Last month, Google announced that it was phasing out tracking users by the use of cookies, and migrating to an alternative.

That alternative is called FLoC – Federated Learning of Cohorts – and besides being a terrible acronym, it may not be quite as privacy-focused as Google suggests.

An Introduction to FLoC

The idea for FLoC seems like a good one – instead of tracking an individual’s behavior, combine users with similar behavior into a group.

And to Google’s credit, they’ve put the proposal up on GitHub, where you can find a detailed but readable description of the whole FLoC system.

Here’s a (very) brief overview of what FLoC does:

Instead of companies or websites (like Google and Facebook) tracking individual users across the web with 3rd-party cookies (and other, more devious means), FLoC would group users into groups (or cohorts) based upon things like their demographics, web browsing history, and other information.

These groups are not static, however. They would change over time as a user’s behavior and visited sites changes. The group identifier would also be a random-looking stream of numbers and letters, not something (easily) human readable.

While the GitHub proposal identifies the need for the groups to be large (to provide anonymity), it also mentions a general range for groups sizes (“thousands of people”) that seems too small. (More on this later).

Additionally, FLoC cohort is determined locally, on the user’s computer, and is currently only supported by Google’s Chrome browser.

The Problem(s) With FLoC

One thing to mention upfront – while I’m going to mention quite a few issues with the design of FLoC, it’s better than the current tracking situation we have now.

Now, on to the complaining!

First, in Google’s own blog post last month, they casually mentioned how web advertising has eroded consumer trust, without mentioning that Google has been one of the biggest drivers of this kind of tracking:

[The tracking of users via 3rd-party cookies] has led to an erosion of trust: In fact, 72% of people feel that almost all of what they do online is being tracked by advertisers, technology firms or other companies, and 81% say that the potential risks they face because of data collection outweigh the benefits…

Now that Google has a solution to this problem, they seem prepared to admit that maybe their whole business model hasn’t been the most responsible.

Moving on…

In their blog post responding to Google’s announcement, the EFF (Electronic Frontier Foundation) points out some of the (potential and actual) downsides of FLoC. However, before mentioning these, it’s worth pointing out this line from early in their article:

Google’s pitch…is that a world with FLoC…will be better than the world we have today…But that framing is based on a false premise that we have to choose between “old tracking” and “new tracking.” It’s not either-or. Instead of re-inventing the tracking wheel, we should imagine a better world without the myriad problems of targeted ads.

This paragraph gives away the EFF’s actual position: that any sort of tracking is a problem. I don’t necessarily disagree with this, but it’s worth noting this position, since it may bias some of their language (but it doesn’t invalidate their points).

Shortly after that, the EFF suggests that:

In one [possible future], users get to decide what information to share with each site they choose to interact with.

This idea seems…not great. It’s already a pain to deal with the “Accept Cookies” pop-ups that are on almost every site (including this one). Having an additional pop-up to decide what information to share with a site before browsing seems like a big UI downgrade.

But the EFF’s biggest complaint about FLoC is that it has the potential to make user identification and fingerprinting easier

Instead of picking an individual user out of millions of web users, if a web page knows your FLoC identifier (which is how FLoC works), then they only have to sift through a few thousand other users to identify you. This could be trivial by using another publicly available characteristic (like your IP address).

This has a wide range of further implications.

• If a site can identify you by even more granular information (like your email address), then a 3rd-party site can monitor how your browsing behavior changes over time, by recording your FLoC identifier whenever you log in.
• While it’s not possible yet, once this technology is wide-ranging, it may be possible to reverse-engineer what a FLoC identifier means, as well as how it is likely assigned.
• Once this kind of information is out, it’s essentially impossible to reverse. Sites can have a record of FLoC identifiers and correlate that with a user’s behavior over time. If you thought user login databases were a juicy target, being able to discover the behavior patterns for millions of users at once is going to be very tempting.
• FLoC lets websites know quite a bit about you the first time you visit. Even though 3rd-party cookies are full of downsides, for them to be useful a site must get the cookie in your browser and then wait. FLoC could potentially let new (to you) sites know a lot of information about you in the first seconds of visiting.

How to Avoid Being FLoC’d

Starting in early April of 2021, Google started the FLoC trial for millions of users without expressly notifying them. If you’re a Google Chrome user, it appears that the only way to make sure you’re not enrolled in this test is to disable 3rd-party cookies.

If you’re using Google Chrome and you want to know if you’re in the FLoC trial, the site Am I FLoCed? can tell if you’ve been enrolled.

If you are enrolled, and you don’t want to be there is no straightforward opt-out. You have to turn off 3rd-party cookies, use this DuckDuckGo browser extension, or simply switch browsers.

Speaking of switching browsers, that may not be a bad idea (I did awhile ago and have never looked back). Currently FLoC is only supported by Google Chrome. Mozilla’s Firefox, Vivaldi, and Brave have all expressly stated that they will not include FLoC support.