5 ms·

This was true of FLoC and it's perhaps even more critical now that topics are more easy for advertisers to understand: Do. Not. Allow. Anything. LGBTQ+. Relate

by btown 5y ago

This was true of FLoC and it's perhaps even more critical now that topics are more easy for advertisers to understand: Do. Not. Allow. Anything. LGBTQ+. Related. To. Be. A. Topic. Unless. It's. Opt. In. People. Live. In. Unpredictably. Unsafe. Places. People. Will. Die.

shuckles 5y ago
Can you say more about how FLoC introduces new risks that don’t already exist with targeted ads?
- tyingq 5y ago
  It's front-loaded with misleading phrases like "privacy first".
- vineyardmike 5y ago
  Targeted ads use data that are owned by each company targeting. Sure you can buy/sell data in the market, but its somewhat decentralized. FLOC is centralized at the individual. That means YOU are profiled completely and all the profile info is centralized for everyone to grab.
  - shuckles 5y ago
    I thought targeted ads let you buy an audience using all the information the ad network had about them. So in your framing, the “company targeting” would be Google, and they already know more than a FLOC cohort worth of information about you.
    - josefx 5y ago
      Officially Google doesn't hand out information who belongs to what group. With FLOC your browser tells everyone in what "cohort" you are, if a cohort can be used to identify gay people just visiting government websites in an anti gay country could end very badly.
      - Spivak 5y ago
        Some additional context because it's not super clear how you turn some opaque cohort ID into something that can find gay people. Being gay is a really strong really specific signal online. Every content recommendation algorithm once it gets even a whiff you like girl in red will start recommending you other queers like there's no tomorrow. Content for gays is niche, doesn't have much broad appeal, and is a strong predictor you'll like other content aimed at gays. So all you need to do to find closeted gay people is to look at the cohorts of an out gay person.
    - vineyardmike 5y ago
      Yes this is true of major ad networks, but there is also straight data brokers who "just" buy/sell data. FB and google used to (idk about now, don't care to check) allow you to upload data you gathered/bought and use it for tracking. To prove a point, i created a fb ad to target my parents and family (uploaded their email, phone number, identifiers, interests, locations they frequent - only data i knew fb already had) and watched as their ads became "hey vineyardmike's parents. the internet is not private".
  - danShumway 5y ago
    To expand on this: with targeted ads, if I want to find out if you're gay I need to figure out a way to track you across sites that give me that information, or to specifically buy that data from a company that's already tracking you. With FLoC, anyone can get that data without entering into an expensive agreement. I can get that data as a single person from a personal blog with no cookies. I can get that data directly, I don't need to sign up with another 3rd-party tracking company that might not tell why they're serving my users a specific ad or what data they have about them. And it's all scaleable with no extra cost to my operations. This opens up additional attack vectors that might not exist otherwise: in a small operation it may be a lot easier for me to fingerprint you using your IP address, login information, or other data I have access to and to correlate that to a real-world identity. When that happens, I also have access to all of the information about you from your FLoC categories, for free. On some level, Google is taking a gamble that users will be difficult to fingerprint or identify using FLoC so it won't matter that some sensitive information is leaked. But it's just not the case, users can be fingerprinted. And in scenarios where they are fingerprinted/identified, FLoC provides a much more complete picture of that person based on activity from sites that might not have ever sold that information, that might have never intended to leak information about them in the first place.
- btown 5y ago
  With cross-site cookies, adnetwork.com has full information about what sites you've visited (among sites that incorporate their cookies). This isn't good either! But generally speaking, an individual site using adnetwork.com for advertising won't have or want access to that vector of your interests; many site operators don't even have visibility into what ads win real-time bidding, just that they're receiving money for providing their inventory. Certainly there are players that can provide demographic targeting metadata to site operators, but to my knowledge they are less widely known and certainly not cheap, and I imagine (or hope) any players with wide enough cookie reach would be discouraged from maintaining a database that could associate metadata with PII. With FLoC, though, the idea was that the browser would provide document.interestCohort() and the individual site's JS could react accordingly: https://github.com/WICG/floc https://github.com/WICG/floc . This means that any site, regardless of its contracts with ad networks, could immediately identify your cohort and associate it with your activity. Web developers working in good faith would be encouraged to have user.cohort or user.topic fields from day one "just so you have it" - imagine all the ways someone could use this in bad faith. Inevitably this data would leak (or be intentionally leaked) and could trivially become a target list for doxxing closeted people. It's a dangerous, dangerous proposal.
  - shuckles 5y ago
    I didn’t understand that the browser would make FLOC cohorts directly available to anyone running JavaScript in my browser. Unless Google also solves fingerprinting (not to mention that I identify myself on many websites), I’m not sure I understand how this is viable. It seems even worse than the old criticism that Google was selling my data. It never did that, but now it’s giving away my data for free!
    - vineyardmike 5y ago
      > it’s giving away my data for free It shows that google no longer things owning data is a competitive advantage. This seems like it should be bigger news.
