Google Chrome is automatically downloading and storing a 4 GB Gemini Nano AI model on users' machines without an explicit consent prompt, according to an investigation published by privacy researcher Alexander Hanff on That Privacy Guy. Hanff's technical audit, based on macOS kernel logs, found the browser background-fetches the multi-gigabyte file even on freshly created, inactive profiles with no user interaction.
What the investigation found
According to Hanff's report, Chrome delivers the model files to a directory named OptGuideOnDeviceModel, which contains a roughly 4 GB binary named weights.bin — the parameter weights for Google's Gemini Nano model, which Chrome uses to power on-device features like "Help me write" and built-in scam detection.
Hanff says verification via macOS .fseventsd filesystem event logs showed Chrome spawning background unpacker subprocesses (com.google.Chrome.chrome_chrome_Unpacker) to fetch and extract the model. In his test on a new profile, he reports the full download completed in roughly 14.5 minutes while the browser sat idle, with no opt-in prompt or notification shown to the user.
Hanff also reports that manually deleting the directory offers only temporary relief: once removed, Chrome's variation servers reportedly recognize the profile's eligibility and trigger a re-download during a later idle window. He cites four pieces of evidence for the mechanism: kernel event logs showing background file creation; Local State profile JSON files recording hardware and VRAM data ahead of feature activation; a feature flag (OnDeviceModelBackgroundDownload) that appears to trigger installs alongside the flag exposing the relevant settings panel; and GoogleUpdater fetching a small control file that instructs Chrome's installer to pull the weights from Google's CDN.
According to Hanff, users who want to stop the re-download cycle currently have to use enterprise policy tooling, modify hidden chrome://flags settings, or uninstall the browser entirely.
Regulatory and environmental questions raised
Hanff argues the deployment may run afoul of European rules, including Article 5(3) of the ePrivacy Directive and GDPR transparency and lawfulness principles, though this is his own legal assessment rather than a regulatory finding. He also estimates that pushing multi-gigabyte payloads across Chrome's user base of billions could generate a wide range of additional carbon emissions — his figures span an order of magnitude, from roughly 6,000 to 60,000 tonnes of CO2-equivalent per major model push — underscoring that this is a rough estimate rather than a measured figure.
Google has not publicly responded to the specific claims in Hanff's report as far as this article's sourcing shows.