Google FLoC: A Third-Party Cookie Alternative

Update: Google has proposed to replace the Federated Learning of Cohorts (FLoC) with a new alternative called “Topics” to phase out third-party cookies. In January 2022, Google has come up with this new system for interest-based advertising. Through Topics, the Chrome browser will curate a user’s top interests in a week based on their browsing history. Read more about it here . 

Google recently began testing Federated Learning of Cohorts (FLoC) - an experimental tracking feature. Google FloC is the latest, privacy-preserving alternative put forward by the tech giant in place of third-party cookies . To refresh your memory, Google announced that it will phase out third-party tracking cookies by 2022. Google joined the likes of Safari and Firefox in blocking third-party cookies on its Chrome web browser.

In March 2021, the tech giant announced that it is rolling out a developer trial of FLoC as part of the Privacy Sandbox initiative. Privacy Sandbox is a proposed set of web browser APIs designed to protect user privacy while delivering efficiency and value to advertisers. It aims to give advertisers the ability to deliver, target and measure campaigns without the use of third-party cookies in Chrome. One of the Sandbox proposals relevant for ad buyers is FLoC.

So what exactly is Google FLoC and how does it work? Here’s a primer.

Google has been looking at ways for advertisers to continue targeting users once third-party cookies are gone. So, it came up with FLoC — a method for browsers to enable interest-based advertising. In Google's words, it enables “interest-based advertising on the web” without letting advertisers know the user’s identity. FLoC will create profiles on groups of users or “cohorts” that eliminates the need to track individual user activity.

Google has announced that it will start FLoC testing in Q2. The trial is currently deployed on a “small percentage” of Chrome users in Australia, Brazil, Canada, India, Indonesia, Japan, Mexico, New Zealand, the Philippines, and the U.S. If you take into account Google Chrome’s 2.65 billion users, even a small fraction of trial users could be a huge number. The trial is likely to continue till July 2021, and may eventually affect as many as 5% of Chrome users worldwide.

FLoC trial also affects websites. According to Google, “websites that don’t opt-out will be included in the FLoC calculation if Chrome detects that they load ads-related resources”. Some websites have opposed being automatically included in a technology trial without notice or consent. Publishers like The Markup and The Guardian have opted out of FLoC.

To find out if Google Chrome has silently activated FLoC on your account, head to the EFF’s FLoC tracking site . It will show you if Google has activated FLoC on your browser or not. If you are part of the FLoC trial and you wish to opt-out, you can disable third-party cookies through Google Chrome’s settings.

Website owners can opt-out of FLoC by sending a Permissions-Policy HTTP response header: Permissions-Policy: interest-cohort=(). 

Users can also install the DuckDuckGo Chrome extension .  It is a privacy-friendly extension with an enhanced tracker blocking feature that will block FLoC interactions on websites. 

Users who don’t want to change settings or download extensions can simply use a different browser including Chromium-based browsers like Microsoft Edge and Brave that have not enabled FLoC.

Chrome browsers will use machine learning and algorithms (the federated learning part) and place users in interest-based cohorts with thousands of other “like-minded” people. According to the FLoC proposal on GitHub, the new tracker will look at the URLs of sites that the user visited and the content of those pages, among other factors. Each group or cohort will receive a label or a FLoC ID, which will capture information about users’ habits and interests. 

The cohorts will have nondescript anonymized names i.e. each user’s browsing history is kept private. Instead of publishers or advertisers being able to track users as they browse one website after another, a user’s browser history is held by FLoC and isn’t shared with anybody, not even Google.

Advertisers will have access to only the name of the user’s cohort through a Javascript API. This way, individual user data is kept locally in the browser, and the browser only exposes the cohort ID to the advertisers. Google has proposed that it will wait until there are “thousands” in a cohort to ensure that user identity is protected.

Cohorts cannot be used for advertising if it has a history of visiting sites with sensitive topics at a high rate, such as personal hardships, identity and belief, sexual interest and access to opportunities.

Chrome will also update the cohorts over time. Users will get assigned to new cohorts every week, based on their browsing data from the previous week. Google’s preliminary analysis suggests that FLoC will give advertisers “at least 95% of the conversions per dollar spent when compared to cookie-based advertising.”

For a detailed understanding of how FLoC works, refer here .

A major concern is that Google rolled out its trials without any clear disclosure of the same. Google Chrome users had no choice regarding the FLoC trial, they received no notification nor was their consent taken. As noted earlier, users have no option to specifically opt-out, other than blocking all third-party cookies to leave the trial.

This is also the reason why FLoC trials are not available in Europe, where the General Data Protection Regulation (GDPR) and ePrivacy Directive are in place. Simply put, FLoC is not GDPR compliant . 

Another key concern noted by many is whether FLoC is anonymous. Grouping users into cohorts may disguise individual users within a crowd, but that may not be enough to protect their privacy. Most privacy advocates argue that, by grouping users based on their browsing, Google can glean a deeper understanding of user data and still may be able to individually identify users.

Google claims that FLoCs will not share sensitive pieces of information with advertisers – such as a user’s medical history. However, what is defined as sensitive and what is not, Google decides. Further, as EFF pointed out , the algorithm can create cohorts that reflect sensitive characteristics such as visits to websites related to substance abuse, financial hardship etc that could enable advertisers to discriminate against users.

Google itself addressed some of the privacy concerns and prospective scenarios of abuse.  It noted that websites that collect personal data (such as email address) can record and reveal the user’s cohort. Also, as FloC is updated over time, multiple FLoC samples can reveal more information about a user’s browsing history. Similarly, if cohorts can be used for tracking, then multiple cohort samples of a user can be used to re-identify them.

• FLoC is Google’s answer to third-party cookies and is based on machine learning
• It is a privacy-focused solution that aims to deliver relevant ads by clustering a large group of users with similar interests
• User accounts are anonymised, grouped into interests, and is processed locally i.e. on-device 
• Advertisers won’t be able to determine which user they can target specifically but can direct relevant ads based on the interests of each group (cohort)
• Google is running a developer origin trial of FLoC as of March 30, 2021, for chrome users in India, Australia, Canada, Japan, Brazil, Mexico, Philippines, New Zealand and the US
• The FLoC trial is not rolled out in Europe, where regulations like the GDPR and ePrivacy Directive are in place
• Browsers like DuckDuckGo, Brave, Vivaldi and Microsoft Edge have disabled FLoC on their browsers
• Privacy advocates and industry experts have raised objections to the privacy implications of FLoC, including lack of voluntary opt-in for the trials

While Google FLoC intends to replace third-party cookies, it will not be an easy task to find a balance between the ever-growing demands for data privacy and the need for businesses to drive traffic via targeted advertising. But, the fact remains that cookies are here to stay and privacy laws like the GDPR, CCPA will strengthen privacy for internet users.

And that’s why businesses should streamline their efforts to protect user privacy with a cookie consent solution such as CookieYes .

With CookieYes, you can scan your website for cookies, add a fully customizable cookie consent banner and make it available in 28 languages. You can also access a record of users’ consents and their cookie preferences in a consent log to demonstrate your compliance. The free privacy policy generator allows you to create a Privacy Policy exclusively for your business, all in a few clicks.