This month Google begins a public test of a technology it says will eventually replace browser cookies in an effort to boost Chrome browser user privacy. However, critics say the switch is a half-measure and does not protect the web movements of Chrome users adequately.
The Google solution–called Federated Learning of Cohorts (FLoC)—is promoted as a way to put people’s privacy first by limiting the capability of third parties to track their activity across the web using Cookies.
How Does Federated Learning of Cohorts Protect Privacy?
The as-yet unproven technology allows browsers to group people together by their interests and give them more anonymity yet still allow for appropriate targeted advertising, which remains at the core of the company’s interest in outfitting their Chrome browser with FLoC. Google’s stance is that it will balance the need to preserve people’s privacy by preventing individual tracking with giving advertisers and publishers the relevant info they need to recognize their target audience.
However, FLoC also raises new questions of who should have the ultimate power when it comes to accessing private information about people’s online browsing habits, which privacy advocates think should ultimately be a far more egalitarian affair. The digital privacy group the Electronic Frontier Foundation (EFF) has even gone so far as to call FLoC a “terrible idea” in a blog post published Wednesday by staff technologist Benett Cyphers.
Why EFF is Critical of FLoC
Others worry that FLoC is just Google attempting to dress up what ostensibly is at its core another, albeit potentially less obtrusive way to track people’s behavior to suit its targeted advertising agenda to ensure the company will continue to drive the market.
“Google has announced that its tests show promising signs that FLoC is working,” wrote Malwarebytes Labs security research Pieter Artnz in a blog post published in January. “Is this a milestone on the road to more privacy, or just better concealed tracking technology?”
That’s the central question that will become even relevant than ever now that FloC is reaching a broader audience, given Google Chrome’s strong position in the browser market and the company’s broad influence in the tech sector in general.
How FLoC Delivers a ‘Privacy First’ Experience
Google, naturally, is leading with its concern for privacy in its messaging and promotion of FloC, stressing the technology is a community effort that aims to include and balance the interests of everyone using the web, either for profit or not.
The company last year announced its intent to remove support for third-party cookies and work on a better solution via a two-year plan that included a Privacy Sandbox—or collaboration and partnership on the mission with industry leaders, publishers and marketers–that would both “protect anonymity while still delivering results for advertisers and publishers,” David Temkin Google’s director of product management, ads privacy and trust wrote in a blog post published Wednesday.
“Even so, we continue to get questions about whether Google will join others in the ad tech industry who plan to replace third-party cookies with alternative user-level identifiers,” he wrote. “Today, we’re making explicit that once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products.”
FLoC’s latest tests show effectiveness of hiding individual browsing behavior that cookies highlighted “within large crowds of people with common interests,” which are called “cohorts.” Temkin wrote.
Within Chrome, the company will make FLoC-based cohorts available for public testing through origin trials with the technology’s next release this month, then begin testing FLoC-based cohorts with advertisers in Google Ads in the second quarter. Chrome also will offer the first iteration of new user controls in April, expanding them after more proposals and feedback from the broader industry, he said.
“This points to a future where there is no need to sacrifice relevant advertising and monetization in order to deliver a private and secure experience,” Temkin wrote.
Potential for New Privacy Risks with FLoC
But not everyone is as enthusiastic about FLoC’s potential to take tracking out of browsers. The EFF’s Cyphers argued that by eliminating one way of tracking user activity, it’s introducing other, potentially more intrusive ways for third parties to observe what people are doing online.
“The core design involves sharing new information with advertisers,” he wrote. “Unsurprisingly, this also creates new privacy risks.”
Cyphers cited fingerprinting, or the practice of gathering many discrete pieces of information from a user’s browser to create a unique, stable identifier for that browser, as one emerging privacy threat.
While Google has promised that the vast majority of FLoC cohorts will comprise thousands of users each, so a cohort ID alone shouldn’t distinguish someone from others in their group, it “still gives fingerprinters a massive head start” that “will make it much easier for trackers to put together a unique fingerprint for FLoC users,” Cyphers wrote.
FLoC also will share new personal data with advertisers and marketers revealing information about their behavior, such as specific information about browsing history and general information about demographics or interests. This means “every site you visit will have a good idea about what kind of person you are on first contact, without having to do the work of tracking you across the web,” he wrote.
Moreover, technology like FLoC raises the question of whether behavior targeting is actually a good idea in the first place and if it should continue, calling the end of the cookie a “fork in the road” with two possible future scenarios ahead.
“In one, users get to decide what information to share with each site they choose to interact with,” Cyphers wrote. “No one needs to worry that their past browsing will be held against them—or leveraged to manipulate them—when they next open a tab.”
In the other, which he argued that FLoC will continue to promote, people’s online behavior follows them across the web “as a label,” appearing innocent at a glance but highly valuable to those with the knowledge and intent to use it—or potentially abuse it–for their own interests.
