Google is probably the most aggressive anti-privacy big tech company currently operating.
No other big-tech company goes to such great lengths to deanonymize users and make its services difficult to use, especially during account creation.
The requirement to have a mobile device to scan a QR code to verify that you're human. Reverse SMS verification, where you have to send an SMS rather than receive a verification code. You think of signing up using a VPN server in another country? The phone number you use to send the SMS from must also be from that country.
Not being able to watch YouTube videos when using VPN - without signing in to a Google account, all under the guise of "bot protection."
Gemini not working in 3/4 of cases when using VPN.
It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.
I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities.
PS. The first company federal investigators often go for data is often Google
> It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.
I had a Gmail account before they required phone numbers. One day, Google stopped allowing me to log in, demanding my phone number if I wanted to continue. Nothing was wrong with my credentials, or behavior patterns, or IP address, or anything at all. My already-registered recovery email address didn't help. There was no way to appeal.
I'm not willing to have my phone number extorted from me, so I sighed and accepted that I'll never again have use of that account. It remains a constant source of irritation, because it still forwards incoming messages to my home email address, and Google doesn't do a very good job of filtering out all the spam before they forward it my way.
Adding insult to injury, Google still (years later) hasn't made good on their announcement that idle accounts would be deleted. I wish they would. I'm done with Google.
Trying to fight it takes an enormous amount of time and energy. I carry two phones now - since I have my "privacy" enabled phone that basically has nothing on it. Email, messages, weather app and a few privacy enabled browsers. My other phone has all my "faux" google stuff on it. Maps, gmail, banking apps, my authenticator apps, music apps, etc.
Even then, these can all be tied together fairly easy, but just trying to make it harder to keep my data private is such a battle; and friends always ask me why I spend so much time trying to keep myself anonymous when in 2026 its virtually impossible to do so.
I always tell them:
“Bene vixit, bene qui latuit.” (To live well is to live concealed.)
Having two phones is more common than you think, and has a very plausible explanation even if it's not true for the particular individual: One is my work phone, issued by my company, other one is mine
> I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities.
Every scammer, fraudster, scammer-in-training, fraudster-in-training, uses a Google account.
The first company federal investigators often go for data is often Google because that's the start of their lead into their investigation. Google needs to provide answers, sometimes by regulation in countries.
> It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.
A process I've gone through a few times (though I didn't actually want a Google Account):
1) Get a new (second-hand sometimes) ChromeOS or Android device.
2) (if necessary) do a power-wash or factory-reset.
3) Do the "set up a new device" process.
4) When it asks you for a Google account, click on the "I don't have one. create a new account" button.
In all these cases, the device didn't (or couldn't, in the case of the Chromebook) have a SIMcard in it, so it couldn't link it to a phone number.
One smartphone that I bought for $20, and never (IIRC) had a SIMCard in, I think the only identity-oriented app I have on it is Netflix. I've wondered if Google links the smartphone's google account to the Netflix account (which is actually not me, but a cousin's), and whether Netflix is complicit in this linking.
I imagine that Google is keeping a log of the ip addresses that phone reports when it's connected to wifi. I There's probably some overlay between you and your known associates / locations.
Have you noticed the front page article sharing front page real estate with this one about Big Tech getting in trouble for not doing more to stop scamming and fraudsters?
Regulators want Big Tech to stop children from doing various things (such as access certain platforms or content), to stop fraudsters and scammers, to stop foreign intelligence operations or bots from astroturfing social media/manipulating social discourse, and so on.
Failing to so leads to inquiries, new laws or regulations, fines, and so on.
The technical solutions to combat these problems are the exact solutions that also ruin privacy for users, create friction at account creation time, require ever more draconian identity verification methods and so on. It's 1:1.
"I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities."
It's really not any more complicated than that Governments have told them its time to start violating users privacy in order to combat these other problems.
It really bothers me that every dick and jane website has normalized asking for your personal phone number. It's the first thing they ask when you sign up. At this point your phone number has become your social security number of the internet.
