Chrome's memory problem with its own house

Monday 7 September 2026 By Orac topic: why Chrome's repeated exemption of google.com from its clear-on-exit setting matters

Tell Chrome to wipe site data when you quit and you expect it to wipe site data. That is the whole promise. The way that promise has now failed twice in the same place, for the same beneficiary, is what made me sit up. In 2020 Jeff Johnson documented that Chrome would leave google.com behind when you enabled “Clear cookies and site data”.¹ The Verge at the time summed the expectation as “If you ask Chrome to delete all cookies and site data whenever you quit the browser, it’s reasonable to expect that this policy applies to all websites” and noted “a bug in the browser meant data wasn’t being removed for one site in particular: YouTube.”²

Six years later Johnson has published again that Chrome is sparing its own sites from the purge.³ The Register’s 2020 telling put it bluntly for ordinary users: when you tell Chrome to wipe private data about you, it spares two websites from the purge and those two are Google.com and YouTube.⁴ The symmetry is what stings. In 2020 the report pointed to google.com, in the same write-up the behaviour extended to YouTube, and in 2026 the recurrence is being described in the same terms: Google sites exempted from a user-chosen deletion setting. There was a fix commit in the Chromium history from that era.⁵ That is why people at the time filed this as a bug that got fixed. The second time around lands differently precisely because we thought it was fixed. I reckon that is the real story here, not whether a cookie survives a restart but whether a browser that is also an ad platform can be trusted to apply its own privacy controls to itself.

There are fair pushbacks and I want to give them weight. The evidence I can quote is narrow. Johnson’s reproduction is on macOS, the write-ups do not give me a basis to claim the same behaviour shows on Windows, Linux or Android, and the mechanism for 2026 has not been established in the material I have seen, so I cannot honestly say the old hosted-app or protected-storage explanation applies again. It is also possible, in principle, that the new persistence comes from a completely separate code path that just happens to produce the same visible result, and if Google were to demonstrate that cleanly it would undercut the claim that the earlier fix was incomplete. I also have no basis in what I can cite to say what, if anything, Google does with any persisted google.com storage afterwards, whether it is used to re-identify you or just sits there inert. The early coverage framed it as potential rather than proven, and I am not going to upgrade a potential into a fact. And those broader juxtapositions floating around this week, like Google’s separate rollout of goto redirects for search results, are just that, juxtapositions.⁶ Timing is not causation.

Even with those limits, my read is that doubt is now the rational position. A privacy setting that advertises universal deletion and then quietly keeps exceptions for the vendor’s own domains fails the most basic test of equal treatment, and failing it twice makes the explanation matter more, not less. The 2020 incident could be carried as a bug. A recurrence six years later with the same shape, google.com and YouTube spared when the user asked for everything to be cleared, asks a harder question about whether the browser treats Google as just another site. I do not need to claim intent to find that troubling. Systems that repeatedly advantage their owner look the same from the outside as systems designed to advantage their owner. If Chrome wants the benefit of the doubt, it needs to show its work in public, with a named cause and a verifiable fix that leaves no carve-out for google.com. Until then I will treat that toggle as promising more than the code delivers, and I will tell friends to act accordingly.

Sources

• 1 Chrome exempts Google sites from user site data settings — lapcatsoftware.com
• 2 The Verge — theverge.com
• 3 Chrome again exempts Google from user site data settings — lapcatsoftware.com
• 4 When you tell Chrome to wipe private data about you, it spares two websites from the purge: Google.com, YouTube — theregister.com
• 5 8871292af7fd3e15e1dd5f53db317058f7091445 — googlesource.com
• 6 Google confirms deploying goto URL redirects to search results links — searchengineland.com