Abbreviation | FLoC |
---|---|
Status | Replaced by Browsing Topics API |
Year started | 2019 |
Organization | |
Series | Privacy Sandbox |
Website | privacysandbox |
Federated Learning of Cohorts (FLoC) is a type of web tracking. It groups people into "cohorts" based on their browsing history for the purpose of interest-based advertising. [1] [2] FLoC was being developed as a part of Google's Privacy Sandbox initiative, [3] which includes several other advertising-related technologies with bird-themed names. [1] [4] : 48 Despite "federated learning" in the name, FLoC does not utilize any federated learning. [5]
Google began testing the technology in Chrome 89 [6] released in March 2021 as a replacement for third-party cookies. By April 2021, every major browser aside from Google Chrome that is based on Google's open-source Chromium platform had declined to implement FLoC. The technology was criticized on privacy grounds by groups including the Electronic Frontier Foundation and DuckDuckGo, and has been described as anti-competitive; it generated an antitrust response in multiple countries as well as questions about General Data Protection Regulation compliance. In July 2021, Google quietly suspended development of FLoC; [7] Chrome 93, [8] released on August 31, 2021, became the first version which disabled FLoC, but did not remove the internal programming. [9]
On January 25, 2022, Google officially announced it had ended development of FLoC technologies and proposed the new Topics API to replace it. [10] [11] Brave developers criticized Topics API as a rebranding of FLoC with only minor changes and without addressing their main concerns. [12]
The Federated Learning of Cohorts algorithm analyzes users' online activity within the browser, and generates a "cohort ID" using the SimHash algorithm [13] to group a given user with other users who access similar content. [14] : 9 Each cohort contains several thousand users in order to make identifying individual users more difficult, [15] and cohorts are updated weekly. [16] Websites are then able to access the cohort ID using an API [14] : 9 and determine what advertisements to serve. [17] Google does not label cohorts based on interest beyond grouping users and assigning an ID, [1] so advertisers need to determine the user types of each cohort on their own. [4] : 47
FLoC experiment was active only in Google Chrome browser and ran from Chrome 89 [6] (inclusive) to Chrome 93 (not inclusive). Modern browsers do not support FLoC. While the experiment was active, users could opt out of FLoC experiment by disabling third-party cookies. Website administrators could opt out from cohort calculation via special HTTP headers. It can be accomplished with a new interest-cohort permissions policy or feature policy, the default behavior is to allow cohort calculation. To opt-out of all FLoC cohort calculations a website could send either of the following HTTP response headers: [18]
Permissions-Policy: browsing-topics=()
or
Feature-Policy: browsing-topics 'none'
Google Chrome applies interest-cohort
Feature Policy restrictions to Browsing Topics API as well. [19]
On August 22, 2019, Google Chrome developers coined the term FLoC and first started discussing the upcoming replacement for cookies. [20] In July 2020, the United Kingdom's Competition and Markets Authority found the FLoC proposal to be anti-competitive, since it would "place the browser in a vital gatekeeper position for the adtech ecosystem." Instead, the authority recommended adoption of a competing proposal called SPARROW, which maintains the same privacy-enhancing objectives but creates a different completely independent "Gatekeeper" which does not have any other role in the adtech ecosystem and does not have access to user-level information. [21]
Google began testing FLoC in the Chrome 89 [6] released in March 2021 [16] as a replacement for third-party cookies, [22] which Google plans to stop supporting in Chrome by mid-2023. [23] (Initially Google announced plans to remove third-party cookies by late 2021, [17] then postponed it to early 2022, [2] and then to 2023 due to delay of FLoC technology.) The initial trial turned on FLoC for 0.5% of Chrome users across 10 countries: [16] the United States, Australia, Brazil, Canada, India, Indonesia, Japan, Mexico, New Zealand and the Philippines. [24] Users were automatically placed in the trial and were not notified, but could opt out by turning off third-party cookies. Furthermore, site administrators could disable FLoC and opt out from interest calculation via a Feature-Policy
header.[ citation needed ] The initial trial did not include users in the United Kingdom or the European Economic Area due to concerns about legality under the area's privacy regulations. [25]
