Slashdot user "Dwonis" drew my attention to a page by Dwayne C Litzenberger where he demonstrates how easy it is to change the Google preferences of a person who visits your website:

dlitz.net/stuff/xsrf/

Dwayne's example comprises this "harmless-looking" link:
dlitz.net/stuff/xsrf/poodles/
which when clicked will change your Google language to Irish. Dwayne also provides a link to switch back to English:
google.com/setprefs?hl=en& ...

So the problem here is that you can change the settings using a GET.

You can also load an URL like this in a hidden iframe, right?

google.com/setprefs?hl=fr& ...