Tired of Copilot? At Least Microsoft Told You.

Let's be honest about something first. Google has always collected everything — your searches, your location, your watch history, what you hovered over, how long you paused. That's not news, and if you're reading this series it's not a surprise. But Google has also, in their fashion, generally told you. Badly. Buried in a Terms of Service document nobody reads, tucked into a privacy dashboard that gets reorganized every year, hidden behind a setting that gets renamed whenever enough people find it. Technically disclosed. Practically invisible. It's a fig leaf, but they've usually bothered to plant one.

Microsoft, meanwhile, has been obnoxious about it in the opposite direction. Researcher Tey Bannerman counted eighty instances of the Copilot brand across Microsoft's apps and services. You couldn't open Notepad without tripping over an AI button. You knew exactly what Microsoft was doing because they wouldn't shut up about it. Annoying. User-hostile in its own way. But visible.

So here's what's notable about what Chrome did. Not that Google collected something — they always collect something. Not that it's buried in settings — it's always buried in settings. What's notable is that this time, Google didn't bother with the fig leaf at all.

Chrome — the browser running on roughly two out of every three computers on the planet — quietly wrote a 4 GB file to your disk. No button. No notification. No dialog box. No entry in a privacy dashboard. Just a file called weights.bin, in a folder called OptGuideOnDeviceModel, containing the full weights for Gemini Nano, Google's on-device language model.

Chrome didn't ask. Chrome didn't tell you. If you found it and deleted it, Chrome downloaded it again.

Privacy researcher Alexander Hanff caught this on a machine that had received zero human input — it was running automated audits, no one had ever clicked anything in the browser. Fourteen minutes and twenty-eight seconds after the profile was created, 4 GB of AI model weights had materialized on the disk, confirmed by four independent evidence trails: macOS's own kernel-level filesystem log, Chrome's per-profile state files, Chrome's runtime feature flags, and Google's component updater logs. The browser reached into the machine and planted a language model while a tab was sitting idle waiting for a timer to expire.

Here's the part that sharpens it further: the most visible AI feature in Chrome — the "AI Mode" pill sitting right there in your address bar — doesn't use this model at all. Every query you type into it goes straight to Google's servers. The 4 GB file powers features buried in right-click menus that most users will never consciously invoke. You paid the storage cost. You paid the bandwidth cost. The AI surface you can actually see still phones home regardless.

The local model isn't your asset. It's Google's asset, staged on your hardware, at your expense, for their future convenience.

And unlike every other thing Google does with your data — the ad targeting, the location history, the Gemini training defaults — there's no privacy setting for this. No toggle. No dashboard entry. No Terms of Service clause you could theoretically find if you went looking. The fig leaf wasn't buried this time. It just wasn't there.

To their credit — and I don't say that often — Microsoft eventually heard the noise about Copilot. Pavan Davuluri's March commitment to pull it back from the more absurd outposts, fewer upsells, less AI jammed into tools that had been working fine since 1985 — I covered the details and my skepticism about whether it sticks over here. The short version: the leopard may or may not change its spots, but at least it heard you yelling at it. Whether they actually follow through is yet to be seen — and to be clear, Microsoft doesn't get a clean bill of health in this series. What they did with GitHub and what they built with Recall are in the record. This is a narrower point: they were loud about Copilot, they got yelled at about Copilot, and there is at least a version of events where some of it gets walked back. That feedback loop exists. With Google and Chrome, it doesn't.

On Windows, paste this into File Explorer's address bar: %LOCALAPPDATA%\Google\Chrome\User Data\OptGuideOnDeviceModel — if the folder exists with a weights.bin inside, that's it. On Mac, look in ~/Library/Application Support/Google/Chrome/[Profile]/OptGuideOnDeviceModel/. You can also type chrome://on-device-internals into the address bar and Chrome will show you the model status directly.

Deleting the file buys you temporary disk space — Chrome will re-download it. To make it stick, go to chrome://flags/, search for "optimization guide on device," disable it, restart Chrome, then delete the file. That holds for now, though Chrome flags have a history of resetting themselves. The more permanent solution on Windows involves a Registry policy entry, which Pureinfotech walks through if you're comfortable in regedit.

