18 ms·

Opting Your Website Out of Google's FLoC Network

586 points by oedmarap 5y ago

encryptluks2 5y ago
How does it benefit website owners to opt out?
- cratermoon 5y ago
  Let me turn the question around: to what extent are website owners who do not opt out accomplices with Google in the privacy violations implicit in their creepy surveillance profiling tech?
  - imwillofficial 5y ago
    accomplices invokes images of people “in” on the conspiracy. In my rough estimation based on nothing, I’d guess most website owners have no idea this is an issue that needs fixing. Your rhetoric is inflammatory, inaccurate, and does your side of the argument harm by making the whole argument look absurd.
  - encryptluks2 5y ago
    Let's rephrase that... to what extent are website owners who do not opt accomplices with Google, Microsoft, Facebook, Twitter, Instagram, Amazon, etc. Please also note that Firefox enables multiple telemetry features by default, such as safe browsing lists that checks links you visit presumably also tracking your URLs in the process.
    - fabrice_d 5y ago
      Please read about how safe browsing works in Firefox (https://wiki.mozilla.org/Security/Safe_Browsing https://wiki.mozilla.org/Security/Safe_Browsing): it's using the privacy respecting update API described at https://developers.google.com/safe-browsing/v4/ https://developers.google.com/safe-browsing/v4/
  - PradeetPatel 5y ago
    I often think of it as: As a website owner, will partnering with Google - a market leader in the advertisement space have a direct negative impact on me and my stakeholders? If not, it has been observed that there's very little incentive to communicate that change through. As much as I'd like to believe that altruism will win in the end, it has been established that ultimately the capacity to gain materialistic advantages can often triumph over individual's judgements.
- dcow 5y ago
  Presumably things that promote a healthy internet also benefit website owners since their sites exist on the internet.
  - encryptluks2 5y ago
    Does Firefox sending URLs you visit to a an external service not constitute as unhealthy?
    - dcow 5y ago
      You can opt out of that (or is it opt in now), too.
      - encryptluks2 5y ago
        You can opt out with Chromium too
    - _underfl0w_ 5y ago
      "What about $otherthing?" Neither is good, but that doesn't necessarily make the topic you're attempting to pivot to relevant in this situation. Also, Cloudflare (provider of the external service you mention, assuming you're talking about DNS-over-HTTPS) definitely isn't Google. At least not yet.
      - encryptluks2 5y ago
        No, I'm talking about their browser protection feature that is supposed to check for malware and unsafe domains.
        dcow 5y ago
        Doesn't that use a bloom filter? So in reality it’s very few if any of the urls you visit are actually sent anywhere.
  - ehsankia 5y ago
- supernovae 5y ago
  It's tech that only benefits Google.
  - encryptluks2 5y ago
    How does not opting out as a website owner benefit Google?
    - _underfl0w_ 5y ago
      Please read TFA. It answers this question.
  - oh_sigh 5y ago
    Doesn't it also benefit anyone who buys ads or anyone who displays ads?
    - supernovae 5y ago
      No, it benefits google and google margins only. Ads have been on a downward trend for ad partners for years, you will never see a dime from giving google more data. This FLoC network should be opt in and it should be revenue sharing for all partners that participate. We need to stop giving google all our work for free.
- ComodoHacker 5y ago
  It can harm them at least one way: they wouldn't be able to monetize Apple users.
  - danaris 5y ago
    ...What the hell does Apple have to do with this?
- JI00912 5y ago
  On an individual level it doesn't. It takes time and makes such a small difference that it's pointless. Google knows this of course. The result is that they can claim people can opt out, while in practice they run a giant surveillance network.
- josefx 5y ago
  Say you are running a page selling car parts, but aren't paying Google to run ads. Not opting out means that your customers now get targeted ads from your competition. Unless your are paying Google large amounts of money to mainly show your ads not opting out seems like the wrong choice.
zenincognito 5y ago
Only a little bit of time before the opting out process is made redundant by some API that will break somewhere or something that will be brought in as an RFC in chrome. Chrome's & Android's entire existence is to ensure Google ads business survives. This until Google can find another business that produces the same returns or dies. I wish there were more entities that would focus on developing tools for open web. Open web as we used to know is dying.
- kovac 5y ago
  I think the state of affairs with the mobile world is the worst. I can't help but think that Android was the worst disaster that happened to software industry. Android corrupted the ethos of FOSS, decimated all hopes for privacy, contributed to destroying the environment, stripped users of freedom of choice. I think it'll take a very special group of people to reverse the tide.
  - m4x 5y ago
    Can you elaborate on why you think Android is a disaster? Particularly the environmental aspect and freedom of choice. If android didn't exist then iOS might be the only major mobile OS, so in that sense at least it seems to be good that Android exists. It would be much better if it wasn't widely used as a carrier for Google's ecosystem and spyware, of course.
    - mrighele 5y ago
      Most of the people outside the US cannot afford an iOS device, so my guess is that missing Android there would be something else (Blackberry ? Windows Mobile ? who knows how it would have gone)
      - kristopolous 5y ago
        honestly with the rise of the web-app based phone app platforms (react/ionic etc) becoming almost "standard" the friction for porting to a hypothetical third platform goes down substantially. Ignoring the branding law of duality (that generally only 2 brands occupy the supermajority of a product category) and looking only at technical barriers, now looks to be better than ever for a third platform to possibly arise - especially given the rise of ARM SoCs.
edent 5y ago
Why isn't this opt-in? I'm sick of having to add yet another config option every time some Web giant decides it is OK to abuse my website and my visitors.
- ulfw 5y ago
  It's always the same web giant.
- JI00912 5y ago
  Because people wouldn't. :)
- sanxiyn 5y ago
  We should make this opt-in, by emitting the header by default in Apache and nginx and requiring special configuration to remove the header.
  - thinkingemote 5y ago
    Also, to standard GO, Ruby/Rails, php, JS net libraries.
  - ognarb 5y ago
    Yeah that should be the default configuration shipped with Apache httpd. If apache is refuse to add the header, I'm sure it will be possible to convince many distros to add it
  - account42 5y ago
    No, we should absolutely not bloat every HTTP response just because Google wants to abuse its users. Not to mention that widespread use of this header will result in it being ignored entirely just like happened to DNT. The proper reponse is to a) convince people to stop using Chrome and other Google software and b) campaign for legislation and antitrust enforcement and c) remove google ads, analytics and any other Google scripts from your websites.
- dspillett 5y ago
  > Why isn't this opt-in? Who would opt in if it was? What benefit would there be to opting in? Unless Google make it a benefit in search rankings in which case some (possibly many) will for SEO purposes, bit still not enough I'd wager (and the balance would be such that lower quality sites, that prioritise SEO over actually useful content, would be the majority of those that went for it). This feels a bit like way-back-when, when BT and a couple of other UK ISPs toyed with a system that would insert ads into web content, sometimes replacing existing ads, simultaneously bothering their users (to make money out of them on top of existing subscription payments), screwing site runners (being associated with ads they had no control or even knowledgeless knowledge of, and potentially losing ad revenue), and screwing other advert providers.
jedwhite 5y ago
Add a simple header to block FLoC on your website (fortunately): `permissions-policy: interest-cohort=()` It's only deployed on a test set of Chrome browsers so far, and it does create a warning message on browsers that don't support it. [1] [1] https://stackoverflow.com/questions/66997942/error-with-permissions-policy-header-when-using-chromedriver-to-a-headless-br https://stackoverflow.com/questions/66997942/error-with-perm... Edit to note support for blocking this!
