A replacement for third-party cookies?

The era of tracking users all across the web using third-party cookies is coming to a close; that type of cookie is something of a zombie at this point. All of the major browsers, save one, are blocking third-party cookies by default and the holdout, Google Chrome, plans to make that change next year. But Google, which has a business model built around advertising that benefits greatly from the status quo, has offered up an alternative scheme to "replace" third-party cookies. The Federated Learning of Cohorts (FLoC) is an in-browser mechanism to pigeonhole users in a way that will be useful to advertisers, but the only reason the idea has any traction at all is because it is being implemented in Chrome—the dominant browser today.

Background

HTTP cookies are small chunks of data, associated with a particular domain, that can be persistently stored by the browser. Once a site has stored its cookie, subsequent HTTP requests to the site will include the cookie information; the mechanism is used to keep users logged into a site, for example. As the name would imply, third-party cookies come from domains other than the first-party domain that the user visited. They can come from advertisers or social networks with visible content (e.g. ads, "like" buttons) on the visited page, but they also come via "invisible" page elements from tracking companies. Whenever content from those third-party sites is requested from any page, anywhere on the web, the cookie information goes along for the ride—allowing those sites to track users across the web.

Over time, the privacy-invading attributes of third-party cookies have caused users, governments, and browser makers to examine them more closely and to make changes in behavior or laws (e.g. the GDPR) in order to thwart or restrict them. Firefox and Safari have both stopped accepting third-party cookies in the last year or two; other, less popular browsers (generally with a stricter stance on privacy), like Brave and the Tor Browser, were well ahead of the pack in that regard. Google described its plans for moving away from cookie-based tracking for Chrome in 2019 and touted FLoC as a replacement in early 2021. The company said that it planned to start rolling out the feature for some users starting in March.

One of the goals of tracking users is to be able to provide those users with ads that are relevant to them. The creepiness of being tracked all over the web is simply an unpleasant side effect, or so we are led to believe. It is far from clear that being bombarded with ads for things that one had only idly searched for—or had already purchased—is the advertising nirvana that some seem to think that is, but it is certainly popular with advertisers. So Google, which derives a rather large pile of money from advertising, is interested in finding other ways to deliver relevant ads, with less of a creepiness factor, perhaps—enter FLoC.

Cohort derivation

The basic idea is that the browser will locally collect information about the sites that are visited and boil that down into a "cohort" identifier. Based on their browsing history, users would be grouped with others who have similar patterns. Each cohort is meant to represent a few thousand users, though the proof of concept described in a FLoC whitepaper [PDF] does not guarantee that size. There is a balance to be struck in the size of a cohort: if it is too small, it becomes easier to identify its members, but if it is too large, its utility for advertisers diminishes. Without imposing some central authority to merge smaller cohorts (and perhaps split larger ones), there will likely be wide variance in the sizes.

The plan is to reset the cohort ID weekly, so users may well move to different IDs as their interests and activities change over time. The experiment described in the whitepaper used SimHash to calculate the cohort ID based on the sites visited, but there are other ways the IDs could be generated, as an Electronic Frontier Foundation (EFF) blog post critical of FLoC notes. However, there are a lot of details missing, the EFF said:

According to the proposal, most of the specifics are still up in the air. The draft specification states that a user's cohort ID will be available via Javascript, but it's unclear whether there will be any restrictions on who can access it, or whether the ID will be shared in any other ways. FLoC could perform clustering based on URLs or page content instead of domains; it could also use a federated learning-based system (as the name FLoC implies) to generate the groups instead of SimHash. It's also unclear exactly how many possible cohorts there will be. Google's experiment used 8-bit cohort identifiers, meaning that there were only 256 possible cohorts. In practice that number could be much higher; the documentation suggests a 16-bit cohort ID comprising 4 hexadecimal characters.

Advertisers will presumably have some means to derive information about what a particular cohort ID means with respect to a user's interests. For one thing, they can do a lot of testing to determine which IDs are likely to lead to users interested in their wares—or so it is hoped. While FLoC may be an improvement over third-party cookies, it is hardly without privacy and other concerns, as might be guessed.

