7 ms·

Let me get this straight: even if my site has no ads or trackers, Chrome will now use my visitors data for advertising and surveillance??? Does anyone else see

by dannyw 6y ago

Let me get this straight: even if my site has no ads or trackers, Chrome will now use my visitors data for advertising and surveillance??? Does anyone else see FLoC as worse than the current state we're in?

_underfl0w_ 6y ago
Definitely worse, but also the next logical step given that an ad company has achieved relative browser dominance and has such weight to throw around in defining web standards. Moves like this were inevitable. Writing's been on the wall a while now too.
aaronharnly 6y ago
It seems not. The FLoC page (https://web.dev/floc/ https://web.dev/floc/) says: > For pages that haven't been excluded, a page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources.
- Dunedan 6y ago
  Excluding a page is a manual process however, requiring to set the header mentioned in the blog post. So website owners have to explicitly opt-out of FLoC.
  - retor 6y ago
    Yeah, but that is only necessary if the page contains ads or ads-related resources, right? That’s how I interpret the previous quote.
    - dspillett 6y ago
      Yeah and the system will never accidentally see something not advert related as advert related and turn the option on. Things like that never happen. And when that does happen, Google is famously transparent in its actions and easy to contact to resolve such issues. (You may detect a little touch of sarcasm above!)
      - lupire 6y ago
        If you detected it yourself, you should rewrite it to make your writing less confusing.
    - bigiain 6y ago
      What’s an “ads-related resource”??? Is it way to cynical to think that coming from the worlds largest advertising company that can’t mean anything except “monetizable web content”...
  - sanxiyn 6y ago
    Web server software maintainers should enable the header by default. Bugs should be filed against those with the wrong default.
    - wyager 6y ago
      Web server software should absolutely not add a bunch of garbage to work around some ad company's shenanigans.
      - ben174 6y ago
        They shouldn't have to, but there are several examples of where it's the software author who has take action in order to put a stop to it. Not an Apple fanboy, but Safari is a great example of software which has changed its default behavior to prevent creepy things from happening.
        NicoJuicy 6y ago
        Safari is also a great example of a browser to keep the app store relevant ( outside of games) Different companies, different incentives
      - yarcob 6y ago
        Pretty much all network code has workarounds or default configurations that work around problems with specific clients. I guess this topic is more of a political issue rather than an obvious compatiblity issue, so it's not as clear cut. But adding special code to deal with buggy clients is something everyone has to do sooner or later.
      - zentiggr 6y ago
        If Google is going to shift to using almost unblockable tracking calculations, then servers are the next most logical place to push back against it. Anyone who runs a site and wants to opt in against a default block should have to take extra action to reduce their visitors privacy, and should be called out for their behavior. As others have noted, there are already plenty of workarounds in use for many reasons... this is a BETTER reason than most.
- bushbaba 6y ago
  Dirty of google to hide behind “web.dev” and not make it front and center clear this is a google property.
  - lrem 6y ago
    Seems to mention Google more than on Youtube. Both use Google accounts, as seen in top right corner, but only web.dev has a footer mentioning Google.
    - lupire 6y ago
      Youtube is very old and has its own reputation and a made-up trademark name. It's not trying to hijack the entire concept of a generic idea like "web dev" that existed before Google existed.
  - hnbad 6y ago
