9 ms·

Google considers switching FLoC to a topic-based approach

64 points by robin_reala 5y ago

nixass 5y ago
Whatever Google chooses you know it will for Google's benefit and on user's disadvantage.
- john_yaya 5y ago
  I was about to dispute this and say, “no, most business relationships are win-win.” Then I remembered that Google’s business relationships aren’t with their users. So, yes, you’re no doubt correct about that.
- dylan604 5y ago
  Whenever I see news about Googs making a decision, it is always read with "how will this ultimately be screwing the users". If Googs decides to stop doing some invasive data collection it is only because they have found something better.
- jefftk 5y ago
  Users benefit from a web where sites can make money by showing ads, because the alternatives (primarily paywalls) are worse. More: https://www.jefftk.com/p/why-i-work-on-ads https://www.jefftk.com/p/why-i-work-on-ads (Disclosure: I work on ads at Google, speaking only for myself)
  - dessant 5y ago
    Google's aberrated view of privacy and the role ads should play in our lives is partly why we have to constantly be on the lookout and expect to end up being screwed regardless, even if we pay $4000 for a device that runs Google TV.
  - dmitriid 5y ago
    Yes, jeff. We all remember your articles in which you argue that invasive, track-all-of-your-life ads are somehow good. They are not. The world has survived for millenia without tracking ads.
    - greiskul 5y ago
      And how long as the open web survived? Cause I see a lot of it dieing every day, being replaced with walls.
      - dmitriid 5y ago
        > And how long as the open web survived For a very, very long time. > Cause I see a lot of it dieing every day, being replaced with walls. That's because companies feel value in silos and extracting every cent they can out of users.
      - Nicksil 5y ago
        >And how long as the open web survived? Since its birth, clearly. No matter how you try and spin this, advertising is not a requite for a free and open Web. If ads were to disappear tomorrow, web sites which society has deemed important will survive, the others (if income was necessary in the first place) will indeed perish. And we will be just fine.
      - gxnxcxcx 5y ago
        The open web never felt the urge to become walled before the ad peddlers made it addicted to revenue.
      - perryizgr8 5y ago
        Just because the open web is being murdered by Google and FB, does not mean we have to go along with their progrom. We need to stand up for what's right, not for what's winning today.
  - rchaud 5y ago
    This neatly sidesteps the reality that Google itself takes actions to makes Adsense revenue completely unpredictable. The "confirmed clicks" program created a ton of instability, with no real explanations from Big G: https://digiday.com/media/googles-confirmed-clicks-initiative-deepens-publishers-revenue-woes/ https://digiday.com/media/googles-confirmed-clicks-initiativ...
  - luckylion 5y ago
    Without ads, content quality would go up, because very few people will pay for low quality content. And if quality goes up, people are happy to pay for it. With ads, content quality goes down. You don't need to convince people that your content is worth reading, you just need to convince Google. Slap a few expired domains on your text-spinner generated content and off you go. Not all content is created equal, and Made-For-Adsense content would not have been made otherwise and would not take away attention from quality content. I believe you're rationalizing your paycheck.
  - gxnxcxcx 5y ago
    It has indeed enabled the professionalization of the endeavor, but the shift in incentives for content creation has irreversibly changed the shape of the mainstream internet, and not necessarily for the better as far as the user is concerned. The monetized web has in a lot of measures exceeded the frontiers of what the ragtag petite bourgeoisie of the early internet could ever be but, in the process, the great majority of us (both users and the very long tail of non-top content creators) have invariably become peasants. I'm not saying there was any other way to have what we have now, but what we have now kinda ain't sooo good when one isn't the middleman in a process architected for the middleman's benefit.
  - dogleash 5y ago
    >because the alternatives (primarily paywalls) are worse Weird position to take when most high-quality content is already shifting to a paywall model (or didn't base their business model on advertising in the first place). And ad-supported content is in a race to the bottom meaning any content useful beyond light entertainment is drying up.
  - easrng 5y ago
    Tracking and profiling users is completely unnecessary. Context-based, non-intrusive, ads are reasonable and better than paywalls and users won't hate them. I wish someone would make https://ethicalads.io https://ethicalads.io but not just targeted at developers.
    - ericholscher 5y ago
      We're looking into the option of expanding our network or offering it as a SaaS for others who are wanting to build something similar for other audiences. The software works great for any content-based targeting, and we're excited to expand to other niches to push the vision forward as we can :)
      - easrng 5y ago
        That would be amazing! You guys are the only non-awful ad network with primarily text-based ads, which I like. I also love that we can style the ads with CSS which I'm pretty sure nobody else allows.
  - rurp 5y ago
    I'm sure you are aware that contextual ads are a thing, and would still be quite profitable. I personally would be fine with wealthiest companies in the world making moderately less money in exchange for everyone having vastly more privacy.
- rektide 5y ago
  Doing nothing & leaving the internet insecure is in every other media & ad & host's interest, because currently it's insecure. Making privacy better is indeed to Google's benefit. Because Google has a 1st party relationship with users: users visit Google.com, Google sees where we go. But this is not to a user's dis-advantage. Google genuinely is trying to find a good path forward. The proof to me comes in the quest for alternatives. Find anything else pro-user being suggested. Find ANYTHING. There's nothing. It's barren. There is a huge astroturfed war going on. Google is trying to do good. It's trying to find some compromise between content-holders & users. The content-holders are stirring up a colossal storm because they want what they have, which is everything. They're winning this PR blitz. Low, cheap, pervasive attacks on Google are winning this war, & it's users who are losing.
