Google is moving scam detection in Chrome's Enhanced Protection to its servers and additionally checks copied commands. For companies this means weighing the protection gain against the data transmitted. This article clarifies what Google documents, what is merely a vendor claim and what remains open.
New Chrome protection features at a glance
End of October 2026 the Chrome team presented new protection features in a post on the Google blog. They include Chrome Gemini scam detection, which will now work on the server side. In addition there is a clipboard check against so-called ClickFix attacks. According to the announcement, both apply only to Safe Browsing's Enhanced Protection, not to Standard Protection.
The announcement matters to admins and data protection officers for two reasons. First, it promises protection against a type of attack that bypasses classic download filters. Second, more data is transferred to Google to achieve it.
The following describes what has changed, which data Chrome transmits in Enhanced Protection, which policy fixes the operating mode and how the decision can be documented.
What Google changed in Chrome's scam detection
According to the Google blog, Chrome now has two warning levels: pages are classified as "suspicious" or "dangerous". The new "suspicious" level applies when Enhanced Protection is enabled. Google does not state the false alarm rate for this new category.
The second change concerns Gemini. Last year Chrome already deployed a Gemini-based detection of tech support scams locally on the device for Enhanced Protection users on supported devices. Now a more powerful Gemini model on Google's servers is added. According to the blog it assesses the brand shown, the intent of the page and a scam probability. Safe Browsing combines this result with the domain's reputation and other signals into an overall verdict. Fake antivirus alerts and fake browser updates are now covered as well.
The server-side analysis is to be extended to all users with Enhanced Protection enabled.
On data minimisation Google writes that page text is analysed only if a page shows very clear scam indicators. Transmitted content is said to be processed transiently, not logged, not stored and not used to train models. This is a vendor claim.
The marketing message is that Enhanced Protection users are "ten times safer" than with Standard Protection. This is a claim by Google. How the figure was determined could not be traced in the sources reviewed, and there is no independent verification. It is therefore only of limited use as a basis for decisions.
ClickFix protection: what happens in the clipboard check
In ClickFix, a user is tricked on a web page into running a command themselves. Typical is a fake check ("I am not a robot") or a supposed error message. One click copies a command to the clipboard, after which it is to be pasted into the Windows Run dialog, a terminal or PowerShell. The copied text often differs from what the page displays. Because the user starts the command themselves, many automatic protection mechanisms do not apply. Microsoft describes the technique in detail and considers it widespread. A more recent Microsoft post from August 2026 also covers a campaign of this kind.
This is exactly where the new Chrome feature comes in. If Chrome detects that a suspicious command has been copied by an Enhanced Protection user, the clipboard content is cleaned of personal data and sent to Safe Browsing for analysis. If the verdict is "dangerous", Chrome shows a warning. Google states the system is designed for high precision so as not to disturb legitimate developer activity where possible.
Two subtleties matter for the assessment. First, for the clipboard check the Google blog explicitly names Safe Browsing, not Gemini. Second, it remains open what exactly the cleaning removes, how a command is recognised as suspicious and how long Google keeps the data.
Safe Browsing Enhanced Protection: data protection and transmitted data
Which data Chrome transmits in each mode is described in the Chrome help page on Safe Browsing. In Standard Protection, Chrome compares visited addresses with a local list. An obfuscated part of the URL goes through a privacy server, and a small amount of visual features of pages is checked. In Enhanced Protection, Chrome shares more: visited URLs, a small sample of page content, downloads, extension activity and system information. If a Google account is signed in, this information is linked to the account.
New are the page text for strong scam indicators and the cleaned, suspicious command from the clipboard. The help page names neither a retention period nor different treatment of enterprise accounts. Whether managed profiles behave differently is therefore not documented.
Three points stand out from a data protection perspective. Linking to the Google account potentially turns technical data into employee data. Despite the cleaning, the clipboard can contain content not intended for third parties, such as internal identifiers or parts of configurations. And the detection logic runs entirely at Google, so its workings cannot be verified from outside.
Standard Protection has its own additional policy concerning the path of the obfuscated URL hashes. The policy definition SafeBrowsingProxiedRealTimeChecksAllowed
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