Concerns

Even if each cohort ID were carefully constructed to ensure that it contained a few thousands users, these IDs will give advertisers that are using browser fingerprinting a leg up in tracking individuals, the EFF pointed out. Instead of needing a fingerprint that is unique among millions of users, they will only need to differentiate among a few thousand users in the cohort.

In addition, many web sites track their users by means of a username or email address that is used to log into the site. Those sites can immediately recognize the cohort of the user, can correlate it with other users of the site with the same ID, and can record changes in the ID over time in order to create a clearer picture of the "type" of person associated with the account. It is likely that certain IDs will track with personal characteristics, like politics, religion, race, sexuality, and more. Meanwhile, presenting your "cohort number" at every site you visit may not be serving you well, as the EFF shows:

You should have a right to present different aspects of your identity in different contexts. If you visit a site for medical information, you might trust it with information about your health, but there's no reason it needs to know what your politics are. Likewise, if you visit a retail website, it shouldn't need to know whether you've recently read up on treatment for depression. FLoC erodes this separation of contexts, and instead presents the same behavioral summary to everyone you interact with.

Another problem with FLoC is that it is opt-out, rather than opt-in, both for users of any browser that implements it (seemingly that will only be Chrome) and for web sites that will be tracked to help calculate the ID. In a post on the blog of the Plausible open-source web-analytics tool, Marko Saric explains how users and sites can opt-out of FLoC.

The easiest way for users to take a pass on FLoC is to simply use a browser other than Chrome; for those who cannot or will not switch, Sarik lists some steps that can be taken to opt-out of FLoC. Sites that do not want to be part of FLoC can use the Permissions-Policy HTTP header to say so:

    Permissions-Policy: interest-cohort=()

Many sites using frameworks and content management systems don't even have the option to control this. Opting out of FLoC is not possible for those sites. Frameworks and CMS providers that care about privacy should add this header by default. Google also needs to provide a more straightforward method.

He also noted that Google is not (yet?) testing FLoC in places where the GDPR is operative. The GDPR effectively requires providers to make their privacy-leaking features opt-in, which may be why FLoC is not being tested there. Meanwhile, there are concerns that FLoC is really meant as an anti-competition move in the advertising space:

Google owns the browser with the largest market share and the only major browser that still allows third-party cookies out of the box. Google is also the largest advertising company and the largest seller of online advertising.

Without third-party cookies, Google still gets all the data as they own the platforms while everyone else in the ecosystem only gets the cohorts that Google sends them.

As numerous observers have said, no one should be lamenting the loss of third-party cookies. As the EFF put it, they have been "the lynchpin in a shadowy, seedy, multi-billion dollar advertising-surveillance industry on the Web". But replacing those cookies with something "better" may not be the right way forward. For many, the whole idea behind targeted advertising is wrongheaded and dangerous. Beyond that, the targeted-advertising system that we have today is rife with abuse. As the EFF put it:

The power to target is the power to discriminate. By definition, targeted ads allow advertisers to reach some kinds of people while excluding others. A targeting system may be used to decide who gets to see job postings or loan offers just as easily as it is to advertise shoes.

[...] In a world with FLoC, it may be more difficult to target users directly based on age, gender, or income. But it won't be impossible. Trackers with access to auxiliary information about users will be able to learn what FLoC groupings "mean"—what kinds of people they contain—through observation and experiment. Those who are determined to do so will still be able to discriminate. Moreover, this kind of behavior will be harder for platforms to police than it already is. Advertisers with bad intentions will have plausible deniability—after all, they aren't directly targeting protected categories, they're just reaching people based on behavior. And the whole system will be more opaque to users and regulators.

It would seem that there are myriad reasons to avoid joining the FLoC, but there is a rather large bird in the room that seems to feel differently—at least for now. Google employees tend to be irritated when the company is tagged with the "if you aren't paying for it, you are the product" quote, but internet advertising is a place where that idea resonates pretty strongly for the company. Users are not paying (money) for their browser or for many of the online services they have come to rely on—in return Google is able to make an enormous amount of money on advertising by, in effect, selling information about the habits of those users. It is a lucrative business model, but one that may well not be tenable for the long term. Time will tell.