3 ms·

I feel like the phrase “tracking individual people” is how Google is going to keep tracking you as well as they did before. With the announcement of federated

I feel like the phrase “tracking individual people” is how Google is going to keep tracking you as well as they did before. With the announcement of federated learning of cohorts [0], it allows Google to use their massive amount of information they have on you already, as well as their dominance in AI to cut out the easy way of tracking people, and make it harder for anyone else to personalize ads. Don’t get me wrong it’s a good thing that we are removing third-party cookies, but the idea that Google is confident they can track you without them makes me worried for the future of advertising. This move is undoubtedly going to cement google as the best ad tracking company for some time into the future. [0]: https://www.cnbc.com/2021/01/24/google-extremely-confident-about-third-party-cookie-alternatives-.html https://www.cnbc.com/2021/01/24/google-extremely-confident-a...

VSerge 6y ago
With regards to the existing footprint of Google, it's useful to keep in mind that Google and Facebook combined are already catching 74% of advertising dollars spent online, as per the bloomberg article shared here today: https://news.ycombinator.com/item?id=26325950 https://news.ycombinator.com/item?id=26325950 It's also worth noting that other groups have proposed systems that would not result in Google creating another monopolistic product line. Google did not seem very interested in such alternatives.
rektide 6y ago
> With the announcement of federated learning of cohorts [0], it allows Google to use their massive amount of information they have on you already, as well as their dominance in AI to cut out the easy way of tracking people, and make it harder for anyone else to personalize ads. yes, yes yes yes. This proposal is that: * the web have no individual tracking * the browser, instead uploads our every activity across all sites into the cloud * the cloud/browser-operators (google, firefox, microsoft, opera, brave) take these troves of big data & apply machine learning to generate cohorts * the browser then places us into these cohorts this would, as parent post suggested, absolutely "cement google as the best ad tracking company". it also makes it radically harder to create a new browser. Brave would have to become not just browsing software you run on your computer, but a cloud-service, gathering reams of data like Google, generating cohorts out new big data systems. how is Lynx/elinks supposed to become compliant with this new proposal? how is anyone other than the already existing giants of the world supposed to do this? bold bold bold plan organize & own all the worlds data here. privacy on the web, but none in the web browser: brave new world Google. you madmen.
- qyph 6y ago
  In floc no personal data or web history is uploaded to the cloud. This is the essence of "federated learning" - your browser does the big ml computation, then just uploads the result.
  - rektide 6y ago
    Where does the data to compute on come from? Personal information will attempted to be scrubbed, but it very much is an upload of one's detailed web history to the cloud. Google alleges they wont know it's my tracks, but these federated learning systems are all powered by endless reams of data gathered from us. That the decision of which cohort we are in can be done locally does not change the fact that that data has to come from somewhere, is gathered, en-mass, via huge bulk collections, of very specific, detailed data. It is only weasel words that it is called "not personal data"; our individuality is being harvested, tracked, modelled via these systems. That the information is free of personal identifiers does not make me feel much better about this all. And it is something few other enterprises will ever have the capability to repeat or compete with. It mandates the web browser be powered by clouds & big data.
ErikVandeWater 6y ago
Yeah what is the cohort size and how many cohorts can a person be part of? This sounds like an underhanded way Google can say they don't track individuals while in practice it is almost the same.
- jefftk 6y ago
  > what is the cohort size? "The browser ensures that cohorts are well distributed, so that each represents thousands of people." > how many cohorts can a person be part of? It's just: cohort = await document.interestCohort(); See https://github.com/WICG/floc https://github.com/WICG/floc (Disclosure: I work on ads at Google, speaking only for myself.)
  - josefx 6y ago
    Only thousands? The x-client-data field all google owned servers get from chrome has over 65000 possible values. Wouldn't that make a combination of both unique again?
    - jefftk 6y ago
      The X-Client-Data header is for evaluating the effect of Chrome changes, not ad targeting: "Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above). These are transmitted using the "X-Client-Data" HTTP header, which contains a list of active variations. On Android, this header may include a limited set of external server-side experiments, which may affect the Chrome installation. This header is used to evaluate the effect on Google servers - for example, a networking change may affect YouTube video load speed or an Omnibox ranking update may result in more helpful Google Search results." -- https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html
      - josefx 6y ago
        > The X-Client-Data header is for evaluating the effect of Chrome changes, not ad targeting: And my personal browsing habits are for me, that doesn't seem to stop Google from inventing new and imaginative ways to use them for ad targeting. The id is also long enough to be unique in a group of thousands, which is a size range in which the groups created by this new way of targeting ads apparently are.
krick 6y ago
Absolutely, and I'm not even sure it's a good thing that we are removing third-party cookies. I mean, if we take a step back: why should I even hate them? Yes, there are problems with them, there have been exploits using them and all that, but I'm pretty confident there will be similar problems with pretty much anything, because there's always a clever way to abuse some technology that was created with the best intentions in mind. And cookies, at least in theory, mean that you are putting me in charge of whatever tracking token you assigned to me: I can open my browser settings and clear it at any time. It's a good thing. Of course, there are reasons why they aren't such a good thing as I make them sound to be. And the fact that you don't feel in charge of them should rather emphasize, than negate my point: if such a simple thing turns out to be something you learn to hate, don't you ever dream of something more complicated and less transparent to be your salvation. And ever since federated learning became "the next big thing" I was arguing here on HN (rather unsuccessfully, I feel) that this doesn't mean that there's suddenly "no tracking", buying into that is just naïve. I'm not directly commenting on FLoC API, both because I don't know it well and because it's usually about making a stronger point anyway: that performing learning client-side and then submitting some sort of "depersonalized data" means better privacy and essentially is having your cake and eating it too. But I think it's just misleading to describe things this way. The idea that "sensitive data" is your document id, your name/surname and such is hopelessly outdated. In fact, it's funny that anyone even believes that, because if you are not a complete bureaucrat, it should be clear that you are not your name or some other sort of ID number, you are your behaviour. It's just that people are used to the idea, that Big Brother needs that simple ID number to keep you in line. But perhaps he doesn't anymore. What I'm saying is essentially that sending "depersonalized data" is just obfuscating which personal & sensitive data is actually exchanged. And (again, not in the context of FLoC API, but more generally) it can be any data: I think we all remember funny stories how completely impartial GPT-3 learns someone's phone number and such. So, this, and all of what you already said about the monopolization of people-tracking market.
jsonne 6y ago
Google isn't the only one doing this though. The Trade Desk and the wider programmatic industry seem to be somewhat pushing to unify around Unified ID 2.0 especially as they released it to the public. (Eg one company isn't the gatekeeper on the cookieless future for ad targeting.
nonpolitic 6y ago
Exactly this. It's Google saying "we don't need third party cookies to track people", and removing them just makes life harder for their competitors.

