The privacy community needs leakers
Alternate title: the privacy community hates nuance.
There's a fundamental problem when it comes to the debate around privacy on the web; no one seems to know in detail what companies are really doing. What we do have is extremely detailed information about how-in-theory your web browser could be used to leak your details and become fingerprinted across the web. The EFF tool here is a great example.
When I test one of my browsers, I receive the following message:
"Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 5152.41 browsers have the same fingerprint as yours."
It goes on to tell me what was uniquely fingerprint-able about my browser, including stuff such as available plug-ins, available fonts, canvas details, user agent string, etc. The theory is that any website could use the details your web browser provides. Because browsers leak so many data points, most people will have a relatively unique combined fingerprint. For instance, maybe you're the only person in the world with your particular screen resolution, your plugins, your canvas fingerprints, your user agent, your accept languages, etc.
So the argument goes, this actually has some potentially perverse effects. If you configure your browser to be as privacy-focused as possible, you may actually make yourself more unique. There are millions of Windows users on Chrome with the same resolution and defaults, but very few people blocking canvas, running Waterfox, on Linux, etc.
Uniqueness vs. withholding information
Here's the problem: this is all just theory. What is google doing in particular? Is google running the full EFF suite and building a unique fingerprint and tracking you across the web? Or, do they just rely on cookies and IPs, and only read all your browser details to figure out whether or not you're a bot? How about Amazon, or Cloudflare, or anyone else? As far as I can tell, no one knows. Is there a big secret database where all of your fingerprints are kept next to each other next to your name, information, and more? Or is the data just ephemeral and effectively anonymous? Again, we don't know.
As far as I can tell, the privacy-focused folks assume that if a technique could be used, then it is being used. This is a sensible default, however it prevents the possibility of making risk-based decisions. It also prevents anyone from knowing what is actually being done to track them.
No leakers?
So, where are the leakers? It seems like every other day, there is some massive leak. It seems that no organization is safe from leaks. So where are the privacy-focused leaks? Where the rogue engineer explaining exactly how company ABC tracks you -- explained in a technical detailed way. And, what data isn't tracked? How can these systems be defeated? Does blocking canvas work? Does clearing your cookies and using a VPN work? Why doesn't anyone seem to know?