2

A lot of websites use ajax.googleapis.com. Some also use it for forms. As filling forms often entails entering personal information, I'm wondering whether there is a risk of that information being readable to Google.

For example, when ordering product online, I have to enter a shipping address and other contact information. Does Google now have my address?

I'm of course hoping that this is all implemented as javascript being loaded from Google's servers once, without any further interaction with Google. I.e., once loaded, I'd hope that the code only runs locally in my browser and only sends the entered data to the owner of the website, not to Google.

Related question, but from the perspective of a website designer: Privacy risk in using Google APIs

Improve this question

1 Answer 1

Reset to default
2

Yes, Google could run a different script than the one the site creator intended, and it's not hard to have a script send off entered information. However, the reaction upon getting "busted" doing that would be pretty severe among developers, and probably lawyers as well. There are terms and conditions, and contracts are to be followed by both parties. There is little incentive for Google to capture info they likely already have, so this is probably not a realistic concern.

You can see all the script's activity in the developer tools, including in non-chrome browsers. I suppose Google could engineer chrome in a way to cover up what script was loaded, as well as hide the ex-filtration http request, but we're getting really tin-hatty here, and there's other tools like wireshark that would ensnare them. In short, it's simply not possible to do this perfectly, nor worth it for them to do this in general.

If in doubt, and doubt is healthy, use the integrity attribute on CDN resources to prevent this exact scenario in supporting browsers (~60% at time of writing).

EDIT: There is a hidden privacy consideration here. It's not the info being entered, but everything else Google can tell by you using such a service:

  1. Who - Which user is loading the script (IP)
  2. What - What script; something for validating forms, watching vids, etc (script url)
  3. When - What time was the script loaded
  4. Where - What site/section/page is the user on (refferer)
  5. Why - Google's a pioneer in deep learning ;)

If you self-host the script, google gets none of that, and thus your users gain a little privacy.

Improve this answer
2
  • 1
    nice answer. Careful about the integrity attribute, it is not yet supported by all the major browsers (notably IE, Edge & Safari not supporting yet)
    – niilzon
    Commented Apr 7, 2017 at 8:06
  • 1
    Sure it can't hurt :) Just saying that one should not believe that it is implemented by all major browsers and blindly rely on it. I'd use it anytime it is a great feature
    – niilzon
    Commented Apr 7, 2017 at 8:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .