Google is rolling out Federated Learning of Cohorts (FLoC) in Chrome browsers – which is more than 60% of all browsers worldwide, based on page visits.

I never used Chrome and am an avid Firefox user, but this is important for every Web user and the Web as the whole.

What is FLoC?

Basically, third-party (aka. tracking) cookies are being blocked now in every major browser, and Chrome is soon to follow. This is a nice change that prevents advertisers from identifying and tracking us as we browse the web.

With FLoC on the other hand, your Chrome browser would anonymously profile you by analyzing your browser history. Few specifics are known except that this is an ongoing experiment being gradually rolled out.

How does this affect the Web?

There are several other issue points where FLoC is being actively criticized, but I would like to emphasize two consequences of this practice.

First, this neatly helps reducing ad-tech competition for Google. Any advertiser can use third-party cookies to track visitors on partner sites, but FLoC results can only be gathered, learned, analyzed and then marketed by Google. Whatever they promise about sharing FLoC IDs, it’s still under their total control. I can hardly feel sorry for any advertising company, but further increasing Google’s web monopoly sounds daunting.

Second, this shifts control from website owners to Google on how visitor data is being collected and capitalized on. Before this, website owners could decide which third-party ad tracker they add to their site, by using tracking pixels or embedded ad scripts.

We dislike ads and the whole web ad business model is arguably flawed, but this at least generated revenue for valuable sites we love.

On the contrary, with FLoC, in every Chrome browser, for every user, every visit is automatically recorded. The whole Web is automatically opted in, and you, as a website owner would have to opt out to prevent Google from harvesting your visitor’s data, even if you have been consciously not using any tracking scripts on your site.

And even if you had tracking/ads on your site, you wouldn’t get any share of revenue with FLoC. (Not mentioning the possibility that Google could rank sites that opt out lower among their search results.)

In my opinion, this would change the Web for the worse: increasing monopoly of Google, decreasing competition and user privacy. 65% of Web users’ visitor data being harvested by some black box algorithm, unless they individually opt out.

How can I opt out?

Take action! Fortunately, there are several ways to opt out from Floc as a webmaster. For gombosg.com I simply disallowed FLoC in a .htaccess file. If you look at the response headers:

~ $ curl -Lv https://gombosg.com  
[...]
< HTTP/2 200 
< date: Fri, 16 Apr 2021 12:21:50 GMT
< permissions-policy: interest-cohort=()`

This header is supposed to turn off data collection regarding this site. Still, we are at Google’s mercy when it comes to actually respecting the received header.

On the client side: just don’t use Chrome. Use Chromium, Firefox, or any other browser.

Ok, if you’re a Chrome user I’m not going to redirect you to floc-away-from-chrome.com… just yet.

It’s important to know that at the time of this writing FLoC is not being tested in countries where the GDPR is in effect. It is possible that some countries’ authorities would take action to deal with this privacy violation. Yet, court cases could take years to pass through, and we have already learned that regulators can hardly manage to contain the greed of tech monopolies.

Resources, further reading

• eff.org: Google’s FLoC Is a Terrible Idea
• paramdeo.com: Opting your Website out of Google’s FLoC Network
• web.dev: What is Federated Learning of Cohorts (FLoC)?