  - dmitriid 5y ago
    > Google genuinely is trying to find a good path forward. Google is that earns 80% of its money from online ads. There's literally no incentive for Google to "find a good path forward".
  - danShumway 5y ago
    > The proof to me comes in the quest for alternatives. Find anything else pro-user being suggested. Find ANYTHING. There's nothing. It's barren. Every major browser other than Google is taking proactive steps to limit cookies right now. Firefox very recently announced better cookie deletion for sites; they'll now try to delete cookies from other domains that are linked to those sites. This is going to get progressively better and better. But the sentiment here is exactly what Google promotes. It begs the question over whether or not we need to compromise with content-holders on privacy. We don't, no browser other than Chrome views user tracking as a necessary compromise with advertisers. There was a point in the past where we might honestly worry about whether it was feasible to block 3rd-party cookies, but since then multiple efforts and improvements from Mozilla and Safari have made it clear that browser manufactures don't have to get advertisers' permission to push code. Google is refusing to proactively move forward with steps that everyone else has agreed are necessary, because Google is mad that we're not thinking enough about their business interests. We have a good path forward, Google is blocking it for a large number of users, and then Google is complaining "why is no one else except us coming up with solutions?" But we have come up with solutions, they're just not solutions that Google likes. The caution from Chrome about cookies is really interesting. Chrome broke web audio, alerts, the dev team is regularly openly hostile to suggestions that the consensus process moves too quickly. They tried tried to deprecate the url for crying out loud, but now they want to be all cautious about cookies? Sure. > There is a huge astroturfed war going on. Agreed, but not in the direction that you're suggesting. The general public wants better privacy, they don't care about whether or not it makes advertisers happy. Nontechnical users are often misinformed about tracking and they often lack technical skills or willpower to increase their privacy on their own. But that doesn't mean the public doesn't care about privacy, ordinary users do support the figerprinting protections Apple is building into iOS, they support the privacy changes Mozilla is building into Firefox. Most ordinary people are on the side of privacy in this debate. Advertisers are desperate to argue that users are being harmed or that moving forward without an alternative tracking system is impossible, when the reality is that even the nontechnical public has turned out to have overwhelmingly positive feelings towards on-by-default technical measures to reduce tracking. The astroturfing here is the FUD coming out of companies claiming that we need (for either moral, technical, or PR reasons) to compromise with advertisers before we can move forward removing 3rd-party cookies. It's really only Google who is lagging on this stuff. If they want the least private browser on the market, then they can have it. I don't think we need to hold back everyone else while we wait for Google to make up their mind about this.
deleted 5y ago
[deleted]
jeffalo 5y ago
I am much happier with this system, but I don't really see how this would help Google.. Early web advertising used basic page topic based targeting, but clearly more targeted ads make more money, so what monetary benefit does this provide Google?
- mandevil 5y ago
  I think the answer is that Apple killed 3rd party cookies on their browser- which includes every single website view from an iPhone, and Mozilla is working on the same thing. So Google, even with full control of Chrome, the most popular browser, could read the writing on the wall that 3rd party cookie tracking was on its way out. The adtech industry has responded so far in ways that undermine security completely- mostly trying to get their cookies counted as first party (which also means that their scripts can view the first party's data, e.g. they can steal your persistent log-in!). So Google has been trying to come up with something that Apple will let them get away with. Either give up on targeted advertising to iPhone/iPad users or come up with something better than third party cookies.
  - vineyardmike 5y ago
    > that Apple will let them get away with Apple has no interest in supporting FLOC at all though right?
charlesdaniels 5y ago
At the end of the day, even if you assume good faith on Google's part (which I think is quite a leap), causing the user to present more entropy to the site will make them easier to fingerprint. 256 topics would be ceil(log2(256)) = 8 bits of entropy 30,000 topics would be ceil(log2(30000) = 15 bits of entropy As a reminder, there are ~ 10 billion people on earth, so if you have 34 bits of entropy or so, you can uniquely identify each person. So really, the way to think of this as "Google considers making FLoC 20% less effective at fingerprinting users", and that's not even considering other sources of entropy, like user agent or screen size.
- josefx 5y ago
  > and that's not even considering other sources of entropy, like user agent or screen size. As a reminder: Chrome sends 16 bits of x-client-data with every http request aimed at Google servers. So they already have half the bits they need to uniquely identify your system without FLoC.
  - jefftk 5y ago
    The X-Client-Data header is only for evaluating the effect of changes to Chrome, not ad targeting: https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat... Earlier comment with more details: https://news.ycombinator.com/item?id=27367482 https://news.ycombinator.com/item?id=27367482 (Disclosure: I work on ads at Google, speaking only for myself)
    - dessant 5y ago
      It's understandable that people have concerns about a HTTP header that could be used as part of a fingerprinting system. Is there an option in Chrome to opt-out of this data being sent to Google?
      - anchpop 5y ago