- lstamour 5y ago
  That said, according to that StackOverflow page, the error only appears in DevTools. That's not as bad as it sounded at first. I was worried it would be an IE-style alert on page load, for example, or a visible bar across the top of the page. It's not, it's just spam in the DevTools console.
  - jedwhite 5y ago
    That's correct. I posted that answer on StackOverflow, and as far as I can tell from testing so far, it is just a warning in the DevTools console as noted on the StackOverflow answer, and there shouldn't be any other negative impact :)
- deleted 5y ago
  [deleted]
- aledalgrande 5y ago
  That works until it breaks or Google deprecates it and then ooops, you're included in FLoC too! :/
  - qweerty 5y ago
    Just block Chrome users, nothing of value lost.
- pbhjpbhj 5y ago
  Isn't this the sort of thing .well-known is for? Presumably Google are doing it this way because less people can create headers than can make a text file.
imwillofficial 5y ago
Anyone have any idea how one might do this in a Ghost Blog? Outside of putting cloud flare in front?
- afrazkhan 5y ago
  Put Nginx in front.
  - imwillofficial 5y ago
    No.
- shakna 5y ago
  Add the HTML equivalent to the document head: <meta http-equiv="Permissions-Policy" content="interest-cohort=()" />
  - mellavora 5y ago
    Hey, thanks for this! I've seen several posts now saying that all you need to do is add ``` Permissions-Policy: interest-cohort=() ``` somewhere, but they all seemed to assume that everyone knew where that where was (nginx config? webserver config? index.html? ??? ??????
    - majewsky 5y ago
      It's an HTTP header, so follow the documentation for your tooling for how to add custom HTTP headers.
    - shakna 5y ago
      When you see something along the lines of: Foo: things This will generally be a HTTP Header. How you add that depends on your server/framework. (And will be well documented). If you've only got a static site, then you can always fallback and use HTML to achieve the same thing with http-equiv, which gets added to the head element: <meta http-equiv="Foo" content="things" /> For example to redirect to /foo after 3 seconds: <meta http-equiv="Refresh" content="3; /foo" /> It's a little off the beaten track for most people, but the kind of knowledge a web developer can be expected to know, or know where to look in the documentation. Hopefully that can help you in your future endeavours.
dannyw 5y ago
Let me get this straight: even if my site has no ads or trackers, Chrome will now use my visitors data for advertising and surveillance??? Does anyone else see FLoC as worse than the current state we're in?
- _underfl0w_ 5y ago
  Definitely worse, but also the next logical step given that an ad company has achieved relative browser dominance and has such weight to throw around in defining web standards. Moves like this were inevitable. Writing's been on the wall a while now too.
- aaronharnly 5y ago
  It seems not. The FLoC page (https://web.dev/floc/ https://web.dev/floc/) says: > For pages that haven't been excluded, a page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources.
  - Dunedan 5y ago
    Excluding a page is a manual process however, requiring to set the header mentioned in the blog post. So website owners have to explicitly opt-out of FLoC.
    - retor 5y ago
      Yeah, but that is only necessary if the page contains ads or ads-related resources, right? That’s how I interpret the previous quote.
      - dspillett 5y ago
        Yeah and the system will never accidentally see something not advert related as advert related and turn the option on. Things like that never happen. And when that does happen, Google is famously transparent in its actions and easy to contact to resolve such issues. (You may detect a little touch of sarcasm above!)
peanut_worm 5y ago
I think I will just block Chrome users from my websites
- jaimex2 5y ago
  Absolutely. Block page with instructions on how to gain access.
- CraftingLinks 5y ago
  This!
- scaglio 5y ago
  That's interesting and ethical by providing suggestions as alternatives! I'd be interested too, but I can't find much on the web... do you guys have any instructions/link?
  - prox 5y ago
    You mean blocking the agent or do you mean other browsers?
    - scaglio 5y ago
      Blocking on my site the access from the Chrome browser only, or displaying a banner page – e.g. "You are using Chrome, thou shall not pass"
      - prox 5y ago
        You have to capture the agent that is visiting and doAction() when it finds it. Here is adecent article: https://geekflare.com/block-unwanted-requests/ https://geekflare.com/block-unwanted-requests/
        scaglio 5y ago
        Thank you, I hoped it could be done from the website code. Currently I have a Hugo blog hosted on ahem Firebase – not the best de-Googled solution. :)
kjrose 5y ago
Waiting for google to make this a ranking factor for SEO like they did with amp.
- gingerlime 5y ago
  Do you know if the algorithm favours sites with GA as a positive SEO ranking factor? or am I going into tin hat territory here?
  - mike_d 5y ago
    No, they don't know. SEO is 100% pure speculation, as there is no way to validate why Google ranks things the way they do. The only people who do know for sure are closely monitored Google employees who value their bonuses.
  - o_m 5y ago
    No, if anything it will affect your site negtivly because it will make your site slightly slower. I suggest ignoring the tinfoil hat SEO community and follow the official Google guidelines.
    - rchaud 5y ago
      I can't think of many sites these days (that aren't personal blogs) that don't have some kind of analytics built into it.
- whoisjuan 5y ago
  That’s probably already the case. This is a common area of speculation in the SEO community. Trying to figure what factors are used by Google to determine the ranking. People will add it in their configs and anecdotally perceive that it has an impact in their rankings. It would likely become a must for SEO. This a reflection of how incredibly genius the original PageRank was. It’s what makes Google the business it is. It’s almost like a small model of free market behavior. Except that in this case Adam Smith’s invisible hand is Google. That’s what makes Google so powerful and scary.
berniemadoff69 5y ago
> add_header Permissions-Policy interest-cohort=(); what does that even do?
- Ndymium 5y ago
  It adds a header "permissions-policy" to the HTTP response with the value "interest-cohort=()". This turns off the FLoC feature for the site in Google Chrome.
  - berniemadoff69 5y ago
    im specifically asking about the nature of the value "interest-cohort=()" , it's being presented as some thing to just inject into your nginx conf file to make floc go away or whatever, but im wondering why the value needs to equal "()" etc.
    - Ndymium 5y ago
      The format of the Permissions-Policy header is roughly <permission>=(<allowlist>). An empty list allows no origins (not even the current page), so the feature is turned off.
1vuio0pswjnm7 5y ago
Perhaps someone will set up a remote^1 web proxy that adds the suggested "Permissions-Policy: interest-cohort=()" HTTP header to disable FLoC. Browser extensions are great but there is nothing to stop Google from removing access to them through the Play Store at any time. 1. Another alternative is to run the proxy locally. I run a web proxy bound to the loopback.
- pjerem 5y ago
  That’s a lot of work when all you have to do is to switch to another browser.
  - 1vuio0pswjnm7 5y ago
    The browser I use does not process Javascript or CSS. I therefore have to do nothing. :) However, I would guess switching browsers is extremely unlikely for a great number of users. Google must know that. That is why they can do something like FLoC. They must know that not many users are going to switch browsers.
    - pjerem 5y ago
      I agree, but those users are not willing to setup a proxy just to disable FLoC headers either.
      - 1vuio0pswjnm7 5y ago
        I was not suggesting it would be users who set up the proxy. On the contrary I was suggesting we might see someone set up a proxy to help users who are unable/unwilling to help themselves. There are so many simple things I do for myself that I see being set up as "SaaS"-type projects/businesses and then posted/discussed on HN.
leonewton253 5y ago