    I kept thinking that web.dev is the same as webplatform.org, which was positioned as a community-driven replacement for Mozilla's MDN Web Docs and heavily pushed by Google at the time. Turns out webplatform.org was discontinued some time in 2015 and put up a notice pointing people at the MDN Web Docs. Then in 2017 Mozilla announced most of the key players (including Google) would now support the MDN Web Docs[0], which still seems to be true except they fired the entire MDN team in 2020[1]. It seems the advisory meetings are still happening and someone is maintaining MDN, but with Mozilla essentially only existing because Google continues to pay the bills, its future seems a lot less certain now. Meanwhile web.dev makes no mention of MDN and instead mixes discussion of Google's proprietary "experimental" features and Chrome-specific behavior with general advice on "building better websites", duplicating some of the content already covered by the MDN Web Docs' guides section (except this gives them opportunities to cross-market their own interests while also not discussing support of features in other browsers). I don't think Google is hiding who's behind as the footer literally has the Google Developers logo in it. They are however not acknowledging anything other than Chrome even exists and heavily blurring the lines between Chrome or Google-specific features and stable web standards. Coupled with certain public Google developers continuously chanting "use the platform" while criticizing people for using other web frameworks instead of custom elements, this certainly creates an impression of deception and dishonesty. [0]: https://blog.mozilla.org/blog/2017/10/18/mozilla-brings-microsoft-google-w3c-samsung-together-create-cross-browser-documentation-mdn/ https://blog.mozilla.org/blog/2017/10/18/mozilla-brings-micr... [1]: https://www.fastcompany.com/90539632/mozilla-vows-mdn-isnt-going-anywhere-as-layoffs-cause-panic-among-developers https://www.fastcompany.com/90539632/mozilla-vows-mdn-isnt-g...
- bigiain 6y ago
  > if Chrome detects that the page load ads or ads-related resources. Let me guess, “ads-related resources” are not defined, but in a court case in 5-10 years time it’ll be accidentally revealed that internally Google considers this to include “JavaScript, css, or HTML files”...
  - martius 6y ago
    It's a good idea to read the article: > During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources. (Ad Tagging in Chromium explains how Chrome's ad detection mechanism works.) Ad tagging? https://chromium.googlesource.com/chromium/src/+/master/docs/ad_tagging.md https://chromium.googlesource.com/chromium/src/+/master/docs... > Ad Tagging works by matching resource requests against a filter list (...) to determine if they’re ad requests. Any requests matching the filter are tagged as ads. Further, requests (and some DOM elements such as iframes) made on behalf of previously tagged scripts are also tagged as ads by the AdTracker. An iframe will be marked as an ad iframe if its url matches the filter list, if tagged script is involved in the creation of the iframe, or if its parent frame is an ad iframe. The main frame of a page will never be tagged as an ad. Any request made within an ad iframe is considered an ad resource request. I can't find what is included in this filter list, I'm not sure it's open source. (mandatory disclaimer: I work at Google, not on Chrome nor ads)
    - donmcronald 6y ago
      > Ad Tagging works by matching resource requests against a filter list (...) to determine if they’re ad requests. This list should be shared with UBlock Origin. Let the people decide what they want IMO.
      - BCM43 6y ago
        I'm pretty sure this is the list: https://github.com/chromium/chromium-ads-detection/blob/master/third_party/filter_lists/9.22.0/filter_list https://github.com/chromium/chromium-ads-detection/blob/mast... It's derived from easylist, and (I think) scoped down based on things that actually show up in the top X websites.
echelon 6y ago
Call your representative today. Tell them it's time for the government to step in and remove Google's ability to run a browser. Google cannot be allowed to continue running Chrome. They've abused this position time and time again to the detriment of us all.
toper-centage 6y ago
Chrome was already tracking your users anyway...
- rivn 6y ago
  why is this comment gray? it's true https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf
  - lupire 6y ago
    What in that doc is "tracking", and what is being tracked? It's not tracking browsing behavior for ad profiles.
    - dannyw 6y ago
      If users have chrome sync enabled, their browsing history is used for targeted ads.
jedwhite 6y ago
The current state with third-party cookie tracking is terrible. This is terrible in a different way. It gives Google even more control over the ad-tech industry. Rather than a diversity of ad-tech kings using third-party cookies to track people and invade privacy, this becomes the "One Ring to Rule Them All" that makes Google even more dominant in ad-tech, while allowing them to pretend that they care about privacy as a prophylactic to anti-trust action. It's nothing if not clever.
- ehsankia 6y ago
  What about FLoC gives Google "even more control"? Isn't it something any ad-company can use? Maybe I don't understand how it works, but from what I've read, any website has the exact same access as Google does to the data.
  - ezrast 6y ago
    It's about writes, not reads. With cookies, the tracking networks get to decide what data to store, and they're bounded by what browser APIs allow. FLoC data is computed by Chrome itself, so Google and only Google gets to decide what data is exposed, and it has full access to your browsing behavior even if you're blocking (or visiting sites that don't use) trackers.
  - jedwhite 6y ago
    As noted by Consumer Reports: "When third-party cookies are replaced by FLoC, Google will have a way to track consumers that isn’t available to other companies, which could give Google a steep advantage in the advertising business." [1] According to the EFF, Google controls the algorithms, and will also be running its implementation and auditing its outputs, a task the EFF describes as "both orwellian and sisyphean". The EFF also notes that "Users and advocates must reject FLoC and other misguided attempts to reinvent behavioral targeting." [1] https://www.msn.com/en-us/news/technology/duckduckgo-solution-andamp-google-floc-privacy/ar-BB1fzWHK https://www.msn.com/en-us/news/technology/duckduckgo-solutio... [2] https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...
weinzierl 6y ago
> "[..] use my visitors data for advertising and surveillance [..]" ..and to improve a search engine empire that is arguably the basis for the majority of their ad business and which is already a factual monopoly. If you successfully avoided giving Google your visitor traffic data so far (by passively avoiding Google analytics, fonts, maps, etc.) then from now on you will have to take active steps to keep their fingers out of your cookie jar.
- lupire 6y ago
  How do you passively avoid Google analytics,fonts, maps? How is "not using Chrome" not passive?
  - weinzierl 6y ago
    I meant that you have to do something to use Google Analytics, Fonts, etc. If you do nothing you don't give data to Google. With FLoC this changes. If you do nothing you are complicit in sending your user data to Google. If you want to avoid it you actively have to add a header to your site.
1vuio0pswjnm7 6y ago
Better for Google and its customers, worse for competitors and end users.
bigiain 6y ago
“Your visitors? Ha ha ha ha ha!” — Google, representative, private communication, post “Do no evil era”.
roody15 6y ago
Yes it is absolutely worse. The very notion that we need a identification profile that tracks are behavior is ridiculous. Contextual advertising works. If you visit a blog that covers tech hardware... advertisers can pay to put ads here or PC parts etc. If you visit a website that covers hiking trails .. advertisers can buy ads here for camping gear etc. It is utter ridiculous to think we need to be tracked from site to site and profiled to this degree.
- Abishek_Muthian 6y ago
  > Contextual advertising works It would, unfortunately advertising agencies have showcased advertisers that they can hijack focus of an average website visitor with rich graphics irrespective of the context e.g. Say toothpaste ad on a tech blog; And the toothpaste company doesn't care as long as they get a click(even if the conversion is abysmal). Other side of the story is that the tech blog would find it very hard to get a proper referral link for PC parts they're covering for contextual advertising unless they're of considerable size. Where as getting a banner ad to display what ever it wants is just usually couple of clicks. As a result, whole Internet is full of rich graphics built by and built for these advertisers making simple text based readable websites an endangered species; Further making the lives of those with accessibility needs miserable.
jimmont 6y ago
I do not currently see it as worse and in fact I see it as better. If Google becomes the boundary behind which my information is shielded they are also the target for accountability. They generally seem a preferred option for this role relative to the others in the market (the little I know much about it). Further this seems a general good fit for their capabilities, business goals and role in society broadly, which is a position counter to the assertions the EFF appears to make. My position and argument is that Google should do what they are naturally doing and be held accountable for sensible privacy, etc by the law and watch that evolve. This seems both fair leverage of their market position and sensible use of it. Competition is freely able to develop their own niche, as is Brave and anyone else able to do. (For example why Mozilla hasn't developed VPN services, etc sooner is beyond me.) Hope this is constructive.

by dannyw 6y ago

_underfl0w_ 6y ago

Definitely worse, but also the next logical step given that an ad company has achieved relative browser dominance and has such weight to throw around in defining web standards. Moves like this were inevitable. Writing's been on the wall a while now too.

aaronharnly 6y ago

It seems not. The FLoC page (https://web.dev/floc/ https://web.dev/floc/) says: > For pages that haven't been excluded, a page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources.

Dunedan 6y ago
Excluding a page is a manual process however, requiring to set the header mentioned in the blog post. So website owners have to explicitly opt-out of FLoC.
- retor 6y ago
  Yeah, but that is only necessary if the page contains ads or ads-related resources, right? That’s how I interpret the previous quote.
  - dspillett 6y ago
    Yeah and the system will never accidentally see something not advert related as advert related and turn the option on. Things like that never happen. And when that does happen, Google is famously transparent in its actions and easy to contact to resolve such issues. (You may detect a little touch of sarcasm above!)
    - lupire 6y ago
      If you detected it yourself, you should rewrite it to make your writing less confusing.
  - bigiain 6y ago
    What’s an “ads-related resource”??? Is it way to cynical to think that coming from the worlds largest advertising company that can’t mean anything except “monetizable web content”...
- sanxiyn 6y ago
  Web server software maintainers should enable the header by default. Bugs should be filed against those with the wrong default.
  - wyager 6y ago
    Web server software should absolutely not add a bunch of garbage to work around some ad company's shenanigans.
    - ben174 6y ago
      They shouldn't have to, but there are several examples of where it's the software author who has take action in order to put a stop to it. Not an Apple fanboy, but Safari is a great example of software which has changed its default behavior to prevent creepy things from happening.
      - NicoJuicy 6y ago
        Safari is also a great example of a browser to keep the app store relevant ( outside of games) Different companies, different incentives
    - yarcob 6y ago
      Pretty much all network code has workarounds or default configurations that work around problems with specific clients. I guess this topic is more of a political issue rather than an obvious compatiblity issue, so it's not as clear cut. But adding special code to deal with buggy clients is something everyone has to do sooner or later.
    - zentiggr 6y ago
      If Google is going to shift to using almost unblockable tracking calculations, then servers are the next most logical place to push back against it. Anyone who runs a site and wants to opt in against a default block should have to take extra action to reduce their visitors privacy, and should be called out for their behavior. As others have noted, there are already plenty of workarounds in use for many reasons... this is a BETTER reason than most.
bushbaba 6y ago
Dirty of google to hide behind “web.dev” and not make it front and center clear this is a google property.
- lrem 6y ago
  Seems to mention Google more than on Youtube. Both use Google accounts, as seen in top right corner, but only web.dev has a footer mentioning Google.
  - lupire 6y ago
    Youtube is very old and has its own reputation and a made-up trademark name. It's not trying to hijack the entire concept of a generic idea like "web dev" that existed before Google existed.
- hnbad 6y ago