        I don't really understand this mindset. Google controls Chrome. They openly track every page you visit and show it to you at https://myactivity.google.com/ https://myactivity.google.com/ . It's possible that Google is tracking you with FLoC or with extra HTTP headers or whatever. But they're also openly tracking you all the time anyway because you use Chrome. If you don't trust them to use the data they collect responsibly, don't use Chrome. (I'm not saying you shouldn't pressure Chrome to collect less data, I'm saying it doesn't make any sense to theorize about secret HTTP header fingerprinting operations when they're making literally no effort to hide the much bigger data collection operation right in front of you.)
srswtf123 5y ago
I wish they’d start switching back to “Don’t Be Evil”. But hey, shareholder value, right? Waaay more important.
- dheera 5y ago
  Fiduciary duty > civil duty Welcome to capitalism.
  - kwhitefoot 5y ago
    > Fiduciary duty > civil duty No it isn't.
    - erhk 5y ago
      Explain your reasoning
      - kwhitefoot 5y ago
        It appears to be commonly believed that a company has a greater duty to maximise the income of its investors than to be a good 'citizen'. As far as I can tell most people do not believe this and it is not required by law.
  - srswtf123 5y ago
    IANAL, but I don't believe that the fiduciary duty a corporation has to its shareholders allows it to ignore its civic duty to follow the law. Then again, rarely is lawbreaking by corporations adequately prosecuted. Even more rare are actual guilty verdicts resulting in actual punishment. Of course, "Don't be evil" isn't a law, and I'm not claiming Google is breaking any. So while I think I may be technically correct, reality certainly does seem to favor your statement. This seems like a fairly sad state of affairs. Is it like this everywhere capitalism is practiced? I'd think a visiting extraterrestrial scholar might be able to weigh in.
    - dheera 5y ago
godshatter 5y ago
If we're going to move to a target-based approach, why advertise through Google who knows a mash-up of topics from sites a person visits, instead of just making a deal with topic-based websites directly? Instead of trying to catch them in transit, catch them at their destination. As a bonus, it cuts out the middle man and no none has to know anything about specific web visitors because they are already pre-filtered based on their interests.
- RcouF1uZ4gsC 5y ago
  This is actually going back to the old model where advertisers targeted magazines, tv shows, etc based on their audience.
- vineyardmike 5y ago
  > Instead of trying to catch them in transit, catch them at their destination. Because i have an interest in X but i frequent sites for topics X, Y, Z, A, B daily because i'm a complex individual. Maybe X is the most "valuable" topic to profit off so now A, B, X, Y, Z all show ads on just X.
  - qeternity 5y ago
    Also, it could be that people who frequent XYZ are actually really profitable for A but they don’t know they’re interested in A yet. This is the holy grail of marketing.
btown 5y ago
This was true of FLoC and it's perhaps even more critical now that topics are more easy for advertisers to understand: Do. Not. Allow. Anything. LGBTQ+. Related. To. Be. A. Topic. Unless. It's. Opt. In. People. Live. In. Unpredictably. Unsafe. Places. People. Will. Die.
- shuckles 5y ago
  Can you say more about how FLoC introduces new risks that don’t already exist with targeted ads?
  - tyingq 5y ago
    It's front-loaded with misleading phrases like "privacy first".
  - vineyardmike 5y ago
    Targeted ads use data that are owned by each company targeting. Sure you can buy/sell data in the market, but its somewhat decentralized. FLOC is centralized at the individual. That means YOU are profiled completely and all the profile info is centralized for everyone to grab.
    - shuckles 5y ago
      I thought targeted ads let you buy an audience using all the information the ad network had about them. So in your framing, the “company targeting” would be Google, and they already know more than a FLOC cohort worth of information about you.
      - josefx 5y ago
        Officially Google doesn't hand out information who belongs to what group. With FLOC your browser tells everyone in what "cohort" you are, if a cohort can be used to identify gay people just visiting government websites in an anti gay country could end very badly.
tehjoker 5y ago
This is all about switching the ad targeting system from one that competitors could use (3rd party cookies) to one that only Google can use, further cementing it as the indispensable company to online advertisers. This issue is really an anti-trust issue. Google already knows everything about you. I do think it is fun to imagine what topics they could assign to you around the web. What about "anti-vax", "terrorist", "communist", or what not now totally divorced from the material that generated the label.
- ocdtrekkie 5y ago
  That is one of the issues with the old cohort ID system, in particular: You could be placed in a group that is particularly concerning for targeting purposes and not even know it, because everything was opaque. You just see a weird cohort identifier, but it might inadvertently discriminate against you in some way. This attempts to solve this by limiting it to a much more limited set of topic groups that are presumably plaintext-readable, and it sounds like the option to remove yourself from ones that are incorrect may also be considered. That being said, I'm happy to use a web browser that doesn't consider better ad targeting a reason to implement features.
ericyan 5y ago
They are just not going to drop this idea, aren't they? Google is in the online advertising business after all.
nixroot 5y ago
They should just target ads to the webpage it's shown on rather than the user.
wendythehacker 5y ago
