Chrome sync quietly joins accounts you meant to keep apart

Chrome sync works per profile, not per account. A Chrome profile syncs to the one Google account you signed in to Chrome with, and everything that profile does goes to that account: history, saved passwords, bookmarks, extensions, open tabs, settings. Sign a second Google account in to the same profile through Gmail's account switcher and its browsing is filed under the first account too. That is the most common way two accounts get joined, and fingerprints have nothing to do with it.

Chrome sync with multiple Google accounts: one sync account per profile

Chrome has two kinds of sign-in, and they look alike.

Signing in to Chrome, from the profile button at the top right, picks the account the profile syncs to. There is one per profile. Chromium's design notes on multiple users say that when a user syncs, the profile's apps, autofill, bookmarks, extensions, passwords, preferences and themes are associated with the signed-in Google account and stored off the computer.

Signing in to a Google website, such as adding a second account in Gmail's switcher, is only a web session. It puts a second set of cookies into the same profile's cookie jar. It does not change the sync account and cannot, because sync belongs to the profile.

How it works: Local first

What the second account leaves in the first

Say a profile syncs to your personal account, and you add a client's account in Gmail to answer one email. From that point, inside that profile:

• Every page you open is saved in the profile's history, so with history sync on, the client's Drive files, its ad dashboard and the sites you visited for it all go into your personal account's synced history.
• A password you save for one of the client's tools goes into your personal account's password manager, and then to every computer where you sign in to Chrome.
• An extension you install for the client's work is installed for you, and appears on your other computers.
• Both accounts share one cookie jar. Google's account switcher can list them together because both sessions sit in the same browser, so the pairing is visible to Google by design.

None of this is a leak or a bug. It is sync doing what it says, across a boundary the person never meant to draw.

The reverse direction

It also runs the other way. Sign in to Chrome as the client in a profile that already holds your own data, turn sync on, and what was already there, your bookmarks and saved passwords included, goes up to the client's account. When Chrome offers to put a newly signed-in account in a profile of its own, that offer is the one to take.

The free fix: one Chrome profile per account

Chrome already has the right tool. Make a separate Chrome profile for each Google account, from the profile button and Add, and sign in to Chrome in each one with its own account, or not at all. Each profile then keeps its own sync, cookies, history, passwords and extensions. For a client whose access you hold through a Workspace address, the Workspace approach to client separation keeps your agency from ever holding the client's password in the first place.

What a Chrome profile does not separate is the computer. Every profile on one machine runs the same browser on the same hardware and leaves from the same network, so a site that reads the fingerprint or the IP sees one device behind both accounts. Sync is the link you make yourself, much like Meta's Accounts Center; the device is the one you make without noticing, and how to manage multiple accounts without getting linked goes through each signal a site compares.

How Mosaic handles sync

Every Mosaic profile runs in Tesseract Chrome, our own Chromium, and the engine launches each one with --disable-sync. A profile never syncs anywhere, so there is no sync account to collect two accounts' history. You can still sign in to Google inside a profile. Its cookies stay in that profile's jar, beside its own fingerprint and its own proxy exit, and the profile itself stays on your computer (local-first has what is kept where). A Google account that sees a sign-in from a profile it has never met may ask you to confirm it; why Google says "verify it's you" explains what it is comparing.

Use it on accounts you are allowed to run. One Google account per person and per client, each in its own profile, is also the arrangement Chrome's own profile menu is built around.