Local AI in your browser, the silent install: a disclosure checklist

Step 1, check your disk

Two commands. The first asks the file system whether the folder exists for any of your Chrome profiles and how big it is. The second confirms the actual weights file. No accounts, no extensions, no third-party tools. If both come back empty, your machine either never qualified for the rollout or you already disabled the toggle.

A note on the Edge path: it includes a literal space in Microsoft Edge, so when you adapt the command for Edge make sure your shell quoting preserves the space. Many copy-pasted Chrome guides break at this exact step on macOS.

Step 2, what the file actually is, and what to do about it

weights.bin is the serialized Gemini Nano model. It is what Chrome's Built-in AI APIs are supposed to call when a page or Chrome surface asks for a local-only completion. Hanff's forensics noted that some Chrome surfaces still route through Google's cloud even when the local model is resident on disk, so users were paying the storage cost without consistently getting the local-only privacy benefit. That decoupling, model on disk versus request stays local, is the part that makes a disclosure gap feel sharper than it would in a clean opt-in design.

To actually remove and prevent re-download, the trash bin is not enough. The Optimization Guide will refetch on the next eligible session. The full sequence is: Chrome Settings, AI or System subsection (the label has moved between Chrome 125 and 130), find the on-device AI toggle, switch it off, restart Chrome, then remove the folder. On older Chrome builds where the toggle has not landed yet, the workaround is chrome://flags, search for Optimization Guide On Device Model, set to Disabled, restart Chrome, then trash the folder. Edge has no consumer-facing toggle today; the enterprise lever is the Windows GenAILocalFoundationalModelSettings policy.

Step 3, the four-question disclosure test

Any tool that uses the words local AI in its marketing can be put through four small questions. The questions are not opinions, they are observable facts about how the tool ships and runs. The Chrome-on-Mac case fails three of the four. A well-disclosed local AI tool on the same machine should pass all four. Run them in order:

The contrast case: what a clean local AI tool on the same Mac looks like

Fazm is a macOS app I work on. It is a computer-use agent that drives the browser, writes code, edits documents, and runs Google Apps. It is in the same category as the on-device AI surface Chrome is shipping, in the sense that it runs locally, sees the screen, and takes actions. The interesting comparison is not the feature set, it is the disclosure shape, because both live on the same disk and both need permission to be useful. Here is the side by side, anchored on observable, file-level facts:

The Fazm column is not aspirational. Every row maps to a file you can read or a dialog you can see. The permissions screen lives at Desktop/Sources/MainWindow/Pages/PermissionsPage.swift in the open source repo. The public safety page is at fazm.ai/safety, linked directly from the in-app permission screen.

Scale, briefly

One person finding a 4 GB file in a profile folder is a footnote. Multiply by a Chrome install base in the billions and the same write becomes a real number. Hanff worked out the distribution side using public Chrome user estimates and standard datacenter carbon math:

Numbers are Hanff's; they assume a one-time distribution without accounting for delete-and-refetch cycles, which on the current Chrome behavior would push the real number higher.

What about the law

The argument Hanff and follow-up coverage make is narrow and worth stating cleanly. Article 5(3) of the ePrivacy Directive, 2002/58/EC, requires prior informed consent before storing data on a user's terminal equipment, with a tightly drawn strictly necessary exception. A 4 GB language model is not strictly necessary to load a web page. Article 5(1) of the GDPR requires lawfulness, fairness, and transparency. Article 25 requires data protection by design and by default. Opt-out toggles added eight months after rollout do not retroactively create consent for the install that already happened. Whether a regulator brings a formal case is a separate question, but the analytical gap between silent install and Article 5(3) is not subtle.

For consumer apps that ship outside the browser, the same principles push in a useful direction even when the apps fall outside the ePrivacy directive's exact scope. The cheapest way to stay safe is structural: route every persistent artifact through a macOS-drawn permission dialog, document what each one does in a public file, and make the in-app screen link to that file. None of that is hard. It is just a different default than the one Chrome picked.