I don't care if fighting fraud is hard for you. Figure it out without stripping away my privacy.
That's why I stay away from trying Gemini or doing anything much with Google until I still host my main gmail account there. One misstep and I'll find myself locked out. Because it's Google's job to spy on everyone, if I have other accounts there, those will also locked out too ("oh! you're trying to circumvent our ban? we noticed!" kind of a thing). Then the only recourse from what I understand is to make an HN post and hope it makes it to the front page and someone from Google who knows someone else at Google will help you.
Its taking me awhile (about a month so far) but Im migrating my Google Pixel 5A to Google Pixel 10 Pro and GraphenOS. Its a step but seriously worth it to avoid the Google stink. RFC messaging is the only real breakage Ive seen so far in that folks that have me in a group msg dont work any more (actually that COULD work as a feature and so far everyone Ive talked to that swear they sent a msg are iPhone users so it could be another Google-Apple pissing contest underway.
The biggest player in ad tech also being the biggest provider of mobile phone operating systems and web browser and email services was only ever going to end up this way. I'm not a big fan of regulation but at some point a single corporate entity should not be allowed to control all of the things.
Our corporate policy doesn't allow personal phones to be linked to corp accounts, for obvious reasons. We have no idea what kind of security your personal phone number has setup, nor do we compensate employees for their personal phones, nor do we want corporate communications happening on your personal device (work/life separation).
If the vendor is unable to comply, all we're using them for is email. Time to look elsewhere.
Just the other day I tried to log into the Google account I have connected only to this HN account, and Google asked me to use the account linked to the backup email address on that account to verify my login, then logged me into that account on my phone when I used it to verify my login. After that point I saw my phone number attached to the HN-specific Gmail account, though it may have been attached before.
All my SIMs I've used in my phone seem to have been added as verified phone numbers to my primary account, but my secondary accounts don't have any phone numbers still.
It's still somewhat obnoxious since it means random travel sims that could get reused after they expire are "verified" for my account.
Report to your state's privacy department (if applicable) and your Attorney General. No guarantees, but once it's in regulator hands, you can let them run with it.
Is it silent, though? I got notifactions about it on my devices, then emails on each account. Then I went straight to delete the added numbers and disabled this "feature". It did not leave a good taste that I had to do this after the fact, I would have appreciated a notice with a chance to opt out first, because they may have already permanently stored those numbers in some internal history (I just asked Dropbox for my data and they listed every single email I've ever used on that account too). But, to be honest, I am not surprised, and I already consider all devices and numbers that ever come into contact with a Google account being permanently on record on some Google server.
I don't think this is new. If you have ever gotten a "fuck off and die" letter from AdSense after like 2010 or so, then you know they will correlate your identity and ban your other accounts too. They don't ban accounts, they ban people.
I've also heard of people getting oopsied trying to farm the GCP demo credits and someone on HN once claimed that a company's gsuite tenant was actioned when they hired somebody on google's naughty list.
fuck. keeping your phone number off accounts is an important security step as many attacks require that you have a phone number connected.
If it's ever been on there you cant trust that some long forgotten recovery pathway can't be convinced to use it to authenticate access to your account.
Google is probably the most aggressive anti-privacy big tech company currently operating.
No other big-tech company goes to such great lengths to deanonymize users and make its services difficult to use, especially during account creation.
The requirement to have a mobile device to scan a QR code to verify that you're human. Reverse SMS verification, where you have to send an SMS rather than receive a verification code. You think of signing up using a VPN server in another country? The phone number you use to send the SMS from must also be from that country.
Not being able to watch YouTube videos when using VPN - without signing in to a Google account, all under the guise of "bot protection."
Gemini not working in 3/4 of cases when using VPN.
It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.
I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities.
PS. The first company federal investigators often go for data is often Google
> It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.