Theres a price to privacy. When I was younger I jumped on the bandwagon and for a period only used Firefox with cookie autodelete and cache cleared every exit. Now I just see it as being asocial. If Google didn't monetize search with ads how would you discover new products? Without ads websites would not be able to deliver premium content and we would all still be stuck in the early 90s. The internet would work like some broken socialist version of wikipedia. I have ad free YouTube and sometimes I consider turning it off just to see what kinds of ads are out there that I've missed.
- zentiggr 5y ago
  Without tracking-fed ads, the internet would work like a super powered version of the directory style setup like we had before Google suborned the very idea of 'the web'. I'd love to see an internet of individual directory sites, some of which could be 'pay for placement', some of which would be hand curated, others could be algorithmically built... So much better than Web == Google homepage == "What's a search? I type in where I want to go and click on the first thing I see"
deleted 5y ago
[deleted]
CaptainZapp 5y ago
What happens if you opt out? Nice website you have here. Would be a shame if no one can find it?
- sss111 5y ago
  how hard would it be to build something to replace google? The search engine
  - rchaud 5y ago
    I think web directories might come back. It's not a search engine per se, but like how Craigslist works....websites listed under a bunch of categories. I miss the days when you'd click on sites inside the Yahoo! directory just because they had a cool or funny domain name. Search probably saved us several years worth of time, but at the same time made it almost impossible to randomly come across sites in your category that are bizarre or unconventional.
    - sss111 5y ago
      I miss them too! It's not the Yahoo! directory, but I have a feeling you will like this subreddit: https://www.reddit.com/r/InternetIsBeautiful/ https://www.reddit.com/r/InternetIsBeautiful/
bjt2n3904 5y ago
> How to opt-out of FLoC as a web developer: Set a Permissions Policy Nah, this isn't enough. Redirect chrome User-Agents to stop-using-google-chrome.com Will you lose users? Yeah. But don't worry, you'll lose them anyways when Google decides to unperson your website like they did with Parler.
deleted 5y ago
[deleted]
JI00912 5y ago
Can website owners do anything to hinder this Google surveillance network? E.g. feeding it bad data. And I don't mean opting out. Asking them nicely and hoping they respect that is not good enough.
kerng 5y ago
Today I looked at the source code of Chrome where this is implemented, so I'd understand it better. It made me realize that there is indeed (of course) software engineers (meaning: people) working on this who actually write that code. Does a high salary justify working on such features, or are modern day software engineers more like factory workers? I think not because most software engineers have a choice. Been thinking about this a lot afterwards.
- chii 5y ago
  > I think not because most software engineers have a choice. most people care more about their own interests than the interests of society in general. Only when collectively devising laws would society take the interest of society over individuals. Therefore, software engineers are fully justified at making software that is deemed unethical, but still take the stance that it is unethical. You might call it hypcracy but i say it's practicality. Legislation should be introduced to perform the function of ensuring ethical standards, not altruism on the part of the individual.
  - girvo 5y ago
    They’re allowed to take that stance, sure, but I’m allowed to judge them for it. Ignoring your own morals just to make a buck isn’t a good thing. Otherwise we should all just become drug dealers.
- izacus 5y ago
  People around the world build machines that melt skin off of children in Middle East for quarter of that pay. Even in America. And they're proud of it too. Time to look outside of tech bubble perhaps?
  - skinkestek 5y ago
    > People around the world build machines that melt skin off of children in Middle East There is a problem with that statement and I will try to highlight it by creating a couple more of the same: - There are people working to build software to allow people to share child porn without getting caught (about Moxie and anyone working to bring e2e-encryption to the masses) - there were people working in factories that created hammers that were used to crush peoples skulls in Cambodia See where I am going?
1_person 5y ago
I think the obvious thing to do is block the user agent, and inform the user that they need to upgrade to access this content without forfeiting a collective right to privacy
jahewson 5y ago
Has nobody bothered to read anything about FLoC? The purpose of this permission is to prevent embedded third-party content from using FLoC. Besides that it’s a no-op. FLoC does not track arbitrary websites, it tracks sites which retrieve the FLoC cohort via JS. So instead of dropping a unique third party cookie, and associating it with the data on the page, sites can now retrieve a k-anonymous cohort id and associate it with the data on the page. If you’re not doing that (or serving ads) there’s nothing you need to do. That’s not to say that FLoC doesn’t deserve criticism just that most criticism I’ve encountered is not grounded in reality.
- aww_dang 5y ago
  https://github.com/WICG/floc/issues/82 https://github.com/WICG/floc/issues/82 >During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources. Who's to say how this evolves in the future?
  - kreeben 5y ago
    "During trial we had so much success with our auto-opt-in mechanism (and grew so fond of being omnipotent) we've decided to make it a permanent feature."
    - aww_dang 5y ago
      Ad-related resources is loosely defined. There's unlimited potential for other rationales.
- jedwhite 5y ago
  According to the W3C Federated Learning of Cohorts Draft Community Group Report, 13 April 2021, Paragraphs 3 & 7.1.1: "The interest cohort API lives under the Document interface since the access permission is tied to the document scope, and the API is only available if the document is in secure context." and "The page can opt itself out of the interest cohort computation through the "interest-cohort" policy-controlled feature. [PERMISSIONS-POLICY]" [1] [1] https://wicg.github.io/floc/ https://wicg.github.io/floc/ Edit for para reference.
bestboy 5y ago
Is it really necessary to add this header to each and every response?! I feel like it might be sufficent to add this header just to documents like *.html.
deleted 5y ago
[deleted]
euske 5y ago
Ha. This just occurred to me - Google is a search engine of websites for many people, but at the same time it is a search engine of people for many advertisers. We thought we were looking for something but actually we were constantly searched.
- freebuju 5y ago
  Ha. They do this everywhere not just on Chrome. In your gmail. Youtube. In your smartphone, google apps. Basically any google product should be expected to spy on you. You are the product in Google's grand scheme. The ad buyers are their customers.
greatgib 5y ago
Isn't a way for websites to poison the results instead? Like sending a random cohort info with each page loaded?
- zentiggr 5y ago
  Not when the algorithm is controlled by Google. Just like SEO efforts. Google will tweak their FLoC generation to ensure they get what they want out of it.
dastx 5y ago
Maybe it's time for developers to help with the fight back. Break things in Chrome, and encourage people to use Firefox. The amount of time I've been told to use Chrome is ridiculous. I regret being part of the crowd who jump on the Chrome bandwagon when it came out all those years ago. Having to explicitly opt out regardless of what you do is terrible. So now you're telling me that I have consciously disable it every time I create a new website/page? How do we force Google to stop this?
- gregoriol 5y ago
  Sadly most users don't even know that they are using Chrome or Firefox or that these have a version number. So breaking up things for them won't help, they won't make the switch... It has to be a regulatory decision imposed on Google, much like when Microsoft was forced to do something about Internet Explorer long time ago.
amaurino 5y ago
Hi, I just tested this for my wordpress website (https://iode.tech https://iode.tech) and it broke it, do you have any ideas why? Thanks for your help Antoine
bryanrasmussen 5y ago
