Google wants to disable third-party tracking cookies used for ads in Chrome with the “Chrome Privacy Sandbox.” However, since Google is also the world’s largest advertising company, it doesn’t destroy tracking cookies without replacing them with something else. Google’s replacement plan is to let Chrome create an ad interest profile for you locally, through a system called “FLoC” (Federated Learning of Cohorts). Instead of letting advertisers collect your browsing history to build an individual profile of you on their servers, Google wants to keep that data local and let the browser display a list of your interests to advertisers when they request it through an API, so you still get relevant ads. Google states that enabling the browser for ad interest tracking is a privacy win as it keeps your exact browsing history local and only displays anonymized interest lists. However, Google doesn’t have many other companies in its corner.
One of the first to challenge Google’s plan was the EFF, which wrote a blog post in March titled “Google’s FLoC is a terrible idea.” The EFF appears to be completely against user tracking for ad, saying that Google’s framing of the problem is “based on the wrong premise that we have to choose between ‘old tracking’ and ‘new tracking’.”
“It’s not either-or,” the EFF writes. “Instead of reinventing the tracking wheel, we should imagine a better world without the myriad problems of targeted advertising.” The EFF is concerned that FLoC won’t stop advertisers from personally identifying people and that the API will display full profile data upon first contact with a site, eliminating the need for tracking companies to build a profile themselves over time. It also states that “the machinery of targeted advertising has often been used for exploitation, discrimination and harm.”
Google’s browser competitors have also come out against FLoC. Mozilla told The Verge, “We are currently evaluating many of the privacy-protective ad proposals, including Google’s, but have no plans at this time to implement any of them.” The Firefox developer continued, “We don’t believe in the assumption that the industry needs billions of data points about people, collected and shared without their understanding in order to deliver relevant ads.”
As for the other major independent browser vendor, Apple, it’s hard to imagine FLoC being on board, given the pro-privacy, anti-ad network it was in the past. While it has no official statement, Webkit (Safari’s rendering engine) Engineer John Wilander has said that the WebKit team “didn’t say we will implement” [FLoC] and we have our tracking prevention policy.”
How do Chromium’s many forks feel like for FLoC? A “no” here would mean getting the code from your browser’s codebase. The Verge also pinged Microsoft about his feelings and got a long, meandering response that I don’t think amounts to a clear “yes” or “no” to FLoC:
We believe in a future where the internet can provide people with privacy, transparency and control while supporting responsible business models to create a vibrant, open and diverse ecosystem. Like Google, we support solutions that give users clear consent and don’t circumvent consumer choice. That’s why we don’t support solutions that use unauthorized user identity signals, such as fingerprints. The industry is on a journey and there will be browser-based proposals that don’t require individual user IDs, and ID-based proposals that are based on consent and first party relationships. We will continue to explore these approaches with the community. For example, recently we were pleased to introduce one possible approach, as described in our PARAKEET proposal. This proposal is not the last iteration, but is a document under development.
Brave has an entire post on why it disables FLoC, saying it’s harmful to users and “a step in the wrong direction,” citing many of the same concerns the EFF has. The Vivaldi browser also has a blog post (and the image above) explaining why it doesn’t support FLoC, saying “Google’s new data collection venture is filthy” and “a dangerous move that harms users’ privacy.” .
There are some reports that WordPress, which powers about 34 percent of all websites on the web, will block FLoC, but that’s just a suggestion from one of the contributors. The founding developer of WordPress, Matt Mullenwegsays the company “hasn’t made any decisions or made any changes yet” on FLoC.
DuckDuckGo, one of Google’s search engine rivals, has also spoken out against FLoC and, in addition to disabling it on search pages, released a Chrome extension that blocks FLoC tracking across the web. I don’t think I’ve seen any company other than Google claim that FLoC is a great idea.
FLoC is currently rolling out as a trial in Chrome and will be enabled for “0.5% of Chrome users” as of March 30. The EFF’s Amiloced.org site will let you know if you’re one of the lucky few.
Part of the, uh, “magic” of Chrome is that if Google doesn’t see value in reaching an industry-wide consensus, Google doesn’t really need anyone else’s cooperation when it comes down to it. Chrome has about 70 percent of the browser’s market share. Google operates the world’s largest advertising network. These ads appear on some of the world’s most popular websites, which are also operated by Google, such as Google.com (#1 in the world) and YouTube (#2). The ads also run on the world’s most popular operating system, Google’s Android, which has more than 2.5 billion monthly active users. There’s also Chrome OS, which is now the second most popular desktop operating system and is particularly successful in schools. The company regularly sneaks its own web standards out of the Google ecosystem first, such as early rollouts of WebP, VP8/9 and SPDY/HTTP/2, and it could do the same with FLoC if it wanted to.