The FLoC origin trials have begun along with a rising tide of criticism against it spilling out into the digital advertising and technology community.

FLoC ostensibly preserves user privacy by replacing user tracking via third-party cookies with a cohort-based alternative that anonymizes users into large groups with similar browsing habits. The Google-led initiative implies that tracking users on an individual level leads us astray from the path of privacy righteousness.

The concept of individual user tracking in any sense has attracted its condemnations — but critics of FLoC have pointed out that it may generate an entirely new set of privacy issues.

Other Browsers vs. FLoC

The FLoC documentation outlines the concept as browser agnostic and Google presented FLoC to the Web Incubation Community Group (WICG) of the W3C. The WICG is a group within the W3C, the international organization responsible for developing open web standards, but the WICG is quick to point out:

"It is not a W3C Standard nor is it on the W3C Standards Track "

There is no indication that any web browser other than Chrome will adopt FLoC as a standard, and Mozilla (Firefox) and Brave have confirmed that they will not support FLoC.

FireFox

Mozilla told Digiday that they have no plans to implement any Privacy Sandbox proposal into their Firefox browser. Mozilla believes that passive data collection without a user's knowledge is unnecessary for advertising, which aligns with their previous decision to block 3rd party tracking cookies by default.

Even though Firefox is the third most popular browser, it still only represents less than 4% market share as of March 2021. But the lack of support for FLoC will continue to splinter web advertising into two distinct sets.

Today, advertisers cannot track Firefox and Safari users using third-party cookies. The lack of third-party cookie support in these browsers requires advertisers to find their audiences using different strategies than they use for Chrome.

This feature divergence splits web users into two distinct groups, and this dichotomy will carry over into the era of FLoC since Chrome will be the lone browser to support it.

Brave

Brave, a privacy-focused browser that blocks ads by default, also announced they will not support FLoC. The company does make a compelling point in their blog post around a criticism that Google surfaces in the original FLoC proposal: sensitive categories.

Sensitive categories can include religion, gender, race, or health — these are known categories that Chrome can hardcode as sensitive. But Brave rightfully claims that it is impossible to create a static list of sensitive categories since what may not be sensitive to one person can be extremely sensitive to another. One example:

Similarly, an adult happily expecting a child might not find their interest in “baby goods” particularly sensitive, but a scared and nervous teenager might.

Google capitulates that they cannot prevent misuse around sensitive categories. Chrome can mitigate sensitive category membership by analyzing the deviation of group membership from demographic and population norms, but algorithms are far from perfect.

Publishers vs. FLoC

Industry thought leaders and publications extolled the value of first-party data ever since we learned of the impending deprecation of third-party cookies in Chrome.

Without a straightforward method for data brokers to stitch together robust third-party data sets, advertisers will turn to publishers and their first-party data to find the audiences they wish to target.

Devaluing First-Party Data

FLoC could degrade the value created through first-party data. Brave illustrates this clearly in the same blog post from above.

"FLoC will have your users broadcast their interest in your site (and sites like your site) to unrelated sites on the web."

So if a publisher or online shop built a niche audience of highly engaged users for a specific topic or product interest, that group of users could command a high value from some advertisers. But with FLoC, Chrome could broadcast that unique interest to any site or advertisers that are interested.

Erosion of User Trust & Privacy

Some publishers may also view FLoC as a threat to the level of trust they have built with their users around the data they collect. Google has not clearly outlined if or how they will gather consent to include users in FLoC.

The lack of consent clarity from Google is even more troubling since the company announced they will not test FLoC in Europe due to GDPR concerns. A core issue at hand may revolve around where consent must take place. Will Chrome only need to ask for permission once? Or will each site need to ask for consent to place a user into a FLoC group?

Publishers will need to weigh their data strategy and user privacy in their decision to allow Chrome to include their website in FLoC calculations.

Some publishers have already started to block Chrome from using their website usage to inform FLoC. The Guardian and The Markup are both notable publishers who actively block FLoC on their websites by sending a new permission policy HTTP response header:

Permissions-Policy: interest-cohort=()

Since Chrome opts-in every website to cohort calculation by default, a website owner would have to take this action to block their property from FLoC.

Government vs. FLoC

The 15 attorneys general filing an antitrust complaint against Google updated the suit to include criticisms of the Privacy Sandbox. The complaint alleges that Google is self-serving its interest by deprecating third-party cookies and hiding their true motivations behind the pretext of privacy.