Ideas - if all it takes to block is adding header `permissions-policy: interest-cohort=() 1. Github has all those bots that suggest security improvements to your code - maybe they should also suggest privacy improvements to your code. 2. Governmental sites should be changed to always require this. 3. How about a plugin that when it gets a site without the header informs user via colored tab or similar solution. I suppose Google would try to remove it from add-ons, but then that would be fuel for the inevitable lawsuits complaining this whole thing was anti-competitive and monopolistic behavior on Google's part.
- darekkay 5y ago
  There are also tools that check your HTTP headers. While securityheaders checks for Permission-Policy being used, I can imagine it will be improved to check for the "interest-cohort" value in the future. - https://securityheaders.com https://securityheaders.com - https://observatory.mozilla.org https://observatory.mozilla.org
gorhill 5y ago
> there is a workaround that involves adding `meta` tags to your pages themselves This does not work, `http-equiv` does not work for `Permissions-Policy`.[1] * * * [1] https://github.com/WICG/floc/pull/47#issuecomment-786966847 https://github.com/WICG/floc/pull/47#issuecomment-786966847
- oedmarap 5y ago
  Thank you, I've been made aware of this and have amended the post to clarify that it's ineffective w.r.t. FLoC; for the technical reason that you mentioned.
nirui 5y ago
Curious. How many of you actually brought something just because a machine/stranger recommended it to you? For me, it's almost never. I watch YouTube a lot, as a free tier user, of course. When a video starts to play, all my focus is automatically dead-locked on the "Skip Ad" button, and sometimes "Skip trial". It's a game for me now to see how fast I can tap the "Skip". As for the content of the Ad, well, usually I ignored it all together. Sometimes, when I'm away from the phone and suddenly a some 50 hours long Ad starts to play, I'll just continue finishing what's on hand first, and then go to my phone to tap "Skip" or switch to Twitter or Telegram to see whats fun over there -- all without notice what the Ad was saying. Yes, sometime, some annoying Ad got into my head anyway, but ... why should I buy something that annoys me? For me, the most effective Ad are those what I'm actively looking for. For example, if I'm looking for a running shoes, I'll click the Ad on the search page and/or listings page to see if there is a good product/deal. And I'll stop click those as soon as I made the purchase. So personally, I don't really understand the idea of Tracking Your Every Move So We Can Sell You Stuff. How it even works? Now if you remember this: https://news.ycombinator.com/item?id=14879204 https://news.ycombinator.com/item?id=14879204
- deleted 5y ago
  [deleted]
- ripdog 5y ago
  What's really curious is that you aren't using ublock origin. Life's too short to be harassed by marketing.
  - nirui 5y ago
    It sound funny, but sometimes, those ads contains some information that might spark the curiosity in me. For example, there was an ad about some gangster/mafia game, the ad itself was absolute ridicules for my taste, however, the game itself received ~4.3 stars rating on Google Play, which is completely contrary to my expectation -- other people think it's not a bad game, it's just me not understanding it well enough. Look, I live a simple life, the world in my eyes is narrow, which is bad for me as a (self entitled LOL) developer. So if getting harassed for 5 seconds is what it takes to widen my view a bit, I think I'll take it :D Of course I never downloaded the game, so it's still an ineffective advertisement for them.
jillesvangurp 5y ago
Done, just added the the header to my .htaccess. No big deal. 1 minute work. In general a good idea to just be on top on what headers your web site actually sends and generally know what you are doing with things like cookies, etc. on behalf of your users. That's already something you need to do and be on top off for legal reasons. Just because lots of website maintainers are kind of indifferent/hands off/sloppy/ignorant on this front does not mean it's OK for you to be that way. This is just another thing to take a conscious decision about and pay attention to. Things that you are in any case supposed to know and pay attention to. Comes with the job of running a website. Your content, your problem to deal with. Or not. Normal due diligence. Should be business as usual.
timvisee 5y ago
By adding this header, does Chrome just stop sending the FLoC ID? Or does it also prevent Chrome using your site to build up the users FLoC profile.
roody15 5y ago
Very dystopian to think Google is normalizing the idea enabling an ad tracking profile built into the browser itself. The very notion that users need to be tracked and fingerprinted/profiled from site to site is asinine. Advertising worked before the concept of tracking on the web. Companies simply paid for contextual ads based on the site. For example visit a site that covers college basketball and advertisers would pay to put ads here for sports gear, sports equipment etc, Go to a site that covers how to keep a nice lawn and advertisers would pay to place ads for mowers, fertilizers, etc. The very idea that it is normal to have a specific adverting profile assigned to you to track you all over the web is disturbing.
karmakaze 5y ago
Opting your site out of FLoC is good advice. Using and promoting the use of Firefox is better/complementary advice.
_Understated_ 5y ago
Ok, so let me see if I understand this correctly: I run a website with no trackers, no ads, nothing at all to do with Google or any other company in any way. You come along, with Google Chrome, and visit my site. Google adds the fact that you visited my site to their massive dataset (as well as who-knows-what-else) And to opt out of something I have never been asked to be involved with in any way, I need to contact Google and ask them to please leave my site alone? Am I understanding this shit correctly? Whether I like it or not, my site, by proxy, is participating in Google's data mining? If my guess is correct, how the actual fuck is this not illegal? Edit: Ok, I guess I'm off the mark here with my assumptions so I'll put my pitchfork down. Google are just using your Chrome browsing data, matching it with site id's (or hashes?) and then analysing the shit out of it for their gain. As a website owner, nothing has changed other than I can tell them not to use my site as part of their analysis... that sound about right?
- npteljes 5y ago
  Why would you control what people use to visit your website? By leaving your website on the open web, you contribute to a bunch of other things, bots parse it left and right, rank it among other websites, archive.org makes snapshots, and not one of them had you opt in. How is this current case different?
- lucideer 5y ago
  > my site, by proxy, is participating I'm 100% against this whole FLoC thing but I really cannot understand this conclusion. If I drive through a McDonald's drivethrough, and Android/iOS/Fitbit/Tesla/whomever records my journey via GPS, they know I ate a McDonald's but McDonald's the company has not directly "participated" in any tracking of any kind.
- rchaud 5y ago
  It's the browser that's the issue, not your site. Seems similar to the Google Street View issue. They took pictures of public places, and you had to manually request to have your face or identifying info removed, if they were revealed. The website is public in the same way as it can be accessed by any browser and isn't blocking search robots.
jefftk 5y ago
If your site does not call document.interestCohort() or include ads, Chrome will already not consider your site in computing FLoC: A page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources. -- https://web.dev/floc/ https://web.dev/floc/ Detecting "ads or ads-related resources" uses a filter derived from EasyList: https://github.com/chromium/chromium-ads-detection/blob/master/third_party/filter_lists/9.22.0/filter_list https://github.com/chromium/chromium-ads-detection/blob/mast... (Disclosure: I work for Google, speaking only for myself)
lawwantsin17 5y ago
This only works if google respects headers. Which they obviously don't have to. In other words, it'll be shadow tracking either way.
cyberpanther 5y ago
OK I'm thinking you could write a simple extension that could add the header for every request and disable this everywhere effectively disabling FLoC. I am missing something or would this be really easy to hack and disable?
- cyberpanther 5y ago
  Looks like it's already there: https://chrome.google.com/webstore/detail/nofloc/egnfijfbeijcildnopmgpflofoobmece?utm_source=chrome-app-launcher https://chrome.google.com/webstore/detail/nofloc/egnfijfbeij...
RileyJames 5y ago
I wish they’d gone with “floc: off” as the header. Would have been a more satisfying change to make.