It seems there are a lot of opportunities for privacy testing here.... -) Is is possible to re-identify webpages a user visits based on Cohort ID? -) E.g. can a website be built to show your "profile" and "interests" based on the Cohort, rather than just the FLoC ID? Google and others who (I assume) will share their back-end data will be able to build such a website. -) Can a "rainbow table of FLoCs" be pre-calcuated? This would allow to re-identify certain browsing habits of users -) In fact what if someone creates a Chrome extension that publishes visited domain names and their resulting FLoC ID - Imagine many people download and use it for fun! This would sort of decentralize the previous mentioned de-identification attacks and render FLoC useless for all other privacy concerned users. -) How much easier is it now to track a user with just IP address + FLoC ID now? BUT, what I'm missing entirely at this point is how will the web server (Google and other ad companies) actually *use/share* the Cohort information? That is not being described at all by Google - and seems rather critical to me. More details and testing ideas in this article: https://embracethered.com/blog/posts/2021/red-teaming-floc-chrome-cohort/ https://embracethered.com/blog/posts/2021/red-teaming-floc-c...
spullara 5y ago
I'd be super happy with something like this honestly. I do want to see advertisements, especially for things in my areas of interest, while being able to control the list. I would go one step further and make topics opt-in with a pending list of inferred topics.
iamben 5y ago
We're just going to end up back at contextual advertising again...
syrrim 5y ago
One thing I've noticed: very few ads are topic focused. Take an ad for a car, or for life insurance. This ad isn't aimed at someone who likes cars, or insurance. It's aimed at an average person, within a certain income bracket and stage of life. How would you know, based on browsing history, whether a person should be displayed such an ad? If they've visited websites for insurance, or cars, then they're a shoo-in, granted. Most people haven't. So the approach will be to identify people of a certain age and income, and figure out what websites they visit. Next, use tracking cookies to identify people who visit the same set of websites. Display the ad to all such people. The original FLoC fit into this model well. Whereas it might have picked out topics that a person likes, it would also likely have picked up other bits of demographic information like age, sex, wealth, which would be more useful for targeting. In moving to an explicitly topic focused model, google throws out this capability. Presumably, people from all age groups are interested in rock music, say. But the way that different people engage with that interest will be different, and therefore offer opportunities to identify more specific groups. A purely topic based model commingles these groups, and therefore makes targeting harder. To the degree it works, it will be against the intentions of the system, since explicit interests will be used as a proxy for demographic information, rather than used directly. As such, I doubt this model will leave anyone very happy. Advertisers will dislike that it offers poorer tracking, and users will dislike that it leaks demographic information. I for one am satisfied with an approach that screws over advertisers. However, I suspect google won't be. What I see as their only escape is to create sandboxed environments in the browser from which to run advertising targeting code. A javascript worker of some sort would be restricted from making web requests, and would only be able to act on information fed to it. This information would come from webpages the user visited, and would include information about the page, as well as their actions there. The worker would use this information to decide what ads to target at the user. Downloading a particular ad without leaking information remains a problem. You could download every possible ad, and have the worker select one, but this is very wasteful of bandwidth. "Private information retrieval" (PIR) schemes can reduce the bandwidth wastage substantially, without leaking any information to the server. These schemes have received a great deal of attention from cryptographers, but as far as I can tell have been overlooked by programmers. Likely this is because there are few instances where a project cares about privacy, but the project owner is untrusted to protect privacy. Thus, it seems like privacy protecting targeted advertising would be an ideal testbed for PIR. It would be very interesting if google went this route.
purplepatrick 5y ago
IMHO this is a terrible idea, because I guarantee you they’d screw up the categorization of “topics”. How granular should a “topic” be? “Financial services” isn’t gonna cut it. Or how about medical sites? “Medical” or “health” are useless mean-nothing buckets, while “rectal bleeding” may be too granular. Ditto the issue of topic visit frequency - sure, someone visiting shoe sites multiple times is a thing, but how often is someone going to look for, say, mortgage loans? ~90%+ of people only gather two offers for home loans, for example. They can get that on one site in one visit. But they may have read a ton about it before on sites that may only have been tagged as “financial content” or some wish washy label. Data structuring for topics, occupations, etc. online or offline has almost never succeeded. Ever. I have never seen anyone do it well and I work in an industry that depends on it. Oh, and don’t even get me started on sets… Making this the basis for targeting is really only going to help sell shoes, fashion, porn, jewelry, and cars.
jtsiskin 5y ago
There has to be a better way to do this with homomorphic encryption.
audit 5y ago
I see that folks in the comments are asking 'what would be an alternative to behavioral fingerprinting based on browsing history. Perhaps we can look at advertising as 2 categories: (1) advertising -- as means to notify about an existing product or a service (2) advertising as means to elevate one product over the other in the eyes of consumers. The (1)st category seems to be very legitimate and welcome. The (2)nd category falls into implicit manipulation, almost con-artistry. So let's assume that it is the (1)st category is the one the public would like to find solutions for (and the 2nd category will, eventually, become outlawed .. let's hope). With that in mind, perhaps a way for a user to set legitimate interest (at the browser level) and the type of 'pages' they accept to see ads would work. The 'types' of pages might be a some sort of taxonomy standard that labels a page with a type (eg privacy preserving or not and many subtypes). As a user navigates to through the web, only pages with specific subtypes, would participate in the 'digital identity build up'. The pages that, according to user preferences, cannot participate in the 'digital identity' build up -- can still show ads, but cannot use or 'donate' its information into the digital identity database.