In July 2021, Google suspended development of FLoC; Chrome 93, released on August 31, 2021, became the first version which rendered FLoC feature void, but did not remove the internal programming. [9] [7] Chrome 100, released on March 29, 2022, removed most of old FLoC code. [26]
On January 25, 2022, Google officially announced it had ended development of FLoC APIs and proposed a new Topics API to replace it. [10] [11] This API would use three weeks of the browser's history to identify user interests based on defined topics. Participating websites could then call this API to get three topics which could be used to tailor advertising. [27] Developers of the Brave web browser called Topics API a "rebranding [of] FLoC without addressing key privacy issues. [28]
Google claimed in January 2021 that FLoC was at least 95% effective compared to tracking using third-party cookies, but AdExchanger reported that some people in the advertising technology industry expressed skepticism about the claim and the methodology behind it. [29] As every website that opts into FLoC will have the same access about which cohort the user belongs to, the technology's developers say this democratizes access to some information about a user's general browser history, in contrast to the status quo, where websites have to use tracking techniques. [30] [13]
The Electronic Frontier Foundation has criticized FLoC, with one EFF researcher calling the testing of the technology in Chrome "a concrete breach of user trust in service of a technology that should not exist" in a post on the organization's blog. [31] [32] The EFF also created a website which allows Chrome users to check whether FLoC is being tested in their browsers. [33] The EFF criticized the fact that every site will be able to access data about a user, without having to track them across the web first. [34] Additionally on the EFF blog, Cory Doctorow praised Chrome's planned removal of third-party cookies, but added that "[just] because FLoC is billed as pro-privacy and also criticized as anti-competitive, it doesn't mean that privacy and competition aren't compatible", stating that Google is "appointing itself the gatekeeper who decides when we're spied on while skimming from advertisers with nowhere else to go." [35]
On April 10, 2021, the CEO of DuckDuckGo released a statement telling people not to use Google Chrome, stating that Chrome users can be included in FLoC without choosing to be and that no other browser vendor has expressed interest in using the tracking method. [36] The statement said that "there is no such thing as a behavioral tracking mechanism imposed without consent that respects people's privacy" and that Google should make FLoC "explicitly opt-in" and "free of dark patterns". [37] DuckDuckGo also announced that its website will not collect FLoC IDs or use them to target ads, [38] and updated its Chrome extension to block websites from interacting with FLoC. [36]
On April 12, 2021, Brave, a web browser built on the Chromium platform, criticized FLoC in a blog post and announced plans to disable FLoC in the Brave browser and make company's main website opt out of FLoC. [39] The blog post, co-written by the company's CEO Brendan Eich, described Google's efforts to replace third-party cookies as "Titanic-level deckchair-shuffling" and "a step backward from more fundamental, privacy-and-user focused changes the Web needs." [40] [41]
Tech and media news site The Verge noted that not all possible repercussions of FLoC for ad tech are known, and that its structure could benefit or harm smaller ad tech companies, noting specifically that larger ad tech companies may be better equipped to "parse what FLoCs mean and what ads to target against them." [1]
Multiple companies including GitHub, Drupal and Amazon declined to enable FLoC, instead opting to disable FLoC outright by including the HTTP Header Permissions-Policy: interest-cohort=()
. [42] [43] [44] WordPress, a widely used website framework floated a proposal to disable FLoC based tracking across all websites that used the framework. [45]
Almost all major browser based on Google's open-source Chromium platform declined to implement FLoC, including Microsoft Edge, Vivaldi, Brave, and Opera. [46]
In May 2021, The Economist reported that it may be hard for Google to "stop the system from grouping people by characteristics they wish to keep private, such as race or sexuality." [16]
In May 2021, The Economist said some critics have suggested that the cohort system will facilitate fingerprinting of individual devices, compromising privacy. [16]
Wired magazine additionally reported that FLoC could "be used as a point of entry for fingerprinting". [15]
Mozilla, the creators of the Firefox browser, expressed concerns that FLoC can be used as an additional fingerprinting vector. Furthermore, they stated that a user's FLoC group can be tracked during multiple visits and correlated via different means and, based on a user's membership in multiple FLoC cohorts, a website might be able to infer information about the user which FLoC aimed to keep private. Since a FLoC cohort is shared across websites, its ID might be abused as an alternative to a unique cookie in third-party contexts. [47]
