Back to Devoured - May 07, 2026
DEVOURED
Google's Prompt API

Google's Prompt API

Tech aisecurityweb-standardsgoogle
Google shipped Prompt API over Mozilla and WebKit objections, forcing a 4GB Gemini Nano download on all Chrome users that any website can access without permission.
What: Chrome now auto-downloads Google's 4GB Gemini Nano model (re-downloads if removed) and exposes it via the Prompt API that requires developers to agree to Google's prohibited use policy. The spec was opposed by Mozilla, WebKit, and W3C TAG but shipped anyway based on claimed developer interest from a 3-comment thread with 2:1 dislike ratio and unverified survey showing '8.0 satisfaction.'
Why it matters: This sets precedent for bundling proprietary products into web standards, letting platform vendors bypass consensus by claiming developer interest. Gemini Nano is the only model exempted from permission requirements in the spec Google wrote.
Deep dive
  • Chrome now includes Gemini Nano (4GB) as part of the browser itself, auto-downloading without user permission and re-downloading if removed
  • Using Prompt API requires developers to agree to Google's prohibited use policy for Gemini Nano
  • Mozilla and WebKit explicitly opposed the standard, W3C TAG expressed deep concern, but Google shipped anyway
  • Google cited developer interest from a thread with 3 comments (2:1 dislike ratio) and vague survey results showing '8.0 satisfaction'
  • Gemini Nano is the only model that doesn't require explicit user permission to download per the spec Google wrote
  • Any website can send prompts to installed models without requesting permission, raising fingerprinting concerns
  • Models provide unique fingerprinting vectors (e.g., 'LLM model available only to logged-in Facebook users released on May 6th')
  • Google's own AI services in Chrome (typing help, page summaries) continue making requests to Google servers rather than using local models
  • Author Mat Marquis calls it 'the most insultingly transparent attempt at web standards bullying' worse than AMP or Manifest V3
  • Compares it to hypothetical where Geolocation API required agreeing to Google Maps terms, or img tags requiring HTML Embedded Media terms
Decoder
  • AMP (Accelerated Mobile Pages): Google's controversial web framework that required publishers to serve stripped-down versions of pages through Google's servers to get preferential treatment in mobile search results, positioned as improving web performance while funneling traffic through Google infrastructure.
  • Manifest V3: Chrome extension platform overhaul that severely limited ad-blocking capabilities by restricting how extensions can intercept network requests, officially justified as improving privacy and performance.
  • W3C TAG (Technical Architecture Group): Advisory body that reviews web platform proposals for architectural consistency and potential harm to the web.
  • Fingerprinting: Technique for tracking users by combining multiple browser characteristics into a unique identifier, often used to bypass cookie-based privacy protections.
Original article

Google's Prompt API is a web standard that requires users to agree with Google's 'prohibited use policy' to use the only model available to it.

Explore all 73 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi