Google Drops FLoC - ThreatWire

By Shannon Morse, ThreatWire

Big news from Google! The company has decided to replace FLoC with Topics. So, let’s break this down. Google’s wanted to replace third party cookies via Interest Based Advertising (or IBA for short), for quite some time now. Their first plan of attack was FLoC. FLoC stands for Federated Learning of Cohorts, and was planned to replace third party cookies in the Chrome browser in 2022, but was later delayed to a 2023 rollout. FLoC was planned to be a new technology that would offer more anonymization for users while still yielding good conversion rates for publishers.

FLoC received a lot of criticism from privacy advocates including the EFF because it still shares a summary of recent browsing history with marketers. Vivaldi is a Chromium based browser and shared these sentiments, saying ad companies could originally only see aspects of a user’s personality with third party cookies, but FLoC would share new information with those same marketers, so a FLoC ID on a user would be accessible to ad companies. If a user was grouped into a FLoC “cohort” that was relatively small, then it could potentially be used to track individual users. It kinda defeats the purpose of replacing third party cookies, because that potential would lead to the same end result. As such, Google ended development in July of 2021.

Google has been working on a replacement, though, called Topics. Topics plans to track users anonymously with a new API that would keep privacy intact for users by making it difficult to re-identify users, make recorded data less personally sensitive, and be transparent and easy to understand for users. The browsing history would only be associated for a few weeks on the user device. Their plan is to allow IBA with relevant ads but advertisers wouldn’t know the sites visited.

Privacy Lead Ben Galbraith shared technical details on a Github post, explaining that Topics will track behavior across a few hundred areas of interest, but these wouldn’t include sensitive topics such as race or gender. When a user visits a site with internet based advertising on it, the Topics API will share a small portion of the detected areas of interest with advertisers randomly, of which one topic would be selected from the top interests. From a user perspective, you could disable tracking for specific areas of interest and you could review Topics that have been associated with you.

The technical information explains how Google is hoping to fix what FLoC would’ve failed at - Topics would have more transparency and less digital fingerprinting, especially around sensitive topics. Google is still pushing ahead on removing third party cookies but is trying to keep existing components of digital advertising.

Google is planning to roll out a testing phase of Topic this year. Why haven’t they just blocked advertising altogether? You guessed it - money. Google makes 80% of their revenue from advertising. Alternatively, Mozilla and Safari both blocked third party cookies by default in the past few years.

Google is Dropping FLoC:
https://azure.microsoft.com/en-us/blog/azure-ddos-protection-2021-q3-and-q4-ddos-attack-trends/
https://www.bleepingcomputer.com/news/security/microsoft-mitigates-largest-ddos-attack-ever-reported-in-history/
https://thehackernews.com/2022/01/microsoft-mitigated-record-breaking-347.html
https://arstechnica.com/information-technology/2022/01/microsoft-fends-off-record-breaking-3-47-tbps-ddos-attack/
https://www.zdnet.com/article/microsoft-heres-how-we-stopped-the-biggest-ever-ddos-attack/