Are There Any Privacy Risks To Google’s New Auto Fill Features?

Google has rolled out an update to its Chrome browser that lets users autofill more personal information than before. The update allows users to automatically fill in passport numbers, driver’s licence details and vehicle information such as registration numbers or VINs.

While it promises convenience, the expansion does make one wonder about how safely this data is stored and shared…

Google said the new feature is available globally for desktop users who have enhanced autofill switched on. The browser already fills in saved passwords, addresses and card details, but now it can handle more sensitive information. Chrome reads the form fields, matches them to stored data, and fills them in once the user confirms.

Google explained that this system depends on the browser recognising the structure of a form rather than collecting personal data directly. Chrome sends the layout and field labels to Google, which returns suggestions for matching information.

The company said this exchange does not include personal details like names or numbers. Instead, generic labels such as “first name” or “passport number” are used, and Chrome adds random data to the form information it sends to avoid any link to private user data.

Users are told they have to give permission before Chrome saves or uses this information. Each time the browser fills in a form, it asks the user to confirm, which Google says keeps the user in full control.

What Data Does Chrome Actually Share With Google?

When users fill in a form or submit one, Chrome sends structural details about it to Google to improve prediction accuracy for future forms. This includes field names, labels and whether the fields were for passwords, card numbers or identity documents. Google said these records help improve autofill’s ability to match the right data type to each field across websites.

The company also uses randomisation to disguise any identifiers within the form labels and attributes. This process, which Google calls “adding noise,” is designed to make sure that Chrome cannot transmit identifiable personal data. In the case of payments, Chrome may collect information about the user’s device and share it with Google Pay for fraud prevention, but this exchange is linked to card protection rather than advertising or analytics.

For saved passwords, Chrome applies encryption and stores them either on the user’s device or in their Google Account if they are signed in. When a password is used, Chrome can check if it has been compromised, match it only to the correct website and verify the user’s identity through fingerprint, face scan or account login. Google said this security system prevents unauthorised access and phishing attacks.

Can Users Delete Or Control What Chrome Stores?

Chrome users can manage all stored data in the browser’s settings. Passwords, addresses, payment details and autofill data can be deleted at any time. When deleted while signed in, that information disappears across all devices connected to the same Google Account.

For users who store payment information through Google Pay, there is a separation between Chrome and Google Pay storage. Deleting payment data in Chrome does not automatically remove it from Google Pay, which has its own controls. Chrome also limits what it keeps locally… For example, if users do not agree to save a full card number, the browser only remembers the last four digits to avoid asking about the same card again.

Google said it uses on-device encryption, depending on the operating system, to protect stored information. For mobile devices that use cameras to scan cards, that information is only saved locally on the phone. Users can turn autofill off entirely if they prefer not to store sensitive information.

Is Storing This Kind Of Data Risky?

While Google describes the system as private and encrypted, some users may wonder whether any collection of passport or driver’s licence details should be managed through a browser. Chrome’s structure relies on transmitting form information to Google to improve autofill accuracy, which technically means metadata about these forms still travels through Google’s servers.

The encryption and confirmation processes are intended to reduce that risk, but users who share devices or accounts may find these protections less reliable if someone else has access. Even though Google says the transmitted data is anonymised, the fact that Chrome sends and receives information about form structures could stress privacy-conscious users out.

Of course, the feature adds elements of speed and convenience for those who trust Chrome’s systems. But for users who prefer not to let their browser handle passport or driver’s licence numbers, it may be wiser to keep autofill disabled for now. The convenience of quick forms might not outweigh the unease of storing sensitive identity details inside a browser.