Google Chrome does not honor Cookie Blocking for Youtube.com

UPDATE: Chrome will correctly block youtube (and other cookies). Thanks to Mike West at Google for taking the time to leave a comment outlining the fix. The crux of the issue is that a literal pattern like I was using ( youtube.com ) will only match the literal domain “youtube.com”. To match all sub-domains, you need to use a wildcard, although the syntax is non-obvious (to me). The correct pattern is [*.]youtube.com. Interestingly, if you try to use *.youtube.com, the field turns red and you cannot save the pattern, which is what led me to try youtube.com. I have also updated my article on HOWTO prevent youtube from tracking your gmail-credentials.

Here’s the original post:


A few (wow, 10?) months ago, I posted instructions for preventing youtube from tracking your gmail credentials, which amounts to blocking youtube from setting cookies in your browser, and removing any existing youtube cookies. However, I’ve noticed that every so often, youtube once again identifies me by my GMail account, and I have to clear the cookies again, even though I am still blocking all cookies matching “youtube.com”.

I finally decided to investigate, and it appears that Chrome is not honoring my blocked cookies settings at all. Clear all cookies prevents youtube from identifying my GMail account, until I click on a youtube link in an email in GMail, and then the cookie is set and I’m identified until I clear it (don’t log out of youtube, you will be logged out of GMail too). For reference, my Chrome version is currently 20.0.1132.57, and is “Up to date” as of this writing, but I have been having this issue for some time.

Steps to reproduce:

  1. Close any open windows/tabs for youtube.com
  2. Open Settings, Advanced Settings; under Privacy click “Content Settings…”
  3. Click “Content Settings…”
  4. Under Cookies make sure the “allow local data to be set (recommended)” is selected.
  5. Click “Manage exceptions…”
  6. in the box “Add a new hostname pattern”, enter “youtube.com” (without quotes); set the behavior dropdown to “block”, and click ok.
  7. You are returned to the Content Settings dialog; click “All cookies and site data…”
  8. in the “Search Cookies” box (top right), type “youtube” (no quotes).
  9. If the list contains any cookies, click “Remove all”.
  10. Close the cookie dialog, content settings dialog, and the settings tab.
  11. Navigate to youtube.com
  12. Return to settings, advanced settings, content settings, All cookies and site data
  13. Search again for “youtube” (no quotes). You will see cookies from youtube. If you return to youtube and watch some videos, and then search again, you will have more cookies, plus “local storage”.

Just because youtube is a google property is no reason for Chrome to not honor my cookie settings. I don’t know if that is the case; I don’t know if Chrome ignores all cookie blocking settings, but this is a case I discovered and can reproduce. I submitted a bug report (essentially the same as this post) via Chrome’s “report an issue” feature. We’ll see if it gets addressed; I’ll post an update if I hear directly from Google.

HOWTO Prevent YouTube from Tracking your GMail Credentials

Updated 21 Jul 2012 to correct the cookie pattern syntax for Chrome.

I have recently noticed that when I visit a page on youtube, the top-right corner shows that I am logged in by my email address. Because I use Google Apps for Business (neĆ© Google Apps for Domains) to manage my email, and because Google recently insisted I merge all of my Google accounts, I also see a banner at the top of the page warning “This account is managed by jclark.org” with a link for more info.

What this means is that Google can track all of the videos I watch on YouTube and associate them with my GMail account. And I expect that goes for YouTube viedos embedded on other sites as well Because I value my privacy, I don’t want that behavior; that’s the primary reason I have never signed up for a YouTube account. Logging out of YouTube has an undesirable side-effect: I am immediately logged out GMail and Google Reader as well. One solution is to use separate browsers, however, I prefer to run a single browser for efficiency, and viewing any page with an embedded YouTube video in my GMail browser would tack me, even if I then use another browser to view it.

I have found a simple solution: do not allow youtube.com to receive or store cookies on my browser. This also required removing any existing youtube.com cookies already stored by the browser. This has the side effect that I cannot log in to YouTube at all, however, that is acceptable to me since I don’t have, and do not want, a YouTube account.

Here are the steps I took in Chrome:

  1. Close any open youtube.com pages.
  2. Using the wrench icon, open Preferences
  3. In the “Under the Hood” tab, in the Privacy section, click “Content Settings…”
  4. Under Cookies, the current setting should say “Allow local data to be set (recommended),” or possibly “Allow local data to be set for the current session only”. If you have another setting, you probably already take a more active role in managing your cookies, and should not need these directions.
  5. Under Cookies, click “Manage Exceptions…”
  6. Under “Hostname Pattern” type “[*.]youtube.com” (no quotes) and change the Behavior dropdown to “Block”. Close the dialog.
  7. You are returned to “Content Settings”; under Cookies click “All Cookies and Site Data…”
  8. In the search box, type “youtube” (no quotes). The list of sites’ cookies will be filtered to URLs containing “youtube”; in my case, it was all URLs ending in youtube.com. Click “Remove All”.
  9. Close preferences. Browse to YouTube, you should now see a “Sign In” link in the upper right corner. Confirm that you are still logged in to GMail.
  10. Profit! Well, a little more Privacy, at any rate.

Inspiration

If you can watch this without being inspired to do something, well, I feel terrible for you.

More Please:

Hamburger Assistant

Like the idea of Hamburger Helper but don’t like the smarmy little glove? Need a quick dinner? Try this.

Ingredients
1 lb. Ground Beef
2 packages Beef flavored Ramen Noodles

Cook the ground beef about 3/4 done and drain the fat off. Add seasoning packet from one of the Ramen packages and continue to cook. Meanwhile, boil the noodles from both packages together (no seasoning) for two minutes and drain well. Mix the noodles with the cooked beef, and add remaining seasoning packet to taste. At least a half packet, you may want the whole thing.

This has always been my go-to dish when I’m Mr. Mom. The kids love it, and so do I. At $0.20 plus a pound of beef, it’s a lot cheaper than the glove too.

Missing Comments

If you have commented on a post in the last few months, and it never appeared – it should now be present (unless it was spam, of course). I just discovered a number of comments awaiting moderation; I don’t seem to have been getting the notification e-mails. I’m trying to figure out why; in the interim, I’ll try to keep an eye on the moderation queue.