01 / Field notes
Executive Summary
“On-device” describes where a particular computation happens. It does not describe every part of an application. A browser may execute a model locally while the surrounding website records prompts, synchronizes history or sends a failed request to a cloud service. Conversely, a network connection used to download model files does not by itself mean the user's prompt was uploaded.
Chrome's built-in AI documentation describes browser-managed models and APIs, with availability depending on the feature and environment. [1] Treat that as a capability description, not a privacy certification for every application that uses those APIs.
The useful question is specific: for this feature, version and configuration, what information crosses which boundary? This guide supplies an original inspection method using synthetic text rather than personal documents.
02 / Field notes
Prerequisites / Lab Setup
Use a fresh browser profile and a test account with no sensitive history. Prepare a harmless sentence containing a unique invented phrase. Record browser version, operating system, application version, selected feature and whether the model has already been downloaded. Availability can vary; do not assume that a feature works identically across browsers or devices.
Open the browser's network tools before the exercise and keep their output private. Requests may contain account identifiers or tokens even when the test text is harmless. Inspect only applications and accounts you are authorized to evaluate. Separate initial setup from later inference so model downloads do not obscure the task's own traffic.
03 / Field notes
Technical Analysis
Draw five distinct data paths
Start with model acquisition, inference, telemetry, synchronization and fallback. A single privacy label usually hides these distinctions. Ask the provider which features are local, which require an account and what happens when the local model is unavailable. Then compare the documented behavior with controlled observations.
| Path | Question | Useful observation |
|---|---|---|
| Model download | What is retrieved before first use? | Download happens before the synthetic prompt exists |
| Inference | Where is this task processed? | Local feature completes under its documented conditions |
| Telemetry | Are content or diagnostic events transmitted? | Request destinations and documented event fields |
| Synchronization | Is history copied to another account or device? | Test history appears only where expected |
| Fallback | What happens if local execution fails? | Clear failure or an explicitly disclosed alternative |
Do not infer content upload solely from a large response or a familiar analytics domain. Inspect what the tool actually exposes, and label encrypted or opaque application payloads as unresolved when you cannot determine their contents. An honest unknown is more useful than a fabricated clean bill of health.
Test a failure path, not only the happy path
In a fictional note-taking application, summarization works locally after a model download. The product also offers a “higher quality” mode that uses a remote service. A privacy review must distinguish those modes and determine whether switching occurs automatically, through an explicit choice or after a failure.
Repeat the synthetic task with the network unavailable after setup, where the documented feature permits that test. Record whether the operation completes, fails clearly or queues work. Restore connectivity and observe whether queued activity occurs. This is a bounded observation, not proof that every future action remains local.
For an application you build, make fallback a deliberate product decision. If a user selects local processing for privacy reasons, silently uploading the same content when local processing fails defeats that expectation. Prefer a clear explanation and an explicit choice before changing the processing location.
Review the data around the model
Browser extensions, crash reporting, form autosave and account history can affect the same text independently of inference. Review permissions and storage behavior alongside the model. A local model cannot protect a document from another application component that is already authorized to read and transmit it.
NIST's generative-AI profile frames privacy and information-security risks as properties of a system and its use, not just model quality. [2] Apply that perspective to retention: where does the prompt remain after the tab closes, and can the user remove it through supported controls?
Plan for changing capabilities
Browser-managed models and APIs will evolve. Record the tested version and repeat the review after a material feature or privacy-policy change. Avoid a permanent “100 percent private” badge based on one successful offline demonstration. A more useful statement describes the processing mode, documented network dependencies and limits of the inspection.
04 / Field notes
Mitigation / Defense
- Test with synthetic content and distinguish initial model download from inference traffic.
- Map telemetry, synchronization and fallback separately from the local model execution path.
- Require an explicit user decision before a privacy-sensitive local task changes to remote processing.
- Review extension permissions and stored history as independent exposure paths.
- Document unresolved observations and retest the relevant behavior after updates.
For browser-level access, use the extension permission guide. For removal of stored AI data, follow the deletion lifecycle. These checks help evaluate a particular workflow; they are not an endorsement of a browser or a guarantee against every data leak.
05 / Field notes
References
Sources checked 28 October 2026. Chrome documentation is feature-specific and may change. The note-taking application and network test are illustrative, not results from a measured product audit. No claim is made about all browsers, all local models or undisclosed vendor telemetry.
- Built-in AI in Chrome ↗Chrome for Developers · accessed 2026-10-28
- AI RMF: Generative Artificial Intelligence Profile ↗NIST · accessed 2026-10-28
Questions readers ask
Does on-device AI mean the application never uses the internet?
No. Model downloads, updates, telemetry, account synchronization and other application features may use the network. Review each path separately.
Does an offline test prove complete privacy?
No. It shows behavior during that test. A queued event, later synchronization or a different feature can still create a separate data path.
About this edition: Articles include AI-assisted drafting and editing. Conceptual illustrations are not evidence of a real incident or product test. Read our sourcing and review standards.
Research improves with scrutiny. Send a correction with the article URL and supporting evidence.
Contact the editorial desk ↗
