Federated Learning of Cohorts

Federated Learning of Cohorts (FLoC) is a type of web tracking through federated learning. It groups people into "cohorts" based on their browsing history for the purpose of interest-based advertising.[1][2]Google began testing the technology in the Chrome browser in the second quarter of 2021 as a replacement for third-party cookies,[3] which it plans to stop supporting in Chrome by late 2021[4] or early 2022.[2] FLoC is being developed as a part of Google's Privacy Sandbox Initiative,[5] which includes several other advertising-related technologies with bird-themed names.[1][6]:48

As of April 2021[update], every major browser aside from Google Chrome that is based on Google's open-source Chromium platform has declined to implement FLoC. The technology has been criticized on privacy grounds by groups including the Electronic Frontier Foundation and DuckDuckGo, and has been described as anti-competitive; it has generated an antitrust response in multiple countries as well as questions about General Data Protection Regulation compliance.

Function[edit]

The Federated Learning of Cohorts algorithm analyzes users' online activity within the browser, and generates a "cohort ID" using the SimHash algorithm[7] to group a given user with other users who access similar content. Websites are then able to access the cohort ID using an API[8]:9 and determine what advertisements to serve.[4] Google does not label cohorts based on interest beyond grouping them and assigning an ID,[1] so advertisers need to determine the user types of each cohort on their own.[6]:47

The process used to generate cohorts without sending user browsing data outside the device is similar to the method behind Google's predictive keyboard.[6]:46

Reactions[edit]

Google claimed in January 2021 that FLoC was at least 95% effective compared to tracking using third-party cookies, but AdExchanger reported that some people in the advertising technology industry expressed skepticism about the claim and the methodology behind it.[9] As every website that opts into FLoC will have the same access about which cohort the user belongs to, the technology's developers say this democratises access to some information about a user's general browser history, in contast to the status quo, where websites have to use tracking techniques.[10][7]

The Electronic Frontier Foundation has criticized FLoC, with one EFF researcher calling the testing of the technology in Chrome "a concrete breach of user trust in service of a technology that should not exist" in a post on the organization's blog.[11][12] The EFF also created a website which allows Chrome users to check whether FLoC is being tested in their browsers.[13] The EFF criticized the fact that every site will be able to access data about a user, without having to track them across the web first.[14] Additionally on the EFF blog, Cory Doctorow praised Chrome's planned removal of third-party cookies, but added that "[just] because FLoC is billed as pro-privacy and also criticized as anti-competitive, it doesn’t mean that privacy and competition aren’t compatible", stating that Google is "appointing itself the gatekeeper who decides when we’re spied on while skimming from advertisers with nowhere else to go."[15]

On April 10, 2021, the CEO of DuckDuckGo released a statement telling people not to use Google Chrome, stating that Chrome users can be included in FLoC without choosing to be and that no other browser vendor has expressed interest in using the tracking method.[16] The statement said that "there is no such thing as a behavioural tracking mechanism imposed without consent that respects people’s privacy" and that Google should make FLoC "explicitly opt-in" and "free of dark patterns".[17] DuckDuckGo also announced that its website will not collect FLoC IDs or use them to target ads,[18] and updated its Chrome extension to block websites from interacting with FLoC.[16]

Brave, a web browser built on the Chromium platform, criticized FLoC in a blog post on April 12, 2021, and announced that it would be disabled in the Brave browser and not accessed by the Brave website.[19] The blog post, co-written by the company's CEO Brendan Eich, described Google's efforts to replace third-party cookies as "Titanic-level deckchair-shuffling" and "a step backward from more fundamental, privacy-and-user focused changes the Web needs."[20][21]

Tech and media news site The Verge noted that not all possible repercussions of FLoC for ad tech are known, and that its structure could benefit or harm smaller ad tech companies, noting specifically that larger ad tech companies may be better equipped to "parse what FLoCs mean and what ads to target against them."[1]

On April 18, 2021, a WordPress development team proposal suggested disabling FLoC by default on WordPress websites over possible privacy issues. The proposal stated that "WordPress powers approximately 41% of the web."[22][23]

As of April 2021[update], every major browser based on Google's open-source Chromium platform (other than Google Chrome) had declined to implement FLoC, including Microsoft Edge, Vivaldi, Brave, and Opera.[24]

Antitrust response[edit]

In July 2020, the United Kingdom's Competition and Markets Authority found that the FLoC proposal "place[s] the browser in a vital gatekeeper position for the adtech ecosystem."[25]

In March 2021, 15 attorneys general of U.S. states and Puerto Rico amended an antitrust complaint filed in December; the updated complaint says that Google Chrome's phase-out of third-party cookies in 2022[26] will "disable the primary cookie-tracking technology almost all non-Google publishers currently use to track users and target ads. Then [...] Chrome, will offer [...] new and alternative tracking mechanisms [...] dubbed Privacy Sandbox. Overall, the changes are anticompetitive".[27][28]

GDPR compliance[edit]

As of April 2021[update], Google was not testing FLoC in the European Economic Area due to concerns about compliance with the General Data Protection Regulation and the ePrivacy Directive.[29][30][31]

Johannes Caspar, the Data Protection Commissioner of Hamburg, Germany, told Wired UK that FLoC "leads to several questions concerning the legal requirements of the GDPR," explaining that FLoC "could be seen as an act of processing personal data" which requires "freely given consent and clear and transparent information about these operations." A spokesperson of the French National Commission on Informatics and Liberty said that the FLoC system would require "specific, informed and unambiguous consent".[29]

As of April 2021[update], the Irish Data Protection Commission, which is the lead data supervisor for Google under GDPR,[30] was consulting with Google about the FLoC proposal.[29]

References[edit]

External links[edit]