Privacy has become the central battleground in the ongoing war for market share between browser makers including Google, Apple, Mozilla, Microsoft and niche providers such as Brave.
Google Chrome is the world's most popular browser on desktop and on computer, with 70% of desktop share, and 64% on mobile according to NetMarketShare. For many users, Chrome and Google are bywords for access to the web.
The dominance of Chrome is alarming to Google's critics, who note that the company makes almost all its money through a complex ecosystem of ad products and free services that hoover up huge amounts of data.
Those critics also say Chrome's dominance as a browser has the consequence of giving the search giant an outsize say in determining how the web is fundamentally shaped.
Much of this boils down to the nitty-gritty of who gets to decide what the web looks like, and how they do it.
Many of the discussions about web standards take place within industry consortia, notably the World Wide Web Consortium, also known as the W3C.
Critics of Google say the firm has too much power in shaping the web
For something so drearily technical, the discussions are surprisingly political.
The W3C's member organizations are a diverse mix of tech firms, academic institutions, and publishers among others. One of these members might propose a new web standard, and put it up for informal discussion through one of the W3C's "interest groups." The process of deciding on the standard then moves up a level to the W3C's "working groups", and then to review and a final vote.
The key W3C interest group for browser providers to talk about new privacy features has, at Business Insider's last count, 30 Google staffers, 11 from Apple, six from Microsoft, and four from Brave.
Despite a one-vote-per-organization rule, critics say Google's ability to devote more staff time and resources to thinking and arguing about these issues gives the search giant an outsize say when it comes to determining how websites fundamentally work.
"Google is by far the largest player on standards bodies and so Google directly or indirectly has a large say in defining what the neutral web is," said one source, also a W3C member.
"In some ways truthfully, in some ways disingenuously, Google can say: 'We're just doing what the web defines, and everybody else is deviating from what the web actually is.' Largely because ... Google outnumbers people on standards bodies ten to one," the person added.
They added that while the engineers behind Google's Chrome are "well-intentioned" on areas such as privacy, it's hard to square this with the way the firm primarily makes money through "tracking people on the web."
Here's a widely cited example among Google's critics: Google has been championing a standard for the web called the Bluetooth Web API.
The idea is to enable sites to scan for local Bluetooth devices, allowing users to control their Bluetooth-connected gadgets from the web. There are some exciting uses here since it would, theoretically, make it easier for a person to control their Bluetooth fitness device from a web app, for example.
But the pro-privacy crowd within W3C saw the development as alarming, saying that Web Bluetooth would leak all kinds of personal information.
Dr Lukasz Olejnik, an independent security and privacy consultant, warned that giving sites access to Bluetooth devices, be it a connected kettle or a fitness device, would likely result in users unknowingly handing over sensitive information. "Using Web Bluetooth API, web sites will be able to monitor user's movements and location changes in real-time," he wrote in 2016. The Register in 2017 described the feature as a "snitch API."
Maciej Stachowiak, head of WebKit engineering at Apple and an active W3C member, also publicly expressed reservations in June, citing "some scary stuff from a web POV [point of view]."
Apple declined to implement the API, but Chrome rolled out the feature, as did several other browsers have based their browsers on the same code as Chrome, Chromium, including Microsoft's Edge.
It's this kind of thing that alarms Google's detractors — can the tech giant make potentially privacy invasive features the norm on the web thanks to Chrome's dominance?
Despite Chrome's huge market share, its smaller competitors are successfully pushing back against features they don't like, turning privacy into a selling point, and in some cases pressuring Google to become more privacy-friendly more quickly.
Brave, the venture capital-backed browser challenger, likewise declined to implement Web Bluetooth API. The API, despite adoption by multiple browsers, has not been approved as a web standard.
Apple, meanwhile, is outwardly and aggressively anti-tracking both on Safari and on iOS apps. In March, the company rolled out full third-party cookie blocking, claiming it was paving the way for competitor browsers. The feature makes it more difficult for advertisers to track users around the web. Brave and the Tor Browser also implement cookie blocking, and Google plans to follow suit in 2022.
Lukasz Olejnik, the independent researcher, told Business Insider: "Chrome's move to restrict third-party cookies is motivated with actions of other web browser vendors and the ensuing pressure."
He added, however, that Google's changes here were part of the firm's ongoing evolution on privacy.
Dr. Johnny Ryan, senior fellow at the Open Markets Institute and at the Irish Council for Civil Liberties and a former Brave employee, said Apple and Brave could sidestep proposals for the web that feel particularly invasive.
"Apple and Brave are fighting this Gaulish little village fight against the Roman empire," he told Business Insider.
Peter Snyder, chief privacy officer at Brave, likewise characterized efforts to push through aggressive pro-privacy features as a group effort.
Brave incorporates widespread ad blocking and anti-tracking, but also offers the ability for users to pay creators who they may be depriving of ad revenue. It's based on a "de-Googlified" version of Chromium, the open source code that underpins Google's Chrome and is available to other browser vendors.
Snyder said: "Where I think Brave and Apple are complementary in standards bodies — not that others aren't doing great work — is that where we have complementary goals, we can play different roles."
He added that Safari, due its size, can essentially block Google from bulldozing new standards through the W3C.
"While Safari is not Chrome, it's large and it's important, and for many reasons, sites need to work in Safari," he said. "If Safari says, 'We think this is bad' and folds it hands, that's a strong deterrent from the rest of the web from being like, 'Well, we're going to use this anyway.'"
He added: "Brave can do the opposite and say, 'We are proof that you can have a highly featured browser that even has a similar code base as Chrome but doing dramatically more aggressive privacy protections in a way users like. So we can be like counterfactuals against each other. And that ends up being useful."
Google is under antitrust pressure
Even those directionally opposed to Apple and Brave's privacy measures accuse Google of having too much influence within the W3C.
A letter submitted by a coalition of adtech firms to the W3C's advisory board in July argued: "Different W3C member organizations are able to dedicate differing numbers of people, with varying amounts of time and expertise. Member organizations with the capacity to field larger numbers of people with the time and mandate to navigate the complexity of multiple groups, processes, history, and documents are advantaged."
Google pushed back on suggestions that its dominant presence in some W3C groups gave it undue influence on the future of the web, and said the consortium was open for anyone to join. The firm argued that its greater presence in certain groups didn't necessarily reflect greater activity.
A spokesperson said: "We have long worked actively across the ecosystem, including in forums like the W3C, to improve, evolve, and preserve the open web.
"Recently we have been focused on the Privacy Sandbox, an open initiative built in collaboration with the industry, to fundamentally enhance privacy on the web to support the wealth of things people use the web for, including maintaining a healthy, ad-supported web ecosystem."
The firm also suggested that fears around Web Bluetooth were unfounded, saying there it hadn't found indications developers were using the feature to track users invasively.
Still, Google is unlikely to convince its most ardent critics to change their minds.
Our W3C source added: "Google has a very different set of incentives than everybody else does on these bodies. Other people [mostly] are not selling tracking-based ads in these bodies. Other people are dramatically more skeptical, in general."