  I kept thinking that web.dev is the same as webplatform.org, which was positioned as a community-driven replacement for Mozilla's MDN Web Docs and heavily pushed by Google at the time. Turns out webplatform.org was discontinued some time in 2015 and put up a notice pointing people at the MDN Web Docs. Then in 2017 Mozilla announced most of the key players (including Google) would now support the MDN Web Docs[0], which still seems to be true except they fired the entire MDN team in 2020[1]. It seems the advisory meetings are still happening and someone is maintaining MDN, but with Mozilla essentially only existing because Google continues to pay the bills, its future seems a lot less certain now. Meanwhile web.dev makes no mention of MDN and instead mixes discussion of Google's proprietary "experimental" features and Chrome-specific behavior with general advice on "building better websites", duplicating some of the content already covered by the MDN Web Docs' guides section (except this gives them opportunities to cross-market their own interests while also not discussing support of features in other browsers). I don't think Google is hiding who's behind as the footer literally has the Google Developers logo in it. They are however not acknowledging anything other than Chrome even exists and heavily blurring the lines between Chrome or Google-specific features and stable web standards. Coupled with certain public Google developers continuously chanting "use the platform" while criticizing people for using other web frameworks instead of custom elements, this certainly creates an impression of deception and dishonesty. [0]: https://blog.mozilla.org/blog/2017/10/18/mozilla-brings-microsoft-google-w3c-samsung-together-create-cross-browser-documentation-mdn/ https://blog.mozilla.org/blog/2017/10/18/mozilla-brings-micr... [1]: https://www.fastcompany.com/90539632/mozilla-vows-mdn-isnt-going-anywhere-as-layoffs-cause-panic-among-developers https://www.fastcompany.com/90539632/mozilla-vows-mdn-isnt-g...
bigiain 6y ago
> if Chrome detects that the page load ads or ads-related resources. Let me guess, “ads-related resources” are not defined, but in a court case in 5-10 years time it’ll be accidentally revealed that internally Google considers this to include “JavaScript, css, or HTML files”...
- martius 6y ago
  It's a good idea to read the article: > During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page load ads or ads-related resources. (Ad Tagging in Chromium explains how Chrome's ad detection mechanism works.) Ad tagging? https://chromium.googlesource.com/chromium/src/+/master/docs/ad_tagging.md https://chromium.googlesource.com/chromium/src/+/master/docs... > Ad Tagging works by matching resource requests against a filter list (...) to determine if they’re ad requests. Any requests matching the filter are tagged as ads. Further, requests (and some DOM elements such as iframes) made on behalf of previously tagged scripts are also tagged as ads by the AdTracker. An iframe will be marked as an ad iframe if its url matches the filter list, if tagged script is involved in the creation of the iframe, or if its parent frame is an ad iframe. The main frame of a page will never be tagged as an ad. Any request made within an ad iframe is considered an ad resource request. I can't find what is included in this filter list, I'm not sure it's open source. (mandatory disclaimer: I work at Google, not on Chrome nor ads)
  - donmcronald 6y ago
    > Ad Tagging works by matching resource requests against a filter list (...) to determine if they’re ad requests. This list should be shared with UBlock Origin. Let the people decide what they want IMO.
    - BCM43 6y ago
      I'm pretty sure this is the list: https://github.com/chromium/chromium-ads-detection/blob/master/third_party/filter_lists/9.22.0/filter_list https://github.com/chromium/chromium-ads-detection/blob/mast... It's derived from easylist, and (I think) scoped down based on things that actually show up in the top X websites.

