Difference between revisions of "FLoC (Federated Learning of Cohorts)"

Revision as of 18:58, April 28, 2021

FLoC (Federated Learning of Cohorts) is a targeted advertising technology developed by Google, for the Chromium browser. It is designed to allow a website to perform targeted advertising for anyone who visits that site, but without specifically identifying the individual visitor. When Google released this, they marketed it as a more "privacy-focused" method of targeted advertising, as opposed to using third party trackers.^[1]

How it works

With FLoC installed on each users' Chromium browser, the system monitors each person's browsing behavior, and learns their individual interests. That user is then assigned identifiers for specific groups (called "cohorts") of people with similar interests. So for example, someone who's browsing activity shows interest in cats, residential construction, cars, Christianity, Libertarians, and fishing will in this case be assigned six identifiers. When this person visits example.com, FLoC freely informs that website this this visitor is interested in these six things. Then, example.com can display advertisements related to those six topics. Google's goal is to have each FLoC ID used by about 1000 people, so in theory, although a visitor is declaring their interests to every website they visit, this information is not directly tied back to their specific identity.^[2]

Controversy

While FLoC is being marketed as a more privacy-focused advertising system (compared to unhindered third party tracking of Chrome users who make no effort to protect their privacy), it has been met with a great deal of opposition. There are a number of main concerns in regard to this new system.

1. FLoC runs in the user's browser, doing the hard work of analytics on the user's device, and then broadcasting the results. Not only are the visitor's interests being captured and distributed, but it is being done by the user's own browser, without the user's explicit consent.
2. This user data is freely available to every website the browser visits, whether directly (browsing to that site), or indirectly (iframed content, 3rd party scripts, CNAME trackers, etc.) even if they have no prior knowledge about that visitor, and do not otherwise engage in tracking.
3. A common problem for user privacy has been browser fingerprinting, which is the practice of taking many data points about a browser (when by themselves are not useful), and using the collection of those data points to get as close as possible to uniquely identifying a user (without needing cookies). For example, browser language, screen size, browser version, OS version, whether DNT is enabled, which addons are installed, etc. Although FLoC IDs can change over time, they will still add new data points for browser fingerprinting.^[2][3]
4. Google plans to manually re-balance cohorts (groups) to make sure that they have at least about 1000 users. This is intended to obscure each person's identity within the group. The concern that many people have is that as a user is added to numerous cohorts, they may end up with a unique combination of cohort IDs, resulting in them being individually identified.
5. Third-party tracking is a booming business. Although user awareness has begun to push back against it in recent years, it seems unlikely to many that third-party tracks will all just show down their businesses as soon as FLoC is implemented. As web browsers have started putting more restrictions on such behavior, third-party trackers have only become more creative in their methods of tracking. It is reasonable to assume that with the implementation of FLoC, trackers will simply integrate the FLoC-declared user interests into their user profiles (thus benefiting from the web browser's own knowledge of the user), and continue tracking in ever-evolving ways.
6. FLoC will have full viability into everything a user does on the web. While third-party trackers can only typically see into the places where webmasters allow them, FLoC will essentailly be everywhere, since it runs in the web browser itself.^[3]
7. FLoC does not consolidate advertising profiles to Google specifically (although Google users will inadvertently begin sharing more data with Google), but this technology does make an effort to drive third-party trackers out of business, and force everyone to base their online advertising on the data that Google's FLoC provides. While some might see this a a good thing, it could also be seen as an anti-trust violation, since Google is using its position in the browser market to consolidate power to themselves while actively fighting third parties who have the same objective.
8. While users can supposedly opt-out of FLoC at this time (by disabling all third-party cookies),^[4] they must know it has been added, and research how to block it. By default, users are opted-in without being asked or informed.^[5]

Notes

• Several chromium-based browsers have pledged to keep FLoC out of their browser builds, including Brave^[6] and Vivaldi.^[7]
• At time of release, FLoC was only compatible with Chromium. The other two browser engines (Safari and Firefox) did not immediately add it to their browsers. Firefox specifically announced its intent to avoid FLoC, at that time.^[8]

References

External links

• FLoC Github page
• AmIFLoCed - EFF's site to test browsers for the presence of FLoC