If they wanted to they could associate them other ways by just looking at the IP address and/or browser fingerprinting.

My thought is that they can certainly find good indicators that they're related, but that signing into them at the same time directly in their website confirms the relationship. Bear in mind, everything coming from say, a corporate network, won't be distinguishable by IP, and browser fingerprinting is likely less helpful in an environment with a hundred PCs running identical system images.

Your home device may not live in such a family, but it's hard for Google to determine that.

Even in a corporate network there's some plugin drift over time depending on job role especially for developers. And GP specifically has installed a container add-on which probably makes him/her fairly unique among all the corporate traffic coming from that IP/group of IPs.

Most good corporate environments should be controlling what plugins they allow users to install in their browsers. (For the few users we permit to use Chrome, for example, all extensions are disabled.)

But again, the issue is not your specific configuration (or GP's specific configuration), the point is that Google cannot assume same IP or browser fingerprint is a definitive association of identity, whereas signing in additional users in Google's app definitely does.

> Most good corporate environments should be controlling what plugins they allow users to install in their browsers.

For a very odd definition of the term 'good' I suppose that's may be the case. It's certainly not been in any place I've worked in the past 20 yrs.

I can't vouch for the security of any place you've worked in the past 20 years.

But suffice to say, it's very common for Chrome extensions to be able to both modify any content on websites you view and read data you enter into them. Both adware and spyware is prolific on the Chrome Web Store, and it's the number one infection vector I see.

Controlling extensions is downright basic competency for network security. With regards to Chrome, I currently operate an outright block, though obviously we can whitelist extensions as necessary. (One thing Chrome does particularly well is their ADMX templates: It's easy to blacklist and whitelist extensions, and install them compulsorily for users as well.)

Considering that I've spent 15 of the last of those 20 years working at cybersecurity companies, I can say with some degree of assuredness that your level of control over browser extensions goes far beyond the typical work environment, and that goes doubly so for companies based in silicon valley. Do you really think that all those engineers at Google/FB/Apple/etc can't install browser extensions?

I assume there is no hiding from Google unless you black-hole their IPs. Also, don't let an Android device with links to Google be near you.

It'd hard to ban Google from your life even if you want ti. I think governments should help citizens achieve that when they choose so.

If you browser fingerprint and uniquely identify someone in this scenario what is the GDPR rationale going to be?