echelon 6y ago

Call your representative today. Tell them it's time for the government to step in and remove Google's ability to run a browser. Google cannot be allowed to continue running Chrome. They've abused this position time and time again to the detriment of us all.

toper-centage 6y ago

Chrome was already tracking your users anyway...

rivn 6y ago
why is this comment gray? it's true https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf
- lupire 6y ago
  What in that doc is "tracking", and what is being tracked? It's not tracking browsing behavior for ad profiles.
  - dannyw 6y ago
    If users have chrome sync enabled, their browsing history is used for targeted ads.

jedwhite 6y ago

The current state with third-party cookie tracking is terrible. This is terrible in a different way. It gives Google even more control over the ad-tech industry. Rather than a diversity of ad-tech kings using third-party cookies to track people and invade privacy, this becomes the "One Ring to Rule Them All" that makes Google even more dominant in ad-tech, while allowing them to pretend that they care about privacy as a prophylactic to anti-trust action. It's nothing if not clever.

ehsankia 6y ago
What about FLoC gives Google "even more control"? Isn't it something any ad-company can use? Maybe I don't understand how it works, but from what I've read, any website has the exact same access as Google does to the data.
- ezrast 6y ago
  It's about writes, not reads. With cookies, the tracking networks get to decide what data to store, and they're bounded by what browser APIs allow. FLoC data is computed by Chrome itself, so Google and only Google gets to decide what data is exposed, and it has full access to your browsing behavior even if you're blocking (or visiting sites that don't use) trackers.
- jedwhite 6y ago
  As noted by Consumer Reports: "When third-party cookies are replaced by FLoC, Google will have a way to track consumers that isn’t available to other companies, which could give Google a steep advantage in the advertising business." [1] According to the EFF, Google controls the algorithms, and will also be running its implementation and auditing its outputs, a task the EFF describes as "both orwellian and sisyphean". The EFF also notes that "Users and advocates must reject FLoC and other misguided attempts to reinvent behavioral targeting." [1] https://www.msn.com/en-us/news/technology/duckduckgo-solution-andamp-google-floc-privacy/ar-BB1fzWHK https://www.msn.com/en-us/news/technology/duckduckgo-solutio... [2] https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-...

weinzierl 6y ago

> "[..] use my visitors data for advertising and surveillance [..]" ..and to improve a search engine empire that is arguably the basis for the majority of their ad business and which is already a factual monopoly. If you successfully avoided giving Google your visitor traffic data so far (by passively avoiding Google analytics, fonts, maps, etc.) then from now on you will have to take active steps to keep their fingers out of your cookie jar.

lupire 6y ago
How do you passively avoid Google analytics,fonts, maps? How is "not using Chrome" not passive?
- weinzierl 6y ago
  I meant that you have to do something to use Google Analytics, Fonts, etc. If you do nothing you don't give data to Google. With FLoC this changes. If you do nothing you are complicit in sending your user data to Google. If you want to avoid it you actively have to add a header to your site.

1vuio0pswjnm7 6y ago

Better for Google and its customers, worse for competitors and end users.

bigiain 6y ago

“Your visitors? Ha ha ha ha ha!” — Google, representative, private communication, post “Do no evil era”.

roody15 6y ago

Yes it is absolutely worse. The very notion that we need a identification profile that tracks are behavior is ridiculous. Contextual advertising works. If you visit a blog that covers tech hardware... advertisers can pay to put ads here or PC parts etc. If you visit a website that covers hiking trails .. advertisers can buy ads here for camping gear etc. It is utter ridiculous to think we need to be tracked from site to site and profiled to this degree.

Abishek_Muthian 6y ago
> Contextual advertising works It would, unfortunately advertising agencies have showcased advertisers that they can hijack focus of an average website visitor with rich graphics irrespective of the context e.g. Say toothpaste ad on a tech blog; And the toothpaste company doesn't care as long as they get a click(even if the conversion is abysmal). Other side of the story is that the tech blog would find it very hard to get a proper referral link for PC parts they're covering for contextual advertising unless they're of considerable size. Where as getting a banner ad to display what ever it wants is just usually couple of clicks. As a result, whole Internet is full of rich graphics built by and built for these advertisers making simple text based readable websites an endangered species; Further making the lives of those with accessibility needs miserable.

jimmont 6y ago

I do not currently see it as worse and in fact I see it as better. If Google becomes the boundary behind which my information is shielded they are also the target for accountability. They generally seem a preferred option for this role relative to the others in the market (the little I know much about it). Further this seems a general good fit for their capabilities, business goals and role in society broadly, which is a position counter to the assertions the EFF appears to make. My position and argument is that Google should do what they are naturally doing and be held accountable for sensible privacy, etc by the law and watch that evolve. This seems both fair leverage of their market position and sensible use of it. Competition is freely able to develop their own niche, as is Brave and anyone else able to do. (For example why Mozilla hasn't developed VPN services, etc sooner is beyond me.) Hope this is constructive.