming Phases
In the upcoming phases, Google plans to bring a 2-hop proxy system to increase privacy. The 2-hop means two proxies in series between the browser and the website.
Google will run the first hop, and the external Content Delivery Network (CDN), which is collaborated with Google, will run the second. The data passes from Chrome to Google proxy (hop 1), then from Google proxy to CDN”s proxy (hop 2), and then to the destination website. This ensures that neither Google nor the external CDN’s server can see the client’s IP address. As usual, the CONNECT and CONNECT-UDP will support the chain of proxies.
GeoIP
IP-based Geolocation is used by many for the traffic routed through proxies to serve the relevant content, such as content personalization (language), compliance with local laws and regulations, and geo-targeting ads.
These activities are hard to do when Chrome masks the IP address. That’s why it assigns a new IP address for the anonymized request. It gives a user’s coarse location (like the country name, not the granular details) to the website, with which they can serve relevant content and personalized ads based on the region’s interests.
Is the New IP Protection Feature Live Now?
Google will not make the feature default anytime now. First, it wants to test and track the behavior trends and introduce additional features in the upcoming phases to accommodate regional demand and minimize disruptions in network operations.
Google decided to proxy the requests in its domains (Google products) in “phase 0” using a proprietary proxy. This will help them test the infrastructure and refine the list of affected domains.
In phase 1, they will extend the application to more users and domains, and they might extend the usage to some regions. If phase 1 works, they will roll out the feature to all as a default setting, but this will not happen before 2024. (as per Google)
The feature will be added to the default settings as an optional feature. Users can choose to turn it on or off.
Who Can Use the IP Protection Feature Now?
- Initially, the feature will be available to users who use Google Chrome from U.S.-based IP addresses.
- As I said, Google will test the working process in its products like Gmail and AdServices to comply with their ecosystem’s commitment to protecting privacy.
Security Concerns in IP Protection Feature
There are some cyber security concerns in the IP protection feature. As the traffic is proxied through the Google servers, it will be difficult for the security and fraud detection services to detect invalid traffic or block DDoS attacks without the IP address.
Also, if any of Google’s servers are compromised, there is a high chance of traffic manipulation by bad actors.
That is why, to overcome this, Google wants the user who uses the new feature to authenticate with the server. The Googe serves tokens for authentication and introduces rate limits to prevent attacks and minimize disruptions.
Impact of IP Protection Feature on Marketers
The new update will take a toll on publishers and advertisers when it becomes fully live.
Cookies depreciation threw the marketers into the deep end, just as they overcame it by embracing alternatives such as contextual targeting, building potential relations with users, and aggregating first-party data. Here again, Google throws another snag at them.
Marketers are now like:
New IP protection will surely hit hard on content distribution and ad serving. Also, we don’t know- to what degree the GeoIP’s coarse location data helps target users. One thing is sure: Personalization is about to get complex.
Now, marketers have to find another solution to keep their revenue flowing. Otherwise, they must wait for another Google initiative, like a Privacy Sandbox for cookie depreciation.
In that case, Google always plays diplomacy with users and marketers. It strengthens user privacy with new features and, at the same time, allows marketers to access user information in a more extracted format. It always strives hard to satisfy both and keep the world-circling inside its products.
FAQs
- What is the IP protection feature in Chrome?
The new IP protection feature in Chrome proposes to route the traffic through intermediate Google proxies (servers) by hiding IP addresses so that the destination website cannot see the original IP address, nor can it track the identifier for a long time to create a persistent user profile without the user’s consent.
- What is IP protection Phase 0 in Chrome?
The phase 0 is the first phase of testing the Chrome’s IP protection approach. In this phase, Google will test the features on its products like Gmail and Adservices to test and make necessary changes. The feature is now available to users who use US-based IP addresses.