VSerge 6y ago

With regards to the existing footprint of Google, it's useful to keep in mind that Google and Facebook combined are already catching 74% of advertising dollars spent online, as per the bloomberg article shared here today: https://news.ycombinator.com/item?id=26325950 https://news.ycombinator.com/item?id=26325950 It's also worth noting that other groups have proposed systems that would not result in Google creating another monopolistic product line. Google did not seem very interested in such alternatives.

rektide 6y ago

> With the announcement of federated learning of cohorts [0], it allows Google to use their massive amount of information they have on you already, as well as their dominance in AI to cut out the easy way of tracking people, and make it harder for anyone else to personalize ads. yes, yes yes yes. This proposal is that: * the web have no individual tracking * the browser, instead uploads our every activity across all sites into the cloud * the cloud/browser-operators (google, firefox, microsoft, opera, brave) take these troves of big data & apply machine learning to generate cohorts * the browser then places us into these cohorts this would, as parent post suggested, absolutely "cement google as the best ad tracking company". it also makes it radically harder to create a new browser. Brave would have to become not just browsing software you run on your computer, but a cloud-service, gathering reams of data like Google, generating cohorts out new big data systems. how is Lynx/elinks supposed to become compliant with this new proposal? how is anyone other than the already existing giants of the world supposed to do this? bold bold bold plan organize & own all the worlds data here. privacy on the web, but none in the web browser: brave new world Google. you madmen.

qyph 6y ago
In floc no personal data or web history is uploaded to the cloud. This is the essence of "federated learning" - your browser does the big ml computation, then just uploads the result.
- rektide 6y ago
  Where does the data to compute on come from? Personal information will attempted to be scrubbed, but it very much is an upload of one's detailed web history to the cloud. Google alleges they wont know it's my tracks, but these federated learning systems are all powered by endless reams of data gathered from us. That the decision of which cohort we are in can be done locally does not change the fact that that data has to come from somewhere, is gathered, en-mass, via huge bulk collections, of very specific, detailed data. It is only weasel words that it is called "not personal data"; our individuality is being harvested, tracked, modelled via these systems. That the information is free of personal identifiers does not make me feel much better about this all. And it is something few other enterprises will ever have the capability to repeat or compete with. It mandates the web browser be powered by clouds & big data.