One piece of good news: this is Chrome-specific. Other Chromium-based browsers like Brave, Edge, and Vivaldi don't receive this download automatically — and non-Chromium browsers like Firefox and its forks, Safari, and Orion are architecturally removed from it entirely. Whatever your reason for already having switched away from Chrome, you're clear on this particular one (and honestly...I'd personally suggest looking into degoogling).

If you're thinking about switching altogether, the landscape in 2026 looks roughly like this — not a recommendation, just the map:

Vivaldi has staked out the most explicit position of anyone. CEO Jon von Tetzchner put it plainly last August: "Today, as other browsers race to build AI that controls how you experience the web, we are making a clear promise: We're taking a stand, choosing humans over hype." Also Chromium-based, also supports Chrome extensions. The customization depth is genuinely impressive — if you're the kind of person who wants to tune every detail of how your browser behaves, Vivaldi was built specifically for you. The tradeoff is the UI layer is proprietary even though the engine underneath isn't, and it requires more configuration to reach strong privacy defaults out of the box.

Brave is another Chromium-based option with privacy protections on by default and Chrome extension compatibility. That said, it has some history worth knowing about. In 2020 it was caught silently rewriting URLs to major crypto exchanges with affiliate links that earned Brave commissions — without telling users. CEO Brendan Eich called it a mistake, reversed it, and moved to opt-in. There's also a built-in crypto wallet and a rewards model that some find useful and others find an odd fit for a browser that markets itself on privacy. It's a meaningful upgrade over Chrome, but it isn't without its own baggage — and Eich is a polarizing figure for reasons that go well beyond browsers.

Firefox gets you off the Chromium engine entirely — it runs Gecko, Mozilla's own engine, which means architectural distance from Google's stack at a fundamental level, not just a reskin. That said, Mozilla is doing their own AI pivot. New CEO Anthony Enzor-DeMeo declared Firefox would evolve into a "modern AI browser," which went over about as well as you'd expect with Firefox's user base. To their credit, the backlash produced something concrete: starting with Firefox 148, there's a "Block AI enhancements" toggle in settings that disables all current and future AI features — and Mozilla says it won't show pop-ups or reminders about them either. They got yelled at, they added a kill switch. At least the feedback loop exists. For the truly committed there are forks like LibreWolf that strip even further back, if you want Firefox's engine without any of the corporate AI ambitions attached.

Edge swaps Google's silent installs for Microsoft's Copilot integration, which depending on your feelings about that particular series of posts may or may not feel like progress. But there's a newer wrinkle worth knowing about before you migrate your passwords there. Researcher @L1v1ng0ffTh3L4N disclosed last week that Edge decrypts every stored password into cleartext process memory the moment the browser launches and keeps them there for the entire session — regardless of whether you ever visit the sites those passwords belong to. Edge was the only browser tested that exhibited this behavior. Chrome decrypts passwords only on demand and uses App-Bound Encryption to tie the decryption keys to the browser process. When the researcher reported it to Microsoft, the official response was that the behavior is "by design." So: Copilot everywhere, and your password vault sitting in plaintext in memory from the moment you open the browser. If you do use Edge, at minimum use a dedicated password manager instead of the built-in one.

One to watch, not quite yet: Orion, made by Kagi, is worth keeping an eye on for the right kind of reader. It's built on WebKit rather than Chromium — so like Firefox, genuine architectural distance from Google's stack, not just a reskin. Zero telemetry by design, no hidden anything, funded directly by users rather than ads or data deals. Orion 1.0 launched for macOS in November 2025 and is stable on Mac, iPhone, and iPad. Windows is in active development targeting late 2026. Linux just hit public beta in March. So if you're not on a Mac right now it's not a daily driver yet — but it's the most principled new entrant in this space in a while and worth watching as it matures. Kagi also runs a paid privacy-focused search engine if you want to go the whole way down that road.

Where you land depends on what trade-offs you can live with. But "the browser I've always used that never asked me anything" is increasingly not the neutral default it used to feel like.