I had a Gmail account before they required phone numbers. One day, Google stopped allowing me to log in, demanding my phone number if I wanted to continue. Nothing was wrong with my credentials, or behavior patterns, or IP address, or anything at all. My already-registered recovery email address didn't help. There was no way to appeal.
I'm not willing to have my phone number extorted from me, so I sighed and accepted that I'll never again have use of that account. It remains a constant source of irritation, because it still forwards incoming messages to my home email address, and Google doesn't do a very good job of filtering out all the spam before they forward it my way.
Adding insult to injury, Google still (years later) hasn't made good on their announcement that idle accounts would be deleted. I wish they would. I'm done with Google.
Trying to fight it takes an enormous amount of time and energy. I carry two phones now - since I have my "privacy" enabled phone that basically has nothing on it. Email, messages, weather app and a few privacy enabled browsers. My other phone has all my "faux" google stuff on it. Maps, gmail, banking apps, my authenticator apps, music apps, etc.
Even then, these can all be tied together fairly easy, but just trying to make it harder to keep my data private is such a battle; and friends always ask me why I spend so much time trying to keep myself anonymous when in 2026 its virtually impossible to do so.
I always tell them: “Bene vixit, bene qui latuit.” (To live well is to live concealed.)
This all sounds completely sensible. And yet, being caught by the police with two phones would probably be a big stupid red flag for them.
Having two phones is more common than you think, and has a very plausible explanation even if it's not true for the particular individual: One is my work phone, issued by my company, other one is mine
That happens all the time
Unless you’re clever about setting up the phones to match your excuse, you are now lying to the police as well.
> I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities.
Every scammer, fraudster, scammer-in-training, fraudster-in-training, uses a Google account.
The first company federal investigators often go for data is often Google because that's the start of their lead into their investigation. Google needs to provide answers, sometimes by regulation in countries.
> It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.
A process I've gone through a few times (though I didn't actually want a Google Account):
1) Get a new (second-hand sometimes) ChromeOS or Android device.
2) (if necessary) do a power-wash or factory-reset.
3) Do the "set up a new device" process.
4) When it asks you for a Google account, click on the "I don't have one. create a new account" button.
In all these cases, the device didn't (or couldn't, in the case of the Chromebook) have a SIMcard in it, so it couldn't link it to a phone number.
One smartphone that I bought for $20, and never (IIRC) had a SIMCard in, I think the only identity-oriented app I have on it is Netflix. I've wondered if Google links the smartphone's google account to the Netflix account (which is actually not me, but a cousin's), and whether Netflix is complicit in this linking.
I imagine that Google is keeping a log of the ip addresses that phone reports when it's connected to wifi. I There's probably some overlay between you and your known associates / locations.
Even if they don't, the law enforcement definitely does (or rather requires your ISP to).
So depending on who you are trying to protect against you are in for varying amounts of fun.
> The requirement to have a mobile device to scan a QR code to verify that you're human.
FWIW I've never seen this.
It's required for setting up a new Youtube account now.
Have you noticed the front page article sharing front page real estate with this one about Big Tech getting in trouble for not doing more to stop scamming and fraudsters?
https://www.theguardian.com/us-news/2026/oct/14/dating-app-s...
Regulators want Big Tech to stop children from doing various things (such as access certain platforms or content), to stop fraudsters and scammers, to stop foreign intelligence operations or bots from astroturfing social media/manipulating social discourse, and so on.
Failing to so leads to inquiries, new laws or regulations, fines, and so on.
The technical solutions to combat these problems are the exact solutions that also ruin privacy for users, create friction at account creation time, require ever more draconian identity verification methods and so on. It's 1:1.
"I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities."
It's really not any more complicated than that Governments have told them its time to start violating users privacy in order to combat these other problems.
More data = better ad sales.
line go up
It really bothers me that every dick and jane website has normalized asking for your personal phone number. It's the first thing they ask when you sign up. At this point your phone number has become your social security number of the internet.
