Google Quietly Removes Privacy Assurances From Chrome AI Settings
Key Takeaways
- ▸Google removed a privacy representation from Chrome settings guaranteeing that Gemini Nano runs locally 'without sending your data to Google servers'
- ▸The removal coincides with relocating the setting to a separate section, reducing visibility and suggesting intentional de-emphasis
- ▸The deletion may constitute unlawful processing under GDPR Article 6 if the original claim was false or if data processing has changed
Summary
Google has silently removed privacy assurances from Chrome's settings UI regarding its Gemini Nano AI model, which the company installed on user devices without explicit consent. Previously, the settings displayed a privacy representation stating that the model runs "without sending your data to Google servers," but this guarantee has been deleted in the current version. The removal raises serious regulatory concerns, as users in the EU, UK, and other jurisdictions are legally entitled to rely on vendors' stated processing claims when deciding whether to permit data processing activities. Privacy analyst AlexanderHanff argues the deletion suggests one of three problematic scenarios: the original claim was inaccurate and Google is removing it pre-emptively before regulators investigate; the architecture is changing to transmit data to Google's servers; or the change is being deliberately obscured to reduce user awareness. Each scenario potentially violates GDPR Article 6, the Unfair Commercial Practices Directive, and equivalent privacy statutes globally.
- The incident highlights how platform vendors exploit regulatory gaps through incremental UI changes rather than transparent policy updates
Editorial Opinion
Google's quiet removal of privacy assurances is a masterclass in regulatory evasion. By installing an unrequested 4GB model and then deleting the privacy claims that made it palatable, Google appears to be attempting an end-run around privacy law through opaque UX changes rather than direct legal challenge. This approach is especially troubling because it targets non-technical users who rely on vendor representations, treating privacy compliance as a PR problem to be managed through UI tweaks rather than substantive policy changes.