64 points by robin_reala 5y ago

nixass 5y ago

Whatever Google chooses you know it will for Google's benefit and on user's disadvantage.

john_yaya 5y ago
I was about to dispute this and say, “no, most business relationships are win-win.” Then I remembered that Google’s business relationships aren’t with their users. So, yes, you’re no doubt correct about that.
dylan604 5y ago
Whenever I see news about Googs making a decision, it is always read with "how will this ultimately be screwing the users". If Googs decides to stop doing some invasive data collection it is only because they have found something better.
jefftk 5y ago
Users benefit from a web where sites can make money by showing ads, because the alternatives (primarily paywalls) are worse. More: https://www.jefftk.com/p/why-i-work-on-ads https://www.jefftk.com/p/why-i-work-on-ads (Disclosure: I work on ads at Google, speaking only for myself)
- dessant 5y ago
  Google's aberrated view of privacy and the role ads should play in our lives is partly why we have to constantly be on the lookout and expect to end up being screwed regardless, even if we pay $4000 for a device that runs Google TV.
- dmitriid 5y ago
  Yes, jeff. We all remember your articles in which you argue that invasive, track-all-of-your-life ads are somehow good. They are not. The world has survived for millenia without tracking ads.
  - greiskul 5y ago
    And how long as the open web survived? Cause I see a lot of it dieing every day, being replaced with walls.
    - dmitriid 5y ago
      > And how long as the open web survived For a very, very long time. > Cause I see a lot of it dieing every day, being replaced with walls. That's because companies feel value in silos and extracting every cent they can out of users.
    - Nicksil 5y ago
      >And how long as the open web survived? Since its birth, clearly. No matter how you try and spin this, advertising is not a requite for a free and open Web. If ads were to disappear tomorrow, web sites which society has deemed important will survive, the others (if income was necessary in the first place) will indeed perish. And we will be just fine.
    - gxnxcxcx 5y ago
      The open web never felt the urge to become walled before the ad peddlers made it addicted to revenue.
    - perryizgr8 5y ago
      Just because the open web is being murdered by Google and FB, does not mean we have to go along with their progrom. We need to stand up for what's right, not for what's winning today.
- rchaud 5y ago
  This neatly sidesteps the reality that Google itself takes actions to makes Adsense revenue completely unpredictable. The "confirmed clicks" program created a ton of instability, with no real explanations from Big G: https://digiday.com/media/googles-confirmed-clicks-initiative-deepens-publishers-revenue-woes/ https://digiday.com/media/googles-confirmed-clicks-initiativ...
- luckylion 5y ago
  Without ads, content quality would go up, because very few people will pay for low quality content. And if quality goes up, people are happy to pay for it. With ads, content quality goes down. You don't need to convince people that your content is worth reading, you just need to convince Google. Slap a few expired domains on your text-spinner generated content and off you go. Not all content is created equal, and Made-For-Adsense content would not have been made otherwise and would not take away attention from quality content. I believe you're rationalizing your paycheck.
- gxnxcxcx 5y ago
  It has indeed enabled the professionalization of the endeavor, but the shift in incentives for content creation has irreversibly changed the shape of the mainstream internet, and not necessarily for the better as far as the user is concerned. The monetized web has in a lot of measures exceeded the frontiers of what the ragtag petite bourgeoisie of the early internet could ever be but, in the process, the great majority of us (both users and the very long tail of non-top content creators) have invariably become peasants. I'm not saying there was any other way to have what we have now, but what we have now kinda ain't sooo good when one isn't the middleman in a process architected for the middleman's benefit.
- dogleash 5y ago
  >because the alternatives (primarily paywalls) are worse Weird position to take when most high-quality content is already shifting to a paywall model (or didn't base their business model on advertising in the first place). And ad-supported content is in a race to the bottom meaning any content useful beyond light entertainment is drying up.
- easrng 5y ago
  Tracking and profiling users is completely unnecessary. Context-based, non-intrusive, ads are reasonable and better than paywalls and users won't hate them. I wish someone would make https://ethicalads.io https://ethicalads.io but not just targeted at developers.
  - ericholscher 5y ago
    We're looking into the option of expanding our network or offering it as a SaaS for others who are wanting to build something similar for other audiences. The software works great for any content-based targeting, and we're excited to expand to other niches to push the vision forward as we can :)
    - easrng 5y ago
      That would be amazing! You guys are the only non-awful ad network with primarily text-based ads, which I like. I also love that we can style the ads with CSS which I'm pretty sure nobody else allows.
- rurp 5y ago
  I'm sure you are aware that contextual ads are a thing, and would still be quite profitable. I personally would be fine with wealthiest companies in the world making moderately less money in exchange for everyone having vastly more privacy.
rektide 5y ago
Doing nothing & leaving the internet insecure is in every other media & ad & host's interest, because currently it's insecure. Making privacy better is indeed to Google's benefit. Because Google has a 1st party relationship with users: users visit Google.com, Google sees where we go. But this is not to a user's dis-advantage. Google genuinely is trying to find a good path forward. The proof to me comes in the quest for alternatives. Find anything else pro-user being suggested. Find ANYTHING. There's nothing. It's barren. There is a huge astroturfed war going on. Google is trying to do good. It's trying to find some compromise between content-holders & users. The content-holders are stirring up a colossal storm because they want what they have, which is everything. They're winning this PR blitz. Low, cheap, pervasive attacks on Google are winning this war, & it's users who are losing.
- dmitriid 5y ago
  > Google genuinely is trying to find a good path forward. Google is that earns 80% of its money from online ads. There's literally no incentive for Google to "find a good path forward".
- danShumway 5y ago
  > The proof to me comes in the quest for alternatives. Find anything else pro-user being suggested. Find ANYTHING. There's nothing. It's barren. Every major browser other than Google is taking proactive steps to limit cookies right now. Firefox very recently announced better cookie deletion for sites; they'll now try to delete cookies from other domains that are linked to those sites. This is going to get progressively better and better. But the sentiment here is exactly what Google promotes. It begs the question over whether or not we need to compromise with content-holders on privacy. We don't, no browser other than Chrome views user tracking as a necessary compromise with advertisers. There was a point in the past where we might honestly worry about whether it was feasible to block 3rd-party cookies, but since then multiple efforts and improvements from Mozilla and Safari have made it clear that browser manufactures don't have to get advertisers' permission to push code. Google is refusing to proactively move forward with steps that everyone else has agreed are necessary, because Google is mad that we're not thinking enough about their business interests. We have a good path forward, Google is blocking it for a large number of users, and then Google is complaining "why is no one else except us coming up with solutions?" But we have come up with solutions, they're just not solutions that Google likes. The caution from Chrome about cookies is really interesting. Chrome broke web audio, alerts, the dev team is regularly openly hostile to suggestions that the consensus process moves too quickly. They tried tried to deprecate the url for crying out loud, but now they want to be all cautious about cookies? Sure. > There is a huge astroturfed war going on. Agreed, but not in the direction that you're suggesting. The general public wants better privacy, they don't care about whether or not it makes advertisers happy. Nontechnical users are often misinformed about tracking and they often lack technical skills or willpower to increase their privacy on their own. But that doesn't mean the public doesn't care about privacy, ordinary users do support the figerprinting protections Apple is building into iOS, they support the privacy changes Mozilla is building into Firefox. Most ordinary people are on the side of privacy in this debate. Advertisers are desperate to argue that users are being harmed or that moving forward without an alternative tracking system is impossible, when the reality is that even the nontechnical public has turned out to have overwhelmingly positive feelings towards on-by-default technical measures to reduce tracking. The astroturfing here is the FUD coming out of companies claiming that we need (for either moral, technical, or PR reasons) to compromise with advertisers before we can move forward removing 3rd-party cookies. It's really only Google who is lagging on this stuff. If they want the least private browser on the market, then they can have it. I don't think we need to hold back everyone else while we wait for Google to make up their mind about this.

