TL;DR, they claim that this header is sent to all Google-owned domains, and describes the feature flags that your browser has enabled, and it doesn't contain any PII.
I guess the closest thing to a defence to your argument one could mount is "That's not true, Chrome sends it to all Google-owned domains!" which is... not a defence.
TL;DR, they claim that this header is sent to all Google-owned domains, and describes the feature flags that your browser has enabled, and it doesn't contain any PII.
Oh wait
They backpedalled on this by removing from the whitepaper their claim that the X-Client-Data field doesn't contain PII: https://vpnoverview.com/news/google-backpedals-on-claim-that...
Sigh.
I guess the closest thing to a defence to your argument one could mount is "That's not true, Chrome sends it to all Google-owned domains!" which is... not a defence.