From someone else's post up-thread: "In general models trained on individual users' data get rebuilt when the underlying data changes so as to properly reflect the current state of the source data." https://news.ycombinator.com/item?id=19809346

Google is not allowed to collect PII data of users who visit google services without registering. So everytime you delete your cookies, you are a new user, and they also are not allowed to log the ip address of non-users indefinitely.

Do you have a source, or any evidence that they don't? Google doesn't deserve the benefit of the doubt. This is literally their business model.

I think this is basically the GDPR rules, but I would need to look into the details more.

You're right - Article 3 of GDPR defines the scope as applying to any user residing in the EU. If the users are not logged in then you don't know where they reside (IP address != residence), meaning any international company that operates in the EU needs to err on the side of caution for non-logged in users everywhere.

IP address geolocation is the normal way people determine if GDPR applies.

IP address geolocation is not always accurate, can be spoofed, and is flat out wrong for EU residents who travel outside of the EU.

Maybe it's normal for a startup, but for a billion dollar company, they're not going to roll the dice on 4% revenue fines and IP address geolocation.

If you send some test requests to any big company including Google I believe you'll see they're using IPgeo.

(Disclosure: I work at Google, I'm not a lawyer, and this is not legal advice)

Do you think my interpretation of Google not having long-term user-profiles of non-logged in users due to GDPR is correct? I read that Google has rolled out their GDPR compliance worldwide.

Simply using an IPGeo service doesn't mean they're not handling the GDPR compliance differently.

GPDR is not recognized in all countries, and most notably not in the country google calls 'home'.

Google is an Irish company.

Translation: American users are f-ed.

GDPR is not enforceable in the US, so this is applicable only to the EU. In the US AFIAK Google can collect anything that you consent to.

uBlock with dynamic filtering takes care of that for me, but I recognise it isn't practical for >95% of internet users.

I use uMatrix, but the amount of sites where you need to allow Google domains and cookies for reCaptcha to work is depressing.

And then you will be "punished" for being off the grid, and the images will take 8 seconds to fade out and fade in...

Glad I'm not the only one hating this. Especially with lots of captchas in a row it's super annoying - "yeah, it's the same browser, same cookie, same IP, doing the tenth captcha in 10 minutes, all previous tests succeeded ... better make sure to look extra closely and slow it down".

I've experienced this too. Are you saying Google's algorithms know (or at least strongly suspect) I'm human but throttle me anyways because I've taken steps to protect my privacy? Out of spite?

Probably not, the issue is that headless browser bots take the same precautions of preventing Google knows anything about them as you and other privacy-conscious users do.

There's a leap in logic there. Some ads may be harmful, but if so, they shouldn't be used at all.