deleted 5y ago

[deleted]

jeffalo 5y ago

I am much happier with this system, but I don't really see how this would help Google.. Early web advertising used basic page topic based targeting, but clearly more targeted ads make more money, so what monetary benefit does this provide Google?

mandevil 5y ago
I think the answer is that Apple killed 3rd party cookies on their browser- which includes every single website view from an iPhone, and Mozilla is working on the same thing. So Google, even with full control of Chrome, the most popular browser, could read the writing on the wall that 3rd party cookie tracking was on its way out. The adtech industry has responded so far in ways that undermine security completely- mostly trying to get their cookies counted as first party (which also means that their scripts can view the first party's data, e.g. they can steal your persistent log-in!). So Google has been trying to come up with something that Apple will let them get away with. Either give up on targeted advertising to iPhone/iPad users or come up with something better than third party cookies.
- vineyardmike 5y ago
  > that Apple will let them get away with Apple has no interest in supporting FLOC at all though right?

charlesdaniels 5y ago

At the end of the day, even if you assume good faith on Google's part (which I think is quite a leap), causing the user to present more entropy to the site will make them easier to fingerprint. 256 topics would be ceil(log2(256)) = 8 bits of entropy 30,000 topics would be ceil(log2(30000) = 15 bits of entropy As a reminder, there are ~ 10 billion people on earth, so if you have 34 bits of entropy or so, you can uniquely identify each person. So really, the way to think of this as "Google considers making FLoC 20% less effective at fingerprinting users", and that's not even considering other sources of entropy, like user agent or screen size.

josefx 5y ago
> and that's not even considering other sources of entropy, like user agent or screen size. As a reminder: Chrome sends 16 bits of x-client-data with every http request aimed at Google servers. So they already have half the bits they need to uniquely identify your system without FLoC.
- jefftk 5y ago
  The X-Client-Data header is only for evaluating the effect of changes to Chrome, not ad targeting: https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat... Earlier comment with more details: https://news.ycombinator.com/item?id=27367482 https://news.ycombinator.com/item?id=27367482 (Disclosure: I work on ads at Google, speaking only for myself)
  - dessant 5y ago
    It's understandable that people have concerns about a HTTP header that could be used as part of a fingerprinting system. Is there an option in Chrome to opt-out of this data being sent to Google?
    - anchpop 5y ago
      I don't really understand this mindset. Google controls Chrome. They openly track every page you visit and show it to you at https://myactivity.google.com/ https://myactivity.google.com/ . It's possible that Google is tracking you with FLoC or with extra HTTP headers or whatever. But they're also openly tracking you all the time anyway because you use Chrome. If you don't trust them to use the data they collect responsibly, don't use Chrome. (I'm not saying you shouldn't pressure Chrome to collect less data, I'm saying it doesn't make any sense to theorize about secret HTTP header fingerprinting operations when they're making literally no effort to hide the much bigger data collection operation right in front of you.)

