Back

Google Docs exports automatically infected with tracking links:

txt - unaffected
html + AFFECTED
odt - unaffected
pdf - unaffected
epub + AFFECTED
rtf - unaffected
docx - unaffected

sample web html <a> tag:
<a class="c4" href="https://www.google.com/url?q=https://wikimediafoundation.org/&amp;sa=D&amp;source=editors&amp;ust=1696089933805520&amp;usg=AOvVaw2ypOvslXzoEGwdryv4bFyJ">https://wikimediafoundation.org/</a>

sample epub xhtml <a> tag:
<a class="c5" href="https://www.google.com/url?q=https://wikimediafoundation.org/&amp;sa=D&amp;source=editors&amp;ust=1696087392161966&amp;usg=AOvVaw1v4xpIFWD9GYkMFifXd1uo">https://wikimediafoundation.org/</a>

For those unfamiliar with html: the href section, everything between href=" and "> is the real link, and the section between > and </a> is the display text

This html feature is useful so that a link can display as smething like "Read more", "Profile", "Wiki" etc, but in this case it is misused.

Google tracks people that are not using any of their products by adding hidden tracking links to exports without designer knowledge or end user consent.

@Joe_0237 how #google manages to do this under the #gdpr is beyond me,… do you get to see a cookie banner before the redirect (in a private window)?

Nope (see picture), if they are collecting data from these redirect links it’s totally against the gdpr:

@lil5 Interesting find. Perhaps they only officially track the google user who made the doc, so users unwittingly help the google collect stats on the author and their site, or only those that are signed with in google are tracked, and almost every person with a computer is usually signed into an account. But even so, this tactic shows that there no trust, so why shouldn't they track everyone, its not like they have to share the code they say only tracks legally.

@Joe_0237 @lil5 without a logged in account, the google domain gets the same data any other site would have. If they're not setting a cookie, and the link is taking you where it is intended, I don't see what they're doing wrong.

I'm up for being educated on this topic, as it affects my field of work. Thanks

@janc @adg @Joe_0237

In Google’s defense: the person clicking export already accepted the TOS

My concern is to any other person who hasn’t logged in, and hasn’t accepted Google’s TOS

I’d need to do some extra digging to what data is being collected and if it matters how much you have consent to.

@lil5 @adg @Joe_0237 It's impossible to know how much data they collect, and what other data they link it to (or what they will aggregate it with in the future).

@adg @Joe_0237 @lil5 In this case it's sending the IP address of e.g an ebook's reader to a third party. That's not something that person expects or agreed with.

Also, breaking the GDPR doesn't require that we have proof, we only need that to convict somebody, and just like most other criminals big data companies will try to hide their crimes.

(And Google got caught violating laws many times before, so I'm definitely not going to trust them...)