About two weeks ago, millions of Google Chrome users signed up for an experiment they never agreed to participate in. Google had just launched a test run for Federated Learning of Cohorts (or FLoC), a new kind of ad targeting technology less invasive than the average cookie. In a blog post In announcing the trial, the company noted that it would only affect a “small percentage” of random users in ten different countries, including the US, Mexico and Canada, with plans to expand globally as the trials continue.
These users probably won’t notice anything else when they click on Chrome, but behind the scenes, that browser quietly monitors every site they visit and every ad they click on. These users’ browsing habits are profiled and packaged, and shared for profit with numerous advertisers. Sometime this month, Chrome will give users the option to opt out of this experiment, according to Google’s blog post, but as of now their only option is to block all third-party cookies in the browser.
That is, if they know at all that these tests are taking place at all. While I am my fair share about FLoC so far, the loudest voices I’ve heard on the subject are too marketing nerds policy nerds, or policy nerds who work in marketingThis may be due to the fact that – apart from a few Blog posts here or there: the only breadcrumbs Google gives to people who want to learn more about FLoC are inscrutable pages of code, an unfathomable one GitHub repositoryand inscrutable mail listEven if Google went to the trouble of asking for permission before enrolling a random sample of the Chrome user base in this trial, chances are they wouldn’t know what they agreed to.
(For the record, you can check if you’re signed up for this first test with this handy tool from the Electronic Frontier Foundation.)
Because Google doesn’t have a good track record of be candid About its privacy practices, we decided to write down the basics of this technology, the trial, and why FLoC’s promises aren’t actually all they’re crazy about.
G / O Media can receive a commission
“WTF is a FLoC?”
In Google’s own words, it is a “privacy-preserving mechanism for interest-based ad selection”. In normal human words, it is a way of tracking users across the web for advertising purposes, in a way that is more privacy-friendly than the cookies and code advertisers have trusted so far, at least that’s what Google says.
“How should it work?”
It’s a bit complicated. When someone floats from site to site across the web using a FLoC powered browser, that browser uses an internal algorithm to pick out an appropriate ‘cohort of interest’ to immerse that person, and these cohorts are recalculated weekly . These specific cohorts are built up according to Google thousands of different users at any one time, making tracking and targeting your specific browser history next to impossible for sleazy adtech types.
Just an example here: I’m redecorating my apartment, which means browsing sites for over two hours a day for stores like West Elm, Target, IKEA, and the like. In this situation, my browser could label me (quite accurately) a home decor nerd, lumping me with thousands of other people who also spend hours over couches.
Under FLoC, each cohort is given a name that is a jumble of letters, numbers, or both, so let’s call the home decor cohort HGTV, after the legendary channel of the same name.
Next time I visit a site for tips on, I don’t know, reupholster my sofa, that site may ask the cohort I am a part of. When it is noted that I am part of the HGTV cohort, the site can track my behavior on the site and the bank ads I inevitably click on, and then merge that data with other people from the same cohort as they trickle in.
Occasionally, that aggregated data on where the HGTV cohort is in (sofa upholstery! Removable wallpaper! Granite countertops!) Is uploaded to all the ad networks that an individual site might operate with.
Let’s say the network is in question Google Ads since about any site uses it. If I try to browse an ad-supported news site – like the one you’re on right now – after viewing that Couch Content, that news site will also ask my browser about the cohort I’m in (HGTV).
Once that’s taken care of, my cohort ID will be beamed to that site’s ad networks, which of course also Google’s network. Based on the data that this ad serving system has previously collected about this cohort (i.e. they could probably use a new bank), it reaches back to the previous catalog of ads from about 7 million several advertisers waiting to appear. The ad platform finds an ad for a new bank and pops it onto the news site, where I see it, immediately giving up the idea of reupholstering something and clicking.
“How is this different from the tracking we have now?”
The trackers that FLoC is supposed to replace are known as ‘third party cookies’. We have a nice one comprehensive guide to the way this kind of technology works, but in a nutshell, these are snippets of code from adtech companies that can incorporate websites into the code that underlies their pages. Those pieces of code control your behavior on the site – and sometimes other personal data—For the adtech organization behind that cookie, that data beams back to its own servers.
That’s one of the main differences between FLoC and the current cookie hell we are entangled in. With FLoC, my thousand-headed cohort is the only thing an external advertiser sees. Everything else – like the names of sites I’ve visited or details about banks I’ve clicked on in the past – is stored locally in the browser. In the cookie case, all these details are sent to an external server where the responsible company can have virtually free rein: they can pawn off this data to other adtech companies, or they can to merge their data with data from other cookie co’s, or in some cases they may provide that data to the police
This is why Google’s pitch sounds semi-appealing. Of course, you are still behaviorally profiled in what is unarguably one kind of icky way, but at least you can’t be picked from a lineup.
“There must be a catch here.”
The catch is that Google still has all that juicy user-level data because it controls Chrome. They are also still free to continue doing what they have always done with that data: sharing accidentally with federal agencies to leak, and you know, just be Google
“Not really.”
Way.
“Isn’t that kind of … anti-competitive?”
It depends on who you ask. Competition authorities in the UK sure think so, like trade groups here in the US. It is also packaged in one Congress probe, at least a class action, and a huge one antitrust case in multiple states under the direction of Texas Attorney General Ken Paxton. Their problems with FLoC are quite easy to understand. Google already manages about 30% of the digital advertising market in the US, just slightly more than Facebook – the other half of the so-called Duopoly– that 25% checks (for context, Microsoft about 4%
While that dominance has netted Google billions upon billions of dollars per year, it has recently been netted multiple ascending antitrust investigations also against the company. And those surveys have pretty broadly painted a picture of Google as one blatant autocrat of the ad-based economy, and an economy that largely got away with disgusting behavior because smaller rivals were too scared – or couldn’t – to speak up. This is why many of them are now speaking out about FLoC.
“But at least it’s good for privacy, right?”
Again, it depends who you ask! Google thinks so, but the EFF certainly doesn’t. In March, the EFF released a detailed piece resolving some of the biggest gaps in FLoC’s privacy promises. If a particular website asks you to provide certain first party information (for example, by registering with your email address or phone number), your FLoC ID is not really anonymous more.
Aside from that issue, the EFF points out that your FLoC cohort is following you all over the web. This isn’t a problem if my cohort is just “ people who want to reupholster furniture, ” but it gets really unpredictable when that cohort accidentally shapes around someone’s mental illness or their sexuality based on the sites that person views. Although Google has promised to prevent FloCs from creating cohorts based on this kind of ‘sensitive categories, ”The EFF again pointed out that Google’s approach was riddled with holes.
“Behavior correlates with demographics in a non-intuitive way,” wrote EFF technologist Bennet Cyphers. “It is very likely that certain demographics will visit a different subset of the Internet than other demographic categories, and that such behavior will not be captured by Google’s framing of” sensitive sites “.”
And Google throws this up as one better alternative to cookies? “
I know?????????
“How can I convey all of this to my uncle / parent / neighbor / estranged cousin who isn’t tech savvy but wants to know what FLoC is all about?”
Remind them that this is a privacy product pushed by Google. Google That’s all they need to know.