srswtf123 5y ago

I wish they’d start switching back to “Don’t Be Evil”. But hey, shareholder value, right? Waaay more important.

dheera 5y ago
Fiduciary duty > civil duty Welcome to capitalism.
- kwhitefoot 5y ago
  > Fiduciary duty > civil duty No it isn't.
  - erhk 5y ago
    Explain your reasoning
    - kwhitefoot 5y ago
      It appears to be commonly believed that a company has a greater duty to maximise the income of its investors than to be a good 'citizen'. As far as I can tell most people do not believe this and it is not required by law.
- srswtf123 5y ago
  IANAL, but I don't believe that the fiduciary duty a corporation has to its shareholders allows it to ignore its civic duty to follow the law. Then again, rarely is lawbreaking by corporations adequately prosecuted. Even more rare are actual guilty verdicts resulting in actual punishment. Of course, "Don't be evil" isn't a law, and I'm not claiming Google is breaking any. So while I think I may be technically correct, reality certainly does seem to favor your statement. This seems like a fairly sad state of affairs. Is it like this everywhere capitalism is practiced? I'd think a visiting extraterrestrial scholar might be able to weigh in.
  - dheera 5y ago

godshatter 5y ago

If we're going to move to a target-based approach, why advertise through Google who knows a mash-up of topics from sites a person visits, instead of just making a deal with topic-based websites directly? Instead of trying to catch them in transit, catch them at their destination. As a bonus, it cuts out the middle man and no none has to know anything about specific web visitors because they are already pre-filtered based on their interests.

RcouF1uZ4gsC 5y ago
This is actually going back to the old model where advertisers targeted magazines, tv shows, etc based on their audience.
vineyardmike 5y ago
> Instead of trying to catch them in transit, catch them at their destination. Because i have an interest in X but i frequent sites for topics X, Y, Z, A, B daily because i'm a complex individual. Maybe X is the most "valuable" topic to profit off so now A, B, X, Y, Z all show ads on just X.
- qeternity 5y ago
  Also, it could be that people who frequent XYZ are actually really profitable for A but they don’t know they’re interested in A yet. This is the holy grail of marketing.

btown 5y ago

This was true of FLoC and it's perhaps even more critical now that topics are more easy for advertisers to understand: Do. Not. Allow. Anything. LGBTQ+. Related. To. Be. A. Topic. Unless. It's. Opt. In. People. Live. In. Unpredictably. Unsafe. Places. People. Will. Die.

shuckles 5y ago
Can you say more about how FLoC introduces new risks that don’t already exist with targeted ads?
- tyingq 5y ago
  It's front-loaded with misleading phrases like "privacy first".
- vineyardmike 5y ago
  Targeted ads use data that are owned by each company targeting. Sure you can buy/sell data in the market, but its somewhat decentralized. FLOC is centralized at the individual. That means YOU are profiled completely and all the profile info is centralized for everyone to grab.
  - shuckles 5y ago
    I thought targeted ads let you buy an audience using all the information the ad network had about them. So in your framing, the “company targeting” would be Google, and they already know more than a FLOC cohort worth of information about you.
    - josefx 5y ago
      Officially Google doesn't hand out information who belongs to what group. With FLOC your browser tells everyone in what "cohort" you are, if a cohort can be used to identify gay people just visiting government websites in an anti gay country could end very badly.

tehjoker 5y ago

This is all about switching the ad targeting system from one that competitors could use (3rd party cookies) to one that only Google can use, further cementing it as the indispensable company to online advertisers. This issue is really an anti-trust issue. Google already knows everything about you. I do think it is fun to imagine what topics they could assign to you around the web. What about "anti-vax", "terrorist", "communist", or what not now totally divorced from the material that generated the label.

ocdtrekkie 5y ago
That is one of the issues with the old cohort ID system, in particular: You could be placed in a group that is particularly concerning for targeting purposes and not even know it, because everything was opaque. You just see a weird cohort identifier, but it might inadvertently discriminate against you in some way. This attempts to solve this by limiting it to a much more limited set of topic groups that are presumably plaintext-readable, and it sounds like the option to remove yourself from ones that are incorrect may also be considered. That being said, I'm happy to use a web browser that doesn't consider better ad targeting a reason to implement features.

ericyan 5y ago

They are just not going to drop this idea, aren't they? Google is in the online advertising business after all.

nixroot 5y ago

They should just target ads to the webpage it's shown on rather than the user.