In July 2020, the United Kingdom's Competition and Markets Authority found that the FLoC proposal "place[s] the browser in a vital gatekeeper position for the adtech ecosystem." [21]
In March 2021, 15 attorneys general of U.S. states and Puerto Rico amended an antitrust complaint filed in December; the updated complaint says that Google Chrome's phase-out of third-party cookies in 2022 [48] will "disable the primary cookie-tracking technology almost all non-Google publishers currently use to track users and target ads. Then [...] Chrome, will offer [...] new and alternative tracking mechanisms [...] dubbed Privacy Sandbox. Overall, the changes are anticompetitive". [49] [50]
In June 2021, EU antitrust regulators launched a formal investigation to assess whether Google violated competition rules, with a focus on display advertising, notably whether it restricts access to user data by third parties while reserving it for its own use. Among the things that will be investigated is Google's plan to prohibit the placement of third-party cookies and replace them with the Privacy Sandbox set of tools. [51]
As of April 2021 [update] , Google was not testing FLoC in the United Kingdom or the European Economic Area due to concerns about compliance with the General Data Protection Regulation and the ePrivacy Directive. [52] [25] [53]
Johannes Caspar, the Data Protection Commissioner of Hamburg, Germany, told Wired UK that FLoC "leads to several questions concerning the legal requirements of the GDPR," explaining that FLoC "could be seen as an act of processing personal data" which requires "freely given consent and clear and transparent information about these operations." A spokesperson of the French National Commission on Informatics and Liberty said that the FLoC system would require "specific, informed and unambiguous consent". [52]
As of April 2021 [update] , the Irish Data Protection Commission, which is the lead data supervisor for Google under GDPR, [25] was consulting with Google about the FLoC proposal. [52]
HTTP cookies are small blocks of data created by a web server while a user is browsing a website and placed on the user's computer or other device by the user's web browser. Cookies are placed on the device used to access a website, and more than one cookie may be placed on a user's device during a session.
A browser extension is a software module for customizing a web browser. Browsers typically allow users to install a variety of extensions, including user interface modifications, cookie management, ad blocking, and the custom scripting and styling of web pages.
Google Chrome is a web browser developed by Google. It was first released in 2008 for Microsoft Windows, built with free software components from Apple WebKit and Mozilla Firefox. Versions were later released for Linux, macOS, iOS, iPadOS, and also for Android, where it is the default browser. The browser is also the main component of ChromeOS, where it serves as the platform for web applications.
Google Native Client (NaCl) is a discontinued sandboxing technology for running either a subset of Intel x86, ARM, or MIPS native code, or a portable executable, in a sandbox. It allows safely running native code from a web browser, independent of the user operating system, allowing web apps to run at near-native speeds, which aligns with Google's plans for ChromeOS. It may also be used for securing browser plugins, and parts of other applications or full applications such as ZeroVM.
DuckDuckGo is an American software company focused on online privacy, whose flagship product is a search engine of the same name. Founded by Gabriel Weinberg in 2008, its later products include browser extensions and a custom DuckDuckGo web browser. Headquartered in Paoli, Pennsylvania, DuckDuckGo is a privately held company with about 200 employees. The company's name is a reference to the children's game duck, duck, goose.
Chromium is a free and open-source web browser project, primarily developed and maintained by Google. It is a widely-used codebase, providing the vast majority of code for Google Chrome and many other browsers, including Microsoft Edge, Samsung Internet, and Opera. The code is also used by several app frameworks.
Web tracking is the practice by which operators of websites and third parties collect, store and share information about visitors' activities on the World Wide Web. Analysis of a user's behaviour may be used to provide content that enables the operator to infer their preferences and may be of interest to various parties, such as advertisers. Web tracking can be part of visitor management.