586 points by oedmarap 5y ago

encryptluks2 5y ago

How does it benefit website owners to opt out?

cratermoon 5y ago
Let me turn the question around: to what extent are website owners who do not opt out accomplices with Google in the privacy violations implicit in their creepy surveillance profiling tech?
- imwillofficial 5y ago
  accomplices invokes images of people “in” on the conspiracy. In my rough estimation based on nothing, I’d guess most website owners have no idea this is an issue that needs fixing. Your rhetoric is inflammatory, inaccurate, and does your side of the argument harm by making the whole argument look absurd.
- encryptluks2 5y ago
  Let's rephrase that... to what extent are website owners who do not opt accomplices with Google, Microsoft, Facebook, Twitter, Instagram, Amazon, etc. Please also note that Firefox enables multiple telemetry features by default, such as safe browsing lists that checks links you visit presumably also tracking your URLs in the process.
  - fabrice_d 5y ago
    Please read about how safe browsing works in Firefox (https://wiki.mozilla.org/Security/Safe_Browsing https://wiki.mozilla.org/Security/Safe_Browsing): it's using the privacy respecting update API described at https://developers.google.com/safe-browsing/v4/ https://developers.google.com/safe-browsing/v4/
- PradeetPatel 5y ago
  I often think of it as: As a website owner, will partnering with Google - a market leader in the advertisement space have a direct negative impact on me and my stakeholders? If not, it has been observed that there's very little incentive to communicate that change through. As much as I'd like to believe that altruism will win in the end, it has been established that ultimately the capacity to gain materialistic advantages can often triumph over individual's judgements.
dcow 5y ago
Presumably things that promote a healthy internet also benefit website owners since their sites exist on the internet.
- encryptluks2 5y ago
  Does Firefox sending URLs you visit to a an external service not constitute as unhealthy?
  - dcow 5y ago
    You can opt out of that (or is it opt in now), too.
    - encryptluks2 5y ago
      You can opt out with Chromium too
  - _underfl0w_ 5y ago
    "What about $otherthing?" Neither is good, but that doesn't necessarily make the topic you're attempting to pivot to relevant in this situation. Also, Cloudflare (provider of the external service you mention, assuming you're talking about DNS-over-HTTPS) definitely isn't Google. At least not yet.
    - encryptluks2 5y ago
      No, I'm talking about their browser protection feature that is supposed to check for malware and unsafe domains.
      - dcow 5y ago
        Doesn't that use a bloom filter? So in reality it’s very few if any of the urls you visit are actually sent anywhere.
- ehsankia 5y ago
supernovae 5y ago
It's tech that only benefits Google.
- encryptluks2 5y ago
  How does not opting out as a website owner benefit Google?
  - _underfl0w_ 5y ago
    Please read TFA. It answers this question.
- oh_sigh 5y ago
  Doesn't it also benefit anyone who buys ads or anyone who displays ads?
  - supernovae 5y ago
    No, it benefits google and google margins only. Ads have been on a downward trend for ad partners for years, you will never see a dime from giving google more data. This FLoC network should be opt in and it should be revenue sharing for all partners that participate. We need to stop giving google all our work for free.
ComodoHacker 5y ago
It can harm them at least one way: they wouldn't be able to monetize Apple users.
- danaris 5y ago
  ...What the hell does Apple have to do with this?
JI00912 5y ago
On an individual level it doesn't. It takes time and makes such a small difference that it's pointless. Google knows this of course. The result is that they can claim people can opt out, while in practice they run a giant surveillance network.
josefx 5y ago
Say you are running a page selling car parts, but aren't paying Google to run ads. Not opting out means that your customers now get targeted ads from your competition. Unless your are paying Google large amounts of money to mainly show your ads not opting out seems like the wrong choice.

zenincognito 5y ago

Only a little bit of time before the opting out process is made redundant by some API that will break somewhere or something that will be brought in as an RFC in chrome. Chrome's & Android's entire existence is to ensure Google ads business survives. This until Google can find another business that produces the same returns or dies. I wish there were more entities that would focus on developing tools for open web. Open web as we used to know is dying.

kovac 5y ago
I think the state of affairs with the mobile world is the worst. I can't help but think that Android was the worst disaster that happened to software industry. Android corrupted the ethos of FOSS, decimated all hopes for privacy, contributed to destroying the environment, stripped users of freedom of choice. I think it'll take a very special group of people to reverse the tide.
- m4x 5y ago
  Can you elaborate on why you think Android is a disaster? Particularly the environmental aspect and freedom of choice. If android didn't exist then iOS might be the only major mobile OS, so in that sense at least it seems to be good that Android exists. It would be much better if it wasn't widely used as a carrier for Google's ecosystem and spyware, of course.
  - mrighele 5y ago
    Most of the people outside the US cannot afford an iOS device, so my guess is that missing Android there would be something else (Blackberry ? Windows Mobile ? who knows how it would have gone)
    - kristopolous 5y ago
      honestly with the rise of the web-app based phone app platforms (react/ionic etc) becoming almost "standard" the friction for porting to a hypothetical third platform goes down substantially. Ignoring the branding law of duality (that generally only 2 brands occupy the supermajority of a product category) and looking only at technical barriers, now looks to be better than ever for a third platform to possibly arise - especially given the rise of ARM SoCs.

edent 5y ago

Why isn't this opt-in? I'm sick of having to add yet another config option every time some Web giant decides it is OK to abuse my website and my visitors.

ulfw 5y ago
It's always the same web giant.
JI00912 5y ago
Because people wouldn't. :)
sanxiyn 5y ago
We should make this opt-in, by emitting the header by default in Apache and nginx and requiring special configuration to remove the header.
- thinkingemote 5y ago
  Also, to standard GO, Ruby/Rails, php, JS net libraries.
- ognarb 5y ago
  Yeah that should be the default configuration shipped with Apache httpd. If apache is refuse to add the header, I'm sure it will be possible to convince many distros to add it
- account42 5y ago
  No, we should absolutely not bloat every HTTP response just because Google wants to abuse its users. Not to mention that widespread use of this header will result in it being ignored entirely just like happened to DNT. The proper reponse is to a) convince people to stop using Chrome and other Google software and b) campaign for legislation and antitrust enforcement and c) remove google ads, analytics and any other Google scripts from your websites.
dspillett 5y ago
> Why isn't this opt-in? Who would opt in if it was? What benefit would there be to opting in? Unless Google make it a benefit in search rankings in which case some (possibly many) will for SEO purposes, bit still not enough I'd wager (and the balance would be such that lower quality sites, that prioritise SEO over actually useful content, would be the majority of those that went for it). This feels a bit like way-back-when, when BT and a couple of other UK ISPs toyed with a system that would insert ads into web content, sometimes replacing existing ads, simultaneously bothering their users (to make money out of them on top of existing subscription payments), screwing site runners (being associated with ads they had no control or even knowledgeless knowledge of, and potentially losing ad revenue), and screwing other advert providers.

jedwhite 5y ago

Add a simple header to block FLoC on your website (fortunately): `permissions-policy: interest-cohort=()` It's only deployed on a test set of Chrome browsers so far, and it does create a warning message on browsers that don't support it. [1] [1] https://stackoverflow.com/questions/66997942/error-with-permissions-policy-header-when-using-chromedriver-to-a-headless-br https://stackoverflow.com/questions/66997942/error-with-perm... Edit to note support for blocking this!

lstamour 5y ago
That said, according to that StackOverflow page, the error only appears in DevTools. That's not as bad as it sounded at first. I was worried it would be an IE-style alert on page load, for example, or a visible bar across the top of the page. It's not, it's just spam in the DevTools console.
- jedwhite 5y ago
  That's correct. I posted that answer on StackOverflow, and as far as I can tell from testing so far, it is just a warning in the DevTools console as noted on the StackOverflow answer, and there shouldn't be any other negative impact :)
deleted 5y ago
[deleted]
aledalgrande 5y ago
That works until it breaks or Google deprecates it and then ooops, you're included in FLoC too! :/
- qweerty 5y ago
  Just block Chrome users, nothing of value lost.
pbhjpbhj 5y ago
Isn't this the sort of thing .well-known is for? Presumably Google are doing it this way because less people can create headers than can make a text file.

imwillofficial 5y ago

Anyone have any idea how one might do this in a Ghost Blog? Outside of putting cloud flare in front?

afrazkhan 5y ago
Put Nginx in front.
- imwillofficial 5y ago
  No.
shakna 5y ago
Add the HTML equivalent to the document head: <meta http-equiv="Permissions-Policy" content="interest-cohort=()" />
- mellavora 5y ago
  Hey, thanks for this! I've seen several posts now saying that all you need to do is add ``` Permissions-Policy: interest-cohort=() ``` somewhere, but they all seemed to assume that everyone knew where that where was (nginx config? webserver config? index.html? ??? ??????
  - majewsky 5y ago
    It's an HTTP header, so follow the documentation for your tooling for how to add custom HTTP headers.
  - shakna 5y ago
    When you see something along the lines of: Foo: things This will generally be a HTTP Header. How you add that depends on your server/framework. (And will be well documented). If you've only got a static site, then you can always fallback and use HTML to achieve the same thing with http-equiv, which gets added to the head element: <meta http-equiv="Foo" content="things" /> For example to redirect to /foo after 3 seconds: <meta http-equiv="Refresh" content="3; /foo" /> It's a little off the beaten track for most people, but the kind of knowledge a web developer can be expected to know, or know where to look in the documentation. Hopefully that can help you in your future endeavours.

dannyw 5y ago

Let me get this straight: even if my site has no ads or trackers, Chrome will now use my visitors data for advertising and surveillance??? Does anyone else see FLoC as worse than the current state we're in?

_underfl0w_ 5y ago
Definitely worse, but also the next logical step given that an ad company has achieved relative browser dominance and has such weight to throw around in defining web standards. Moves like this were inevitable. Writing's been on the wall a while now too.
aaronharnly 5y ago
It seems not. The FLoC page (https://web.dev/floc/ https://web.dev/floc/) says: > For pages that haven't been excluded, a page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources.
- Dunedan 5y ago
  Excluding a page is a manual process however, requiring to set the header mentioned in the blog post. So website owners have to explicitly opt-out of FLoC.
  - retor 5y ago
    Yeah, but that is only necessary if the page contains ads or ads-related resources, right? That’s how I interpret the previous quote.
    - dspillett 5y ago
      Yeah and the system will never accidentally see something not advert related as advert related and turn the option on. Things like that never happen. And when that does happen, Google is famously transparent in its actions and easy to contact to resolve such issues. (You may detect a little touch of sarcasm above!)

peanut_worm 5y ago

I think I will just block Chrome users from my websites

jaimex2 5y ago
Absolutely. Block page with instructions on how to gain access.
CraftingLinks 5y ago
This!
scaglio 5y ago
That's interesting and ethical by providing suggestions as alternatives! I'd be interested too, but I can't find much on the web... do you guys have any instructions/link?
- prox 5y ago
  You mean blocking the agent or do you mean other browsers?
  - scaglio 5y ago
    Blocking on my site the access from the Chrome browser only, or displaying a banner page – e.g. "You are using Chrome, thou shall not pass"
    - prox 5y ago
      You have to capture the agent that is visiting and doAction() when it finds it. Here is adecent article: https://geekflare.com/block-unwanted-requests/ https://geekflare.com/block-unwanted-requests/
      - scaglio 5y ago
        Thank you, I hoped it could be done from the website code. Currently I have a Hugo blog hosted on ahem Firebase – not the best de-Googled solution. :)

kjrose 5y ago

Waiting for google to make this a ranking factor for SEO like they did with amp.

gingerlime 5y ago
Do you know if the algorithm favours sites with GA as a positive SEO ranking factor? or am I going into tin hat territory here?
- mike_d 5y ago
  No, they don't know. SEO is 100% pure speculation, as there is no way to validate why Google ranks things the way they do. The only people who do know for sure are closely monitored Google employees who value their bonuses.
- o_m 5y ago
  No, if anything it will affect your site negtivly because it will make your site slightly slower. I suggest ignoring the tinfoil hat SEO community and follow the official Google guidelines.
  - rchaud 5y ago
    I can't think of many sites these days (that aren't personal blogs) that don't have some kind of analytics built into it.
whoisjuan 5y ago
That’s probably already the case. This is a common area of speculation in the SEO community. Trying to figure what factors are used by Google to determine the ranking. People will add it in their configs and anecdotally perceive that it has an impact in their rankings. It would likely become a must for SEO. This a reflection of how incredibly genius the original PageRank was. It’s what makes Google the business it is. It’s almost like a small model of free market behavior. Except that in this case Adam Smith’s invisible hand is Google. That’s what makes Google so powerful and scary.

berniemadoff69 5y ago

> add_header Permissions-Policy interest-cohort=(); what does that even do?

Ndymium 5y ago
It adds a header "permissions-policy" to the HTTP response with the value "interest-cohort=()". This turns off the FLoC feature for the site in Google Chrome.
- berniemadoff69 5y ago
  im specifically asking about the nature of the value "interest-cohort=()" , it's being presented as some thing to just inject into your nginx conf file to make floc go away or whatever, but im wondering why the value needs to equal "()" etc.
  - Ndymium 5y ago
    The format of the Permissions-Policy header is roughly <permission>=(<allowlist>). An empty list allows no origins (not even the current page), so the feature is turned off.

