What is FLoC? Google's Replacement for Third-Party Cookies
When configuring online ads, advertisers and ad tech companies have a wide number of options to choose who gets to see an ad and when. One of the most effective forms of ad targeting is “audience targeting” where ads are targeted to users based on their specific interests. Today, audience targeting is powered by third-party cookies. Due to numerous privacy concerns with third-party cookies, browsers have started to block third-party cookies. To allow targeted ads without the privacy concerns of third-party cookies, Google has proposed FLoC as a replacement for third-party cookies.
What is FLoC?
FLoC, or Federated Learning of Cohorts, is designed to provide a privacy-focused replacement for third-party cookies. FLoC anonymizes users by grouping users with similar interests together. This allows advertisers to target ads to cohorts of users with specific interests, without needing to track information about any particular user.
Let’s dive into the details below.
How Ad Targeting Works
There are two sides to audience based ad targeting. On one side, Google tracks individual users as they navigate the web. Based on specific sites each user visits, Google will infer the user’s specific interests. If you're curious, you can see what interests Google has inferred about you here. For me, Google has determined I'm interested in programming, rock music, and strategy games, all of which is correct.
On the other side of audience targeting are the advertisers. Before running an ad in Google Ads, an advertiser has the option to show the ad only to people with specific interests. As an example, if a band is releasing a new rock album, they can limit their ads to people who are interested in rock music. That way, their ads are shown to groups of people who are highly likely to convert.
Audience targeting has been shown to be highly effective. Ads targeted to specific audiences have been measured to increase conversions by 5x.
To track web users as they navigate the web and learn their interests, Google has historically used third party cookies.
New Privacy Problems: Browsers and Third-Party Cookies
Due to many different privacy concerns, browsers have started blocking third-party cookies.
Within the past two years, Firefox and Edge have started blocking third-party cookies associated with known trackers, while Safari has started blocking all third party cookies across the board.
As for Chrome, Google is planning to phase out third-party cookies in 2022, but because ads are such a critical part of Google’s business (last year Google made nearly $150 billion from advertising alone), Google is going to rollout FLoC before blocking third-party cookies. Google's claim is FLoC is at least 95% as effective at target ads as third party cookies, but without the privacy downsides.
Before taking a deeper look at FLoC, let's recap what third party cookies are and how Google uses them to learn about your interests.
Third-Party Cookies
When you think of cookies, you are probably thinking of first-party cookies. Both first- and third-party cookies let websites store data on your computer, but they differ in who can access the cookie and when.
How First-Party Cookies Work
When you login to a website, say example.com, example.com will store a first-party cookie on your computer. This cookie allows example.com to keep track that you are logged in. Only example.com has access to the first-party cookie, and example.com can only access the cookie when you are on example.com.
How Third-Party Cookies Work
Third-party cookies differ in that they can be accessed by a site besides the one you are visiting.
Let's say example.com is making use of Google Ads. When you visit example.com, Google (not example.com) will place a third-party cookie on your computer. Not only can Google access the cookie when you visit example.com, Google can access it whenever you visit any other site that participates in Google Ads. This allows the advertiser to get a clear view of your past browsing activity and learn your interests based on your web history.
Third-party cookies have an obvious privacy concern. Third-party cookies allow third-parties to know whenever a user visits a site with the third-party installed. It's for this reason browsers have started blocking third party cookies.
How FLoC enables interest-based advertising
FLoC is designed to allow advertisers to target ads to users without allowing third parties to track users across the web. The core idea is instead of Google tracking individual users across the web to infer the individuals' interests, the users will be first grouped together into cohorts. When a user visits a website, Google and any other ad network will be able to determine which cohort the user belongs to, but will not be able to determine the precise individual visiting the website.
This means all information a third party can collect is at the cohort level and not at the individual level. Instead of Google inferring information based on an individual's browsing history and targeting ads to that individual, Google will infer information based on the cohort's browsing behavior and target ads to that cohort. This gives Google the ability to target ads to cohorts based on the cohorts’ interests, but does not allow Google to track a specific individual across the web.
Of course, if users were placed into cohorts randomly, the interests of any individual user in the cohort will not be reflective of the interests of the other users in the cohort. That means targeting ads based on the behavior of the cohort would not be effective. To address this problem, users' cohort ids will be calculated in such a way that users with similar browsing history will have the same cohort id.
More specifically, your browser keeps track of your browsing history. Once a week, your browser will take that information and use an algorithm called SimHash to compute your cohort id (SimHash is a specific instance of a technique known as Locality-Sensitive Hashing). SimHash can be computed locally, so there’s no need for a central server to collect and store data. This ensures users with the same cohort id will have similar browsing history. Therefore users in the same cohort are likely to have the same interests and ads targeted to the cohort are more likely to be effective.
Trade Offs: What are the new privacy risks?
Compared to third party cookies, FLoC is much better. Instead of allowing ad networks to track individuals across the web, FLoC only allows for tracking information at the cohort level. Of course there are some costs when compared to no tracking at all:
Fingerprinting
Fingerprinting is the process of gathering many discrete pieces of information from a user’s browser.
FLoC Cohort ids are great for fingerprinting. If the cohort a user is in is too small, it may be possible to uniquely identify the user based on their cohort id and a little bit of other information such as an IP address. Trackers across the web could then put together a unique fingerprint and skirt user privacy.
Google's response to this is they are going to guarantee a minimum cohort size to prevent too much information from being revealed by the cohort id.
Cross-context exposure
The FloC generated cohort id can potentially leak sensitive information about a user. It’s plausible that a third-party can determine a user’s demographics or interests based solely on their cohort ID and no other information. The cohort id is computed based on a user's entire browsing history across devices. Even more information goes into computing the cohort id than what Google normally has under third-cookies. With third-party cookies Google only knows if you visited a site if Google Ads is installed on the site. With FLoC, any site you visit is used to compute your cohort id. Google says they will monitor the cohorts that correlate with sensitive information and reconfigure those cohorts if needed.
Conclusion
In summary, FLoC relies on grouping users together in an attempt to limit third parties ability to track individual users. Google’s business relies heavily on advertising, and FLoC is designed to help advertisers continue to perform behavioral targeting in a world without third-party cookies.
While there are advantages over third party cookies, there are also some tradeoffs. Note that FLoC is not the only replacement or browser change being made by Google. Google plans to also rollout FLEDGE later this year. FLEDGE will allow advertisers to perform ad retargeting without needing to use third party cookies.
