So Chrome 70 landed this week and buried in the changelog is the thing I've actually been waiting for since September: you can finally turn off that forced sign-in nonsense. If you don't remember the drama, back when Chrome 69 shipped in early September, Google quietly changed how browser sign-in worked. Log into Gmail or YouTube in a tab, and boom, the whole browser silently signs you into your Google account too. No prompt, no "hey is this okay," just done. A bunch of security people made a lot of noise about it (Matthew Green's blog post on this was the one that actually got me paying attention) and Google's response at the time was basically "don't worry, we're not syncing your data unless you tell us to." Which, fine, but that's not really the point. The point is I didn't ask for my browser identity and my website login to be the same thing.
Anyway, it's fixed now, or at least fixable. Chrome 70 went to stable on the 16th and there's a new toggle buried in Settings.
Here's where to find it:
- Go to
chrome://settings/ - Scroll down to "You and Google" (or just search "sign-in" in the settings search bar, way faster)
- Look for "Allow Chrome sign-in" and flip it off
That's it. Once it's off, signing into a Google site in a tab is just... signing into that site. Your browser doesn't care. You can still sign into Chrome on purpose if you want bookmarks and history synced across devices, you just have to actually click the button now instead of it happening to you as a side effect of checking your email at a coffee shop on a computer that isn't yours.
I want to be clear I'm not one of the people who thinks this was some grand conspiracy to harvest everyone's data. I don't think it was. I think it was a product team optimizing for "fewer steps to get logged in everywhere" without thinking hard enough about the fact that identity and browser state are different things to different people for different reasons. Some of us use one Chrome profile for work and a personal Gmail on the side and very much do not want those blurring together automatically. My work laptop has three Google accounts logged into different services throughout the day and the idea of the browser itself picking one and running with it made me twitchy in a way I couldn't fully articulate until I actually read through what was happening under the hood.
The other small thing in this release, and I almost missed it because it's not flashy: cookies get deleted now when you sign out of a Google account through this flow, instead of hanging around. Small, unglamorous, exactly the kind of change that never gets a headline but is the actual substance of the fix.
I bring this up not because I think Chrome 70 is some huge moment in tech history, obviously it isn't, but because I think this is a decent little case study in how these things go. Ship a change, get pushback, take a few weeks, ship a real fix with an actual off switch. That's basically the system working, even if the first version shouldn't have gone out that way to begin with. I'd rather write about the boring toggle than the initial controversy anyway, because everyone already wrote the outraged post back in September and at this point rehashing it is just noise.
If you're on Firefox already and feeling smug right now, fair, but Firefox has its own sync opt-in weirdness if you dig into it, nobody's hands are perfectly clean here. I still use Chrome for most day to day stuff mainly because of extensions and devtools, not because I think Google's the trustworthy one in this story. Worth checking that toggle either way, took me about four seconds to find once I knew where to look, and I'd been annoyed about this specific thing for a month and a half without doing anything about it. Sometimes the fix really is that small.
One more thing while I'm in here: if you use multiple Chrome profiles for different clients or projects, this update is a genuinely good reason to double check each profile's setting individually. The toggle is per profile, not global, at least on my machine. Found that out the hard way when my "client B" profile was still set to auto sign-in after I'd already turned it off on my main one.