I don't care if fighting fraud is hard for you. Figure it out without stripping away my privacy.
That's why I stay away from trying Gemini or doing anything much with Google until I still host my main gmail account there. One misstep and I'll find myself locked out. Because it's Google's job to spy on everyone, if I have other accounts there, those will also locked out too ("oh! you're trying to circumvent our ban? we noticed!" kind of a thing). Then the only recourse from what I understand is to make an HN post and hope it makes it to the front page and someone from Google who knows someone else at Google will help you.
Its taking me awhile (about a month so far) but Im migrating my Google Pixel 5A to Google Pixel 10 Pro and GraphenOS. Its a step but seriously worth it to avoid the Google stink. RFC messaging is the only real breakage Ive seen so far in that folks that have me in a group msg dont work any more (actually that COULD work as a feature and so far everyone Ive talked to that swear they sent a msg are iPhone users so it could be another Google-Apple pissing contest underway.
The biggest player in ad tech also being the biggest provider of mobile phone operating systems and web browser and email services was only ever going to end up this way. I'm not a big fan of regulation but at some point a single corporate entity should not be allowed to control all of the things.
Our corporate policy doesn't allow personal phones to be linked to corp accounts, for obvious reasons. We have no idea what kind of security your personal phone number has setup, nor do we compensate employees for their personal phones, nor do we want corporate communications happening on your personal device (work/life separation).
If the vendor is unable to comply, all we're using them for is email. Time to look elsewhere.
Just the other day I tried to log into the Google account I have connected only to this HN account, and Google asked me to use the account linked to the backup email address on that account to verify my login, then logged me into that account on my phone when I used it to verify my login. After that point I saw my phone number attached to the HN-specific Gmail account, though it may have been attached before.
Very unexpected behavior, esp for those with several accounts and phone numbers, intending to keep them separate for security or other reasons.
People who want security don't use multiple google accounts tho.
Yay surveillance state pushed by ad tech!
Um, I think you mean convenience at the cost of privacy, which most people have no problem with, unfortunately.
Think of how nice this will be for all the people who don't care and have given up! So convenient.
This isn't the behavior I observe on my phone.
All my SIMs I've used in my phone seem to have been added as verified phone numbers to my primary account, but my secondary accounts don't have any phone numbers still.
It's still somewhat obnoxious since it means random travel sims that could get reused after they expire are "verified" for my account.
This is an outrageous privacy invasion and if it's not illegal already, it should be.
Report to your state's privacy department (if applicable) and your Attorney General. No guarantees, but once it's in regulator hands, you can let them run with it.
https://www.naag.org/find-my-ag/
Is it silent, though? I got notifactions about it on my devices, then emails on each account. Then I went straight to delete the added numbers and disabled this "feature". It did not leave a good taste that I had to do this after the fact, I would have appreciated a notice with a chance to opt out first, because they may have already permanently stored those numbers in some internal history (I just asked Dropbox for my data and they listed every single email I've ever used on that account too). But, to be honest, I am not surprised, and I already consider all devices and numbers that ever come into contact with a Google account being permanently on record on some Google server.
I think it's creepy and bad, but "silently" is not accurate, at least in my case: Google sent each of my accounts an email telling me about it.
That's mighty generous of them. Does the mail contain an opt-out link?
More companies have my phone number than not..
I don't think this is new. If you have ever gotten a "fuck off and die" letter from AdSense after like 2010 or so, then you know they will correlate your identity and ban your other accounts too. They don't ban accounts, they ban people.
I've also heard of people getting oopsied trying to farm the GCP demo credits and someone on HN once claimed that a company's gsuite tenant was actioned when they hired somebody on google's naughty list.
No shit
"Silently" has been redefined to mean "we know this because of the emails it sends".
fuck. keeping your phone number off accounts is an important security step as many attacks require that you have a phone number connected.
If it's ever been on there you cant trust that some long forgotten recovery pathway can't be convinced to use it to authenticate access to your account.