Epic is an Indian proprietary privacy-centric web browser developed by Hidden Reflex using Chromium source code. Epic is always in private browsing mode, and exiting the browser deletes all browser data. The browser's developers claim that Google's tracking code has been removed, and that blocks other companies from tracking the user.
Comodo Dragon is a freeware web browser. It is based on Chromium and is produced by Comodo Group. Sporting a similar interface to Google Chrome, Dragon does not implement Chrome's user tracking and some other potentially privacy-compromising features, replacing them with its own user tracking implementations, and provides additional security measures, such as indicating the authenticity and relative strength of a website's Secure Sockets Layer (SSL) certificate.
Do Not Track (DNT) is a formerly official HTTP header field, designed to allow internet users to opt out of tracking by websites—which includes the collection of data regarding a user's activity across multiple distinct contexts, and the retention, use, or sharing of data derived from that activity outside the context in which it occurred.
HTTPS Everywhere is a discontinued free and open-source browser extension for Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave, Vivaldi and Firefox for Android, which was developed collaboratively by The Tor Project and the Electronic Frontier Foundation (EFF). It automatically makes websites use a more secure HTTPS connection instead of HTTP, if they support it. The option "Encrypt All Sites Eligible" makes it possible to block and unblock all non-HTTPS browser connections with one click. Due to the widespread adoption of HTTPS on the World Wide Web, and the integration of HTTPS-only mode on major browsers, the extension was retired in January 2023.
A headless browser is a web browser without a graphical user interface.
uBlock Origin is a free and open-source browser extension for content filtering, including ad blocking. The extension is available for Chrome, Chromium, Edge, Firefox, Brave, Opera, Pale Moon, as well as versions of Safari before 13. uBlock Origin has received praise from technology websites and is reported to be much less memory-intensive than other extensions with similar functionality. uBlock Origin's stated purpose is to give users the means to enforce their own (content-filtering) choices.
Brave is a free and open-source web browser developed by Brave Software, Inc. based on the Chromium web browser. Brave is a privacy-focused browser, which automatically blocks most advertisements and website trackers in its default settings. Users can turn on optional ads that reward them for their attention in the form of Basic Attention Tokens (BAT), which can be used as a cryptocurrency or to make donations to registered websites and content creators.
Searx is a discontinued free and open-source metasearch engine, available under the GNU Affero General Public License version 3, with the aim of protecting the privacy of its users. To this end, Searx does not share users' IP addresses or search history with the search engines from which it gathers results. Tracking cookies served by the search engines are blocked, preventing user-profiling-based results modification. By default, Searx queries are submitted via HTTP POST, to prevent users' query keywords from appearing in webserver logs. Searx was inspired by the Seeks project, though it does not implement Seeks' peer-to-peer user-sourced results ranking.
Third-party cookies are HTTP cookies which are used principally for web tracking as part of the web advertising ecosystem.
ungoogled-chromium is a free and open-source variant of the Chromium web browser that removes all Google-specific web services. It achieves this with a series of patches applied to the Chromium codebase during the compilation process. The result is functionally similar to regular Chromium.
The Privacy Sandbox is an initiative led by Google to create web standards for websites to access user information without compromising privacy. Its core purpose is to facilitate online advertising by sharing a subset of user private information without the use of third-party cookies. The initiative includes a number of proposals, many of these proposals have bird-themed names which are changed once the corresponding feature reaches general availability. The technology include Topics API, Protected Audience, Attribution Reporting, Private Aggregation, Shared Storage and Fenced Frames as well as other proposed technologies. The project was announced in August 2019.
Brave Search is a search engine developed by Brave Software, Inc., and is the default search engine for the Brave web browser in certain countries.
Web Environment Integrity (WEI) is an abandoned API proposal previously under development for Google Chrome. A Web Environment Integrity prototype existed in Chromium, but was removed in November 2023 after extensive criticism by many tech groups. Its purpose was to verify that interactions with websites were human and authentic as defined by third-party attesters.
FLoC didn't actually use Federated learning
FLoC ended its experiment in July of 2021.
if EITHER the interest-cohort OR the browsing-topics directive turns off the API, then the API is off