"Google/Firebase operates at the high end of surveillance capitalism, collecting extensive sensitive data (location, health, biometrics, communications) across 2+ million partner sites and serving ads based on granular behavioral tracking that users cannot truly opt-out of. Data is retained indefinitely for vague purposes, shared with advertisers and domain administrators without per-request consent, and tracking persists even in private browsing modes. While some controls exist for ad preferences, the underlying data collection and cross-device tracking continue automatically, and domain administrators can override user deletion rights entirely."
firebaseapp Privacy Concerns & Scorecard
No meaningful opt-out from data collection or sharing; controls only affect ad personalization, not underlying tracking or data use. Domain administrators can restrict user deletion rights, removing control entirely
Extensive collection of sensitive personal data including location (GPS, IP-based, cell tower, Wi-Fi), health information (Fitbit data, heart rate, sleep patterns, skin temperature), biometric data (fingerprints), communications (emails, call logs with routing metadata), and continuous device/app activity tracking
Indefinite retention of data for vague 'legitimate business or legal purposes' with no clear deletion timeline. Data persists in backup systems for unspecified periods after deletion requests
Comprehensive cross-site behavioral tracking through cookies, pixels, and unique identifiers on partner sites. Tracks mouse movements over ads, page interactions, and creates inferences about user interests for targeted advertising
Sharing phone numbers with businesses when users interact with ads and integration of Google services into third-party apps enabling unrestricted data collection beyond Google's direct control
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, authentication, communication, and ad targeting with phone number sharing to businesses on ad interaction.
Service operations, email delivery, comment moderation, and law enforcement response.
Maps navigation, location-based ads, Timeline features, device functionality, and personalized search results.
Health tracking, fitness features, product improvement, and research.
Product development, authentication method research, and algorithm improvement.
Service compatibility, device fingerprinting, cross-device tracking, ad targeting, and crash reporting.
Network functionality, security, location determination, and system optimization.
Search personalization, content recommendations, ad targeting, product improvement, and research.
Transaction processing, purchase recommendations, ad targeting, fraud prevention, and financial record-keeping.
Service operations, user storage, content delivery, and machine learning model training.
Ad personalization, advertiser reporting, product recommendations, and machine learning model improvement.
Service improvement, ad targeting, advertiser measurement, cross-site behavioral profiling, and product analytics.
Service reliability, security, bug fixing, and system optimization.
Ad targeting, content personalization, product recommendations, and research.
Legal compliance, law enforcement response, and subpoena fulfillment.
Cross-Platform Tracking
Google tracks users across 2+ million partner websites and apps using cookies, pixels, unique device identifiers, and account linking. Your browsing activity on unrelated websites is automatically associated with your Google Account if you're signed in, enabling cross-site behavioral profiling. This tracking persists even in private/Incognito mode when third parties are involved. Device identifiers (UUID/IMEI) cannot be reset, ensuring permanent cross-service tracking.
Tracking Methods:
First-Party Cookies & Session IDs
Google's own cookies on google.com domain and signed-in users' accounts to maintain sessions and store preferences.
Third-Party Cookies & Partner Pixels
Cookies set by Google AdSense, Google Analytics, and other Google services on 2+ million partner websites to track user behavior across the web.
Unique Device Identifiers
Permanent UUID/IMEI and Advertising ID on Android, plus browser fingerprints, that cannot be reset by users and enable cross-device tracking regardless of account sign-in status.
Google Account Linking
Automatic association of third-party website visits and app usage with user's Google Account when signed in, creating unified cross-site behavioral profile.
Web Beacons & Tracking Pixels
Invisible pixels embedded in emails and web pages (especially YouTube embeds) that communicate with Google servers to track opens, views, and interactions.
Analytics & Measurement Tags
Google Analytics code installed on millions of websites collecting detailed user interaction data (page views, clicks, scroll depth, time spent) and transmitting to Google.
IP Address Tracking
Every web request and API call includes IP address, which Google uses to determine location, network type, and user identity even without cookies.
Voice Activation Buffers
Devices record 0-5 seconds of audio before 'Hey Google' wake word is detected, creating continuous partial recordings sent to Google servers.
Android System Integration
Deep integration into Android OS enables collection of call logs, message logs, app usage, network connections, and device events without per-app consent.
Cross-Service Account Aggregation
Data from Gmail, YouTube, Google Maps, Android, Chrome, Search, and Fitbit is automatically linked within Google account, creating unified behavioral profile.
AI & Data Training
firebaseapp uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Search Queries
Search terms and queries entered into Google Search are used to train generative AI and language models
Browsing History
Chrome browsing history and activity on third-party websites is used for AI model training
Email Content
Email content in Gmail accounts may be used for AI training, with claim that sensitive content (health, financial) is excluded
Photos, Videos, Documents
User-created content including photos, videos, documents, and spreadsheets is used for computer vision and generative AI training
Public Web Content
Publicly available web content across the internet is collected and used to train large language models and generative AI systems
Audio & Voice Samples
Audio samples including voice recordings from 'Hey Google' activation and voice assistant interactions are analyzed to improve speech recognition and AI systems
YouTube Video Metadata & Comments
YouTube video watch history, comments, and engagement data is used for AI model training and content recommendation systems
How to Object
- 1
Under U.S. state privacy laws (Washington My Health My Data Act and Nevada Senate Bill 370), users can withdraw consent for certain AI training and profiling. For Washington users specifically, health information must be excluded from AI training unless explicitly authorized. No global opt-out URL provided in policy.
Why We Analyzed firebaseapp
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.