1vuio0pswjnm7 5y ago

Perhaps someone will set up a remote^1 web proxy that adds the suggested "Permissions-Policy: interest-cohort=()" HTTP header to disable FLoC. Browser extensions are great but there is nothing to stop Google from removing access to them through the Play Store at any time. 1. Another alternative is to run the proxy locally. I run a web proxy bound to the loopback.

pjerem 5y ago
That’s a lot of work when all you have to do is to switch to another browser.
- 1vuio0pswjnm7 5y ago
  The browser I use does not process Javascript or CSS. I therefore have to do nothing. :) However, I would guess switching browsers is extremely unlikely for a great number of users. Google must know that. That is why they can do something like FLoC. They must know that not many users are going to switch browsers.
  - pjerem 5y ago
    I agree, but those users are not willing to setup a proxy just to disable FLoC headers either.
    - 1vuio0pswjnm7 5y ago
      I was not suggesting it would be users who set up the proxy. On the contrary I was suggesting we might see someone set up a proxy to help users who are unable/unwilling to help themselves. There are so many simple things I do for myself that I see being set up as "SaaS"-type projects/businesses and then posted/discussed on HN.

leonewton253 5y ago

Theres a price to privacy. When I was younger I jumped on the bandwagon and for a period only used Firefox with cookie autodelete and cache cleared every exit. Now I just see it as being asocial. If Google didn't monetize search with ads how would you discover new products? Without ads websites would not be able to deliver premium content and we would all still be stuck in the early 90s. The internet would work like some broken socialist version of wikipedia. I have ad free YouTube and sometimes I consider turning it off just to see what kinds of ads are out there that I've missed.

zentiggr 5y ago
Without tracking-fed ads, the internet would work like a super powered version of the directory style setup like we had before Google suborned the very idea of 'the web'. I'd love to see an internet of individual directory sites, some of which could be 'pay for placement', some of which would be hand curated, others could be algorithmically built... So much better than Web == Google homepage == "What's a search? I type in where I want to go and click on the first thing I see"

deleted 5y ago

[deleted]

CaptainZapp 5y ago

What happens if you opt out? Nice website you have here. Would be a shame if no one can find it?

sss111 5y ago
how hard would it be to build something to replace google? The search engine
- rchaud 5y ago
  I think web directories might come back. It's not a search engine per se, but like how Craigslist works....websites listed under a bunch of categories. I miss the days when you'd click on sites inside the Yahoo! directory just because they had a cool or funny domain name. Search probably saved us several years worth of time, but at the same time made it almost impossible to randomly come across sites in your category that are bizarre or unconventional.
  - sss111 5y ago
    I miss them too! It's not the Yahoo! directory, but I have a feeling you will like this subreddit: https://www.reddit.com/r/InternetIsBeautiful/ https://www.reddit.com/r/InternetIsBeautiful/

bjt2n3904 5y ago

> How to opt-out of FLoC as a web developer: Set a Permissions Policy Nah, this isn't enough. Redirect chrome User-Agents to stop-using-google-chrome.com Will you lose users? Yeah. But don't worry, you'll lose them anyways when Google decides to unperson your website like they did with Parler.

deleted 5y ago

[deleted]

JI00912 5y ago

Can website owners do anything to hinder this Google surveillance network? E.g. feeding it bad data. And I don't mean opting out. Asking them nicely and hoping they respect that is not good enough.

kerng 5y ago

Today I looked at the source code of Chrome where this is implemented, so I'd understand it better. It made me realize that there is indeed (of course) software engineers (meaning: people) working on this who actually write that code. Does a high salary justify working on such features, or are modern day software engineers more like factory workers? I think not because most software engineers have a choice. Been thinking about this a lot afterwards.

chii 5y ago
> I think not because most software engineers have a choice. most people care more about their own interests than the interests of society in general. Only when collectively devising laws would society take the interest of society over individuals. Therefore, software engineers are fully justified at making software that is deemed unethical, but still take the stance that it is unethical. You might call it hypcracy but i say it's practicality. Legislation should be introduced to perform the function of ensuring ethical standards, not altruism on the part of the individual.
- girvo 5y ago
  They’re allowed to take that stance, sure, but I’m allowed to judge them for it. Ignoring your own morals just to make a buck isn’t a good thing. Otherwise we should all just become drug dealers.
izacus 5y ago
People around the world build machines that melt skin off of children in Middle East for quarter of that pay. Even in America. And they're proud of it too. Time to look outside of tech bubble perhaps?
- skinkestek 5y ago
  > People around the world build machines that melt skin off of children in Middle East There is a problem with that statement and I will try to highlight it by creating a couple more of the same: - There are people working to build software to allow people to share child porn without getting caught (about Moxie and anyone working to bring e2e-encryption to the masses) - there were people working in factories that created hammers that were used to crush peoples skulls in Cambodia See where I am going?

1_person 5y ago

I think the obvious thing to do is block the user agent, and inform the user that they need to upgrade to access this content without forfeiting a collective right to privacy

jahewson 5y ago

Has nobody bothered to read anything about FLoC? The purpose of this permission is to prevent embedded third-party content from using FLoC. Besides that it’s a no-op. FLoC does not track arbitrary websites, it tracks sites which retrieve the FLoC cohort via JS. So instead of dropping a unique third party cookie, and associating it with the data on the page, sites can now retrieve a k-anonymous cohort id and associate it with the data on the page. If you’re not doing that (or serving ads) there’s nothing you need to do. That’s not to say that FLoC doesn’t deserve criticism just that most criticism I’ve encountered is not grounded in reality.

aww_dang 5y ago
https://github.com/WICG/floc/issues/82 https://github.com/WICG/floc/issues/82 >During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources. Who's to say how this evolves in the future?
- kreeben 5y ago
  "During trial we had so much success with our auto-opt-in mechanism (and grew so fond of being omnipotent) we've decided to make it a permanent feature."
  - aww_dang 5y ago
    Ad-related resources is loosely defined. There's unlimited potential for other rationales.
jedwhite 5y ago
According to the W3C Federated Learning of Cohorts Draft Community Group Report, 13 April 2021, Paragraphs 3 & 7.1.1: "The interest cohort API lives under the Document interface since the access permission is tied to the document scope, and the API is only available if the document is in secure context." and "The page can opt itself out of the interest cohort computation through the "interest-cohort" policy-controlled feature. [PERMISSIONS-POLICY]" [1] [1] https://wicg.github.io/floc/ https://wicg.github.io/floc/ Edit for para reference.

bestboy 5y ago

Is it really necessary to add this header to each and every response?! I feel like it might be sufficent to add this header just to documents like *.html.

deleted 5y ago

[deleted]

euske 5y ago

Ha. This just occurred to me - Google is a search engine of websites for many people, but at the same time it is a search engine of people for many advertisers. We thought we were looking for something but actually we were constantly searched.

freebuju 5y ago
Ha. They do this everywhere not just on Chrome. In your gmail. Youtube. In your smartphone, google apps. Basically any google product should be expected to spy on you. You are the product in Google's grand scheme. The ad buyers are their customers.

greatgib 5y ago

Isn't a way for websites to poison the results instead? Like sending a random cohort info with each page loaded?

zentiggr 5y ago
Not when the algorithm is controlled by Google. Just like SEO efforts. Google will tweak their FLoC generation to ensure they get what they want out of it.

dastx 5y ago

Maybe it's time for developers to help with the fight back. Break things in Chrome, and encourage people to use Firefox. The amount of time I've been told to use Chrome is ridiculous. I regret being part of the crowd who jump on the Chrome bandwagon when it came out all those years ago. Having to explicitly opt out regardless of what you do is terrible. So now you're telling me that I have consciously disable it every time I create a new website/page? How do we force Google to stop this?

gregoriol 5y ago
Sadly most users don't even know that they are using Chrome or Firefox or that these have a version number. So breaking up things for them won't help, they won't make the switch... It has to be a regulatory decision imposed on Google, much like when Microsoft was forced to do something about Internet Explorer long time ago.

amaurino 5y ago

Hi, I just tested this for my wordpress website (https://iode.tech https://iode.tech) and it broke it, do you have any ideas why? Thanks for your help Antoine

bryanrasmussen 5y ago

Ideas - if all it takes to block is adding header `permissions-policy: interest-cohort=() 1. Github has all those bots that suggest security improvements to your code - maybe they should also suggest privacy improvements to your code. 2. Governmental sites should be changed to always require this. 3. How about a plugin that when it gets a site without the header informs user via colored tab or similar solution. I suppose Google would try to remove it from add-ons, but then that would be fuel for the inevitable lawsuits complaining this whole thing was anti-competitive and monopolistic behavior on Google's part.

