If you follow technology news, you might have heard about Google’s new ad targeting technology called FLoC, which stands for 'Federated Learning of Cohorts'. The proposed technology is supposed to replace third-party tracking cookies by letting the web browser create a profile of interests while surfing the web. Each user is put into multiple interest groups or cohorts and the web browser transmits a cohort ID to visited websites, indicating which group they belong to, who in turn could use them for targeted advertising. Google has recently started to test FLoC with a limited number of Chrome users, but many other web browsers have announced to not support the technology. Among others, the companies behind Brave and Vivaldi heavily criticized the feature. DuckDuckGo even updated its browser extension to block it. On the other hand, WordPress may automatically disable Google FLoC on websites as stated by the company in their blog post quoting "WordPress powers approximately 41% of the web – and this community can help combat racism, sexism, anti-LGBTQ+ discrimination and discrimination against those with mental illness with four lines of code,". You could say Google was FLoC blocked...
Why is there so much controversy about a feature that Google presents as the solution to many online privacy issues? Let's have a closer look.
Google claims, FLoC is built with privacy in mind and according to the Electronic Frontier Foundation, FLoC would indeed avoid the privacy risks of third-party cookies, but it would also create new ones in the process. FLoC could make fingerprinting much easier. Fingerprinting gets easier, the more your browsers look unique, different from others. Since FLoC cohorts most likely each consist of a few thousand browsers, a tracker could get a massive head start. It only would have to distinguish these few thousand users in the same cohort instead of a few hundred million across the web.
Google's proposal could also reveal more information than intended. It would be very conceivable that specific types of people would fall in similar cohorts which means it would likely be possible to infer age, gender, ethnicity, political orientation and so on, even without learning these characteristics directly. It also would lower the bar for many more websites to deploy targeted ads.
No one would have to do the work of tracking users anymore because every website that wants it would be served, what is essentially, a user’s recent browsing activity. While the algorithm to create the cohorts is supposed to run unsupervised, Google already announced the need for a central authority to adjust several parameters like the cohort size or unwanted correlations between cohorts continuously. It is unsurprising that the company would like to see itself as that powerful central authority.
Google Chrome has an enormous market share and is currently the only browser willing to use FLoC. Other Chromium browsers have disabled the feature and other companies like Apple and Microsoft also have their own proposals for the future of online advertising. Microsoft is looking forward to implementing PARAKEET proposal to counter Google's FloC technology. Google's dominant position gives them a lot of power for influencing that future but it's important to recognize: They are presenting a false dilemma.
Why would users have to choose between “Old tracking" and "New tracking"?
Mozilla's statement on FLoC reflects this as well. They believe advertising and privacy can co-exist, without billions of data points. We should all hope that these companies come to an agreement though because otherwise, it could lead to websites that are only compatible with specific browsers, the complete opposite of a free web. Until we get a result, website owners are able to effectively exclude their site from calculations of the FLoC ID by adding Permissions-Policy: interest-cohort=() this piece of policy into the site header. Apart from that, average users can only wait and see what the internet looks like after the dust from the so-called Cookiepocalypse has settled.