Essentially, if Chrome deprecates third-party cookies, it becomes much harder for any other ad tech platform to perform the precise targeting advertisers crave. So while the suit does not claim that FLoC is the issue, it purports that FLoC and the Privacy Sandbox are a byproduct of a concerted effort by Google to cement their place as an ad tech behemoth.

While platforms struggle to turn FLoC IDs into valuable data points, Google will rake in ad revenue through their massive first-party data sets.  Google builds their data on the back of their enormously popular applications like Google Search, Gmail, YouTube, or maybe even browsing history derived from logged-in Chrome users.

The Competition and Markets Authority (CMA), the competition regulator of the United Kingdom, is also investigating the impact of the Google Privacy Sandbox. The CMA is focusing specifically on how these proposals and the associated deprecation of third-party cookies can impact a publisher's ability to generate revenue and bolster the market power of Google.

Users vs. FLoC

If you have ever seen a monster movie like Godzilla or King Kong, you know that the monsters are the real stars, and everyone else is left running for their lives as the monsters fight and the city burns.

Right now, we are all participating in a monster film trilogy:

  1. The Death of the Cookie
  2. Privacy Apocalypse
  3. Antitrust - The Return of the Regulators

Users are scrambling for their lives while tech juggernauts duke it out. Users know there is a fight going on, but most do not understand why the hell it is happening or who should win.

If you are reading this, you have made a concerted effort to learn. But most web users will go on living their life in ignorant bliss without worrying about the various machinations and motivations of these giant tech companies.

This lack of background knowledge is why we need organizations like the Electronic Frontier Foundation to represent users in this debate. The EFF is an organization dedicated to "defending civil liberties in the digital world" — a virtuous mission that creates very polarizing opinions.

The organization decries behavioral targeting in any form and views FLoC as an equally ignoble replacement to third-party cookies. The EFF is correct that FLoC surfaces additional privacy concerns.

Fingerprinting

Ad tech companies can use the FLoC ID as an additional data point to fingerprint users. Fingerprinting involves taking any data points available (user agent, time zone, and even installed system fonts) and making a statistical deduction to identify an individual.

The more data points available, the more accurate the fingerprint. Since each FLoC can contain a thousand or so individuals, the FLoC ID can help to narrow down a unique user.

Linking Browsing Habits to PII

The EFF also points out that anyone consuming a FLoC ID and Personally Identifiable Information (PII) can now link those two data points together. If platforms can algorithmically narrow down the browsing habits of a given FLoC ID, they can tie browsing habits to a user's real-world identity.

These are valid privacy concerns — but we also must consider that the EFF is laser-focused on protecting users. Any steps taken to microtarget users will draw the ire of the organization.

An untenable position

Google finds itself in the untenable position of balancing concerns on privacy, antitrust, and its digital advertising business. These three things are inherently at odds with each other, and addressing each presents a possibly insurmountable task.

You could view the current situation through two points of view:

Google POV

When other browsers eliminated third-party cookies, they drew praise from privacy advocates. When Chrome eradicates third-party cookies, the public shuns the move as anti-competitive.

Anti-competitive pressure then forces Google to develop an alternative solution like FLoC to preserve digital advertising revenue for competitors, but privacy advocates similarly shun the effort for its privacy deficiencies.

Digital Advertising Industry / Regulator POV

Google wants to eliminate third-party cookies to make precise user-level targeting impossible outside of the Google walled garden.

Google then develops FLoC and the Privacy Sandbox as a cover for antitrust scrutiny, using the growing demand for privacy as a vehicle to further entrench market dominance.

Which is correct?

The reality is that there is probably a semblance of truth to each POV. But at the end of the day, Google is a business, and we must scrutinize any move they make as furthering their strategic objectives.

The success of Google is intrinsically linked to its ability to provide advertisers with the most robust set of advertising capabilities, at scale, and with the greatest return on ad spend.

But we also must scrutinize any criticisms arising from competitors. Any business that earns money from digital advertising stands to gain from any regulation imposed on Google.

Anything that restricts the growth of Google would equate to more advertising revenue available for competitors. So any privacy criticisms against Google must gain equal scrutiny as any move Google makes.

The direction FLoC takes can influence the dominant business models and privacy restrictions employed across the web for years to come. Unfortunately, the users it impacts may not understand the dire implications.

That is why it is vital to consider the opinion of organizations who protect user rights and with the necessary background information like the EFF and weigh those against motivations from business-driven entities.

The vast majority of people FLoC impacts will not understand the difference between FLoC and third-party cookies, and if FLoC is successful, they may not even notice the change.