wendythehacker 5y ago

It seems there are a lot of opportunities for privacy testing here.... -) Is is possible to re-identify webpages a user visits based on Cohort ID? -) E.g. can a website be built to show your "profile" and "interests" based on the Cohort, rather than just the FLoC ID? Google and others who (I assume) will share their back-end data will be able to build such a website. -) Can a "rainbow table of FLoCs" be pre-calcuated? This would allow to re-identify certain browsing habits of users -) In fact what if someone creates a Chrome extension that publishes visited domain names and their resulting FLoC ID - Imagine many people download and use it for fun! This would sort of decentralize the previous mentioned de-identification attacks and render FLoC useless for all other privacy concerned users. -) How much easier is it now to track a user with just IP address + FLoC ID now? BUT, what I'm missing entirely at this point is how will the web server (Google and other ad companies) actually *use/share* the Cohort information? That is not being described at all by Google - and seems rather critical to me. More details and testing ideas in this article: https://embracethered.com/blog/posts/2021/red-teaming-floc-chrome-cohort/ https://embracethered.com/blog/posts/2021/red-teaming-floc-c...

spullara 5y ago

I'd be super happy with something like this honestly. I do want to see advertisements, especially for things in my areas of interest, while being able to control the list. I would go one step further and make topics opt-in with a pending list of inferred topics.

iamben 5y ago

We're just going to end up back at contextual advertising again...

syrrim 5y ago

One thing I've noticed: very few ads are topic focused. Take an ad for a car, or for life insurance. This ad isn't aimed at someone who likes cars, or insurance. It's aimed at an average person, within a certain income bracket and stage of life. How would you know, based on browsing history, whether a person should be displayed such an ad? If they've visited websites for insurance, or cars, then they're a shoo-in, granted. Most people haven't. So the approach will be to identify people of a certain age and income, and figure out what websites they visit. Next, use tracking cookies to identify people who visit the same set of websites. Display the ad to all such people. The original FLoC fit into this model well. Whereas it might have picked out topics that a person likes, it would also likely have picked up other bits of demographic information like age, sex, wealth, which would be more useful for targeting. In moving to an explicitly topic focused model, google throws out this capability. Presumably, people from all age groups are interested in rock music, say. But the way that different people engage with that interest will be different, and therefore offer opportunities to identify more specific groups. A purely topic based model commingles these groups, and therefore makes targeting harder. To the degree it works, it will be against the intentions of the system, since explicit interests will be used as a proxy for demographic information, rather than used directly. As such, I doubt this model will leave anyone very happy. Advertisers will dislike that it offers poorer tracking, and users will dislike that it leaks demographic information. I for one am satisfied with an approach that screws over advertisers. However, I suspect google won't be. What I see as their only escape is to create sandboxed environments in the browser from which to run advertising targeting code. A javascript worker of some sort would be restricted from making web requests, and would only be able to act on information fed to it. This information would come from webpages the user visited, and would include information about the page, as well as their actions there. The worker would use this information to decide what ads to target at the user. Downloading a particular ad without leaking information remains a problem. You could download every possible ad, and have the worker select one, but this is very wasteful of bandwidth. "Private information retrieval" (PIR) schemes can reduce the bandwidth wastage substantially, without leaking any information to the server. These schemes have received a great deal of attention from cryptographers, but as far as I can tell have been overlooked by programmers. Likely this is because there are few instances where a project cares about privacy, but the project owner is untrusted to protect privacy. Thus, it seems like privacy protecting targeted advertising would be an ideal testbed for PIR. It would be very interesting if google went this route.

purplepatrick 5y ago

IMHO this is a terrible idea, because I guarantee you they’d screw up the categorization of “topics”. How granular should a “topic” be? “Financial services” isn’t gonna cut it. Or how about medical sites? “Medical” or “health” are useless mean-nothing buckets, while “rectal bleeding” may be too granular. Ditto the issue of topic visit frequency - sure, someone visiting shoe sites multiple times is a thing, but how often is someone going to look for, say, mortgage loans? ~90%+ of people only gather two offers for home loans, for example. They can get that on one site in one visit. But they may have read a ton about it before on sites that may only have been tagged as “financial content” or some wish washy label. Data structuring for topics, occupations, etc. online or offline has almost never succeeded. Ever. I have never seen anyone do it well and I work in an industry that depends on it. Oh, and don’t even get me started on sets… Making this the basis for targeting is really only going to help sell shoes, fashion, porn, jewelry, and cars.

jtsiskin 5y ago

There has to be a better way to do this with homomorphic encryption.

audit 5y ago

I see that folks in the comments are asking 'what would be an alternative to behavioral fingerprinting based on browsing history. Perhaps we can look at advertising as 2 categories: (1) advertising -- as means to notify about an existing product or a service (2) advertising as means to elevate one product over the other in the eyes of consumers. The (1)st category seems to be very legitimate and welcome. The (2)nd category falls into implicit manipulation, almost con-artistry. So let's assume that it is the (1)st category is the one the public would like to find solutions for (and the 2nd category will, eventually, become outlawed .. let's hope). With that in mind, perhaps a way for a user to set legitimate interest (at the browser level) and the type of 'pages' they accept to see ads would work. The 'types' of pages might be a some sort of taxonomy standard that labels a page with a type (eg privacy preserving or not and many subtypes). As a user navigates to through the web, only pages with specific subtypes, would participate in the 'digital identity build up'. The pages that, according to user preferences, cannot participate in the 'digital identity' build up -- can still show ads, but cannot use or 'donate' its information into the digital identity database.