ErikVandeWater 6y ago

Yeah what is the cohort size and how many cohorts can a person be part of? This sounds like an underhanded way Google can say they don't track individuals while in practice it is almost the same.

jefftk 6y ago
> what is the cohort size? "The browser ensures that cohorts are well distributed, so that each represents thousands of people." > how many cohorts can a person be part of? It's just: cohort = await document.interestCohort(); See https://github.com/WICG/floc https://github.com/WICG/floc (Disclosure: I work on ads at Google, speaking only for myself.)
- josefx 6y ago
  Only thousands? The x-client-data field all google owned servers get from chrome has over 65000 possible values. Wouldn't that make a combination of both unique again?
  - jefftk 6y ago
    The X-Client-Data header is for evaluating the effect of Chrome changes, not ad targeting: "Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above). These are transmitted using the "X-Client-Data" HTTP header, which contains a list of active variations. On Android, this header may include a limited set of external server-side experiments, which may affect the Chrome installation. This header is used to evaluate the effect on Google servers - for example, a networking change may affect YouTube video load speed or an Omnibox ranking update may result in more helpful Google Search results." -- https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html
    - josefx 6y ago
      > The X-Client-Data header is for evaluating the effect of Chrome changes, not ad targeting: And my personal browsing habits are for me, that doesn't seem to stop Google from inventing new and imaginative ways to use them for ad targeting. The id is also long enough to be unique in a group of thousands, which is a size range in which the groups created by this new way of targeting ads apparently are.

krick 6y ago

Absolutely, and I'm not even sure it's a good thing that we are removing third-party cookies. I mean, if we take a step back: why should I even hate them? Yes, there are problems with them, there have been exploits using them and all that, but I'm pretty confident there will be similar problems with pretty much anything, because there's always a clever way to abuse some technology that was created with the best intentions in mind. And cookies, at least in theory, mean that you are putting me in charge of whatever tracking token you assigned to me: I can open my browser settings and clear it at any time. It's a good thing. Of course, there are reasons why they aren't such a good thing as I make them sound to be. And the fact that you don't feel in charge of them should rather emphasize, than negate my point: if such a simple thing turns out to be something you learn to hate, don't you ever dream of something more complicated and less transparent to be your salvation. And ever since federated learning became "the next big thing" I was arguing here on HN (rather unsuccessfully, I feel) that this doesn't mean that there's suddenly "no tracking", buying into that is just naïve. I'm not directly commenting on FLoC API, both because I don't know it well and because it's usually about making a stronger point anyway: that performing learning client-side and then submitting some sort of "depersonalized data" means better privacy and essentially is having your cake and eating it too. But I think it's just misleading to describe things this way. The idea that "sensitive data" is your document id, your name/surname and such is hopelessly outdated. In fact, it's funny that anyone even believes that, because if you are not a complete bureaucrat, it should be clear that you are not your name or some other sort of ID number, you are your behaviour. It's just that people are used to the idea, that Big Brother needs that simple ID number to keep you in line. But perhaps he doesn't anymore. What I'm saying is essentially that sending "depersonalized data" is just obfuscating which personal & sensitive data is actually exchanged. And (again, not in the context of FLoC API, but more generally) it can be any data: I think we all remember funny stories how completely impartial GPT-3 learns someone's phone number and such. So, this, and all of what you already said about the monopolization of people-tracking market.

jsonne 6y ago

Google isn't the only one doing this though. The Trade Desk and the wider programmatic industry seem to be somewhat pushing to unify around Unified ID 2.0 especially as they released it to the public. (Eg one company isn't the gatekeeper on the cookieless future for ad targeting.

nonpolitic 6y ago

Exactly this. It's Google saying "we don't need third party cookies to track people", and removing them just makes life harder for their competitors.