darekkay 5y ago
There are also tools that check your HTTP headers. While securityheaders checks for Permission-Policy being used, I can imagine it will be improved to check for the "interest-cohort" value in the future. - https://securityheaders.com https://securityheaders.com - https://observatory.mozilla.org https://observatory.mozilla.org

gorhill 5y ago

> there is a workaround that involves adding `meta` tags to your pages themselves This does not work, `http-equiv` does not work for `Permissions-Policy`.[1] * * * [1] https://github.com/WICG/floc/pull/47#issuecomment-786966847 https://github.com/WICG/floc/pull/47#issuecomment-786966847

oedmarap 5y ago
Thank you, I've been made aware of this and have amended the post to clarify that it's ineffective w.r.t. FLoC; for the technical reason that you mentioned.

nirui 5y ago

Curious. How many of you actually brought something just because a machine/stranger recommended it to you? For me, it's almost never. I watch YouTube a lot, as a free tier user, of course. When a video starts to play, all my focus is automatically dead-locked on the "Skip Ad" button, and sometimes "Skip trial". It's a game for me now to see how fast I can tap the "Skip". As for the content of the Ad, well, usually I ignored it all together. Sometimes, when I'm away from the phone and suddenly a some 50 hours long Ad starts to play, I'll just continue finishing what's on hand first, and then go to my phone to tap "Skip" or switch to Twitter or Telegram to see whats fun over there -- all without notice what the Ad was saying. Yes, sometime, some annoying Ad got into my head anyway, but ... why should I buy something that annoys me? For me, the most effective Ad are those what I'm actively looking for. For example, if I'm looking for a running shoes, I'll click the Ad on the search page and/or listings page to see if there is a good product/deal. And I'll stop click those as soon as I made the purchase. So personally, I don't really understand the idea of Tracking Your Every Move So We Can Sell You Stuff. How it even works? Now if you remember this: https://news.ycombinator.com/item?id=14879204 https://news.ycombinator.com/item?id=14879204

deleted 5y ago
[deleted]
ripdog 5y ago
What's really curious is that you aren't using ublock origin. Life's too short to be harassed by marketing.
- nirui 5y ago
  It sound funny, but sometimes, those ads contains some information that might spark the curiosity in me. For example, there was an ad about some gangster/mafia game, the ad itself was absolute ridicules for my taste, however, the game itself received ~4.3 stars rating on Google Play, which is completely contrary to my expectation -- other people think it's not a bad game, it's just me not understanding it well enough. Look, I live a simple life, the world in my eyes is narrow, which is bad for me as a (self entitled LOL) developer. So if getting harassed for 5 seconds is what it takes to widen my view a bit, I think I'll take it :D Of course I never downloaded the game, so it's still an ineffective advertisement for them.

jillesvangurp 5y ago

Done, just added the the header to my .htaccess. No big deal. 1 minute work. In general a good idea to just be on top on what headers your web site actually sends and generally know what you are doing with things like cookies, etc. on behalf of your users. That's already something you need to do and be on top off for legal reasons. Just because lots of website maintainers are kind of indifferent/hands off/sloppy/ignorant on this front does not mean it's OK for you to be that way. This is just another thing to take a conscious decision about and pay attention to. Things that you are in any case supposed to know and pay attention to. Comes with the job of running a website. Your content, your problem to deal with. Or not. Normal due diligence. Should be business as usual.

timvisee 5y ago

By adding this header, does Chrome just stop sending the FLoC ID? Or does it also prevent Chrome using your site to build up the users FLoC profile.

roody15 5y ago

Very dystopian to think Google is normalizing the idea enabling an ad tracking profile built into the browser itself. The very notion that users need to be tracked and fingerprinted/profiled from site to site is asinine. Advertising worked before the concept of tracking on the web. Companies simply paid for contextual ads based on the site. For example visit a site that covers college basketball and advertisers would pay to put ads here for sports gear, sports equipment etc, Go to a site that covers how to keep a nice lawn and advertisers would pay to place ads for mowers, fertilizers, etc. The very idea that it is normal to have a specific adverting profile assigned to you to track you all over the web is disturbing.

karmakaze 5y ago

Opting your site out of FLoC is good advice. Using and promoting the use of Firefox is better/complementary advice.

_Understated_ 5y ago

Ok, so let me see if I understand this correctly: I run a website with no trackers, no ads, nothing at all to do with Google or any other company in any way. You come along, with Google Chrome, and visit my site. Google adds the fact that you visited my site to their massive dataset (as well as who-knows-what-else) And to opt out of something I have never been asked to be involved with in any way, I need to contact Google and ask them to please leave my site alone? Am I understanding this shit correctly? Whether I like it or not, my site, by proxy, is participating in Google's data mining? If my guess is correct, how the actual fuck is this not illegal? Edit: Ok, I guess I'm off the mark here with my assumptions so I'll put my pitchfork down. Google are just using your Chrome browsing data, matching it with site id's (or hashes?) and then analysing the shit out of it for their gain. As a website owner, nothing has changed other than I can tell them not to use my site as part of their analysis... that sound about right?

npteljes 5y ago
Why would you control what people use to visit your website? By leaving your website on the open web, you contribute to a bunch of other things, bots parse it left and right, rank it among other websites, archive.org makes snapshots, and not one of them had you opt in. How is this current case different?
lucideer 5y ago
> my site, by proxy, is participating I'm 100% against this whole FLoC thing but I really cannot understand this conclusion. If I drive through a McDonald's drivethrough, and Android/iOS/Fitbit/Tesla/whomever records my journey via GPS, they know I ate a McDonald's but McDonald's the company has not directly "participated" in any tracking of any kind.
rchaud 5y ago
It's the browser that's the issue, not your site. Seems similar to the Google Street View issue. They took pictures of public places, and you had to manually request to have your face or identifying info removed, if they were revealed. The website is public in the same way as it can be accessed by any browser and isn't blocking search robots.

jefftk 5y ago

If your site does not call document.interestCohort() or include ads, Chrome will already not consider your site in computing FLoC: A page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources. -- https://web.dev/floc/ https://web.dev/floc/ Detecting "ads or ads-related resources" uses a filter derived from EasyList: https://github.com/chromium/chromium-ads-detection/blob/master/third_party/filter_lists/9.22.0/filter_list https://github.com/chromium/chromium-ads-detection/blob/mast... (Disclosure: I work for Google, speaking only for myself)

lawwantsin17 5y ago

This only works if google respects headers. Which they obviously don't have to. In other words, it'll be shadow tracking either way.

cyberpanther 5y ago

OK I'm thinking you could write a simple extension that could add the header for every request and disable this everywhere effectively disabling FLoC. I am missing something or would this be really easy to hack and disable?

cyberpanther 5y ago
Looks like it's already there: https://chrome.google.com/webstore/detail/nofloc/egnfijfbeijcildnopmgpflofoobmece?utm_source=chrome-app-launcher https://chrome.google.com/webstore/detail/nofloc/egnfijfbeij...

RileyJames 5y ago

I wish they’d gone with “floc: off” as the header. Would have been a more satisfying change to make.