    - jefftk 5y ago
      > Unless Google also solves fingerprinting FLoC is one of a collection of proposals, which does include preventing fingerprinting: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... If you're not going to prevent fingerprinting, why even get rid of third-party cookies? Fingerprinting is a step backwards from cookies, since, for example, closing and reopening a private browsing window gives you a new cookie jar but the same fingerprint. (Disclosure: I work for Google, speaking only for myself)
- Spivak 5y ago
  Because it exposes cross-site data to every website that didn't have access to it previously and tracks users on websites that they weren't previously being tracked. FLoC is fundamentally is a proxy for your aggregate browser history which is something that hasn't really be exposed before.
kodah 5y ago
I've been trying to talk privacy with people for a while. Some folks see targeted advertising as "good" because it introduces them to new products or services. To some milquetoast person with nothing "special" going on in life that's just fine, however, if you are involved in anything that you don't want the average Tom, Dick, or Harry to know about then you're fighting an up-hill battle against a monster that you can't really see but from a distance. To me, in the United States, there are two major camps of thought: * Targeted advertising is useful to me and I don't mind someone knowing everything about me * Targeted advertising is dangerous to me for x, y, and z reason A world that allows both is optimal. Allow companies to collect data, but have federal agency oversight and requirements up to and including the right to be forgotten. It should be possible to pull a level and dump most (if not all) collected data associated with you.
- danShumway 5y ago
  > Allow companies to collect data, but have federal agency oversight and requirements up to and including the right to be forgotten. I agree with your overall sentiment, but I think the solution you propose is bad. It allows companies to collect data automatically behind users' backs, and then tries to address the extreme power imbalance that creates with regulations and escape hatches that users can take after that data has already been created. But ideally, we want to prevent problems from occurring at all, not just to try and fix them after the fact. To your point about voluntary tracking, users may want to signal interest in some topics but not others. They may want to signal interest about some topics only in certain situations. They may want to signal interest about a topic to one site, but signal interest about another topic to a different site. They may want to "freeze" the topics that they signal interest about, so that they don't need to worry about accidentally revealing new preferences in the future, or to think about how browsing a set of sites will change the ads that they get. All of these are valid things for a user to want to do. It is better if users have complete agency over what data is transmitted, and if companies do not fingerprint or correlate users behind their backs at all. Attempting to determine user cohorts clientside is the correct move, arguably the only part of FLoC that Google got right. The problem with FLoC is that even if cohorts are determined completely clientside, the user still does not have agency and transparency about those cohorts. There is theoretically a version of FLoC that would be really good for privacy, and that would also allow the kind of optional tracking that some users want. Such a system would need to be easy for users to toggle on and off on the fly on a site-by-site basis. It would need to be transparent to users about what categories they're in, it would need to allow users to edit and delete their categories, to add new categories, and to turn off category aggregation. It would need to not send new categories to a website without the user's permission. It would need to block websites from determining whether they're being given an automatically generated category, or a user-defined category. And importantly, it would all need to be opt-in. Right now, tracking is an invisible system that happens automatically, with (rare) escape hatches that the majority of users are not expected to pursue, and that give little to no granularity about how users can customize how they present to the world. This kind of tracking is inherently invasive. We should pursue a paradigm shift where users proactively volunteer information about how they want to present to the world in any given situation -- in other words, we should give users agency to choose their own identities online. Most regulatory suggestions that I see online (including the one you give) consciously or unconsciously focus on preserving the invasive nature of tracking while adding safeguards to try and prevent advertisers from abusing the inherent power imbalance. Instead, that power imbalance ought to be totally flipped in favor of the user. We need to reject the underlying idea that preferences should be extracted from users, rather than something that users consciously choose to volunteer. ---- I've commented to the same effect a couple of times in the past: - https://news.ycombinator.com/item?id=25906791 https://news.ycombinator.com/item?id=25906791 - https://news.ycombinator.com/item?id=26353494 https://news.ycombinator.com/item?id=26353494 - https://news.ycombinator.com/item?id=25907079 https://news.ycombinator.com/item?id=25907079 This isn't only true for advertising. Think about how little control users have over how personalized algorithmic content filtering/ordering works on sites like Youtube, and you'll see similar conceptual problems with how the systems are designed. But it's really apparent in advertising, moreso than in other contexts. I want to fight back against policy changes that (in my mind) cement and normalize the current philosophical approach to advertising. It's not OK to be tracked without your permission, and regulations or safeguards and escape hatches around tracking aren't enough to make it OK. The system would still be fundamentally broken.
audit 5y ago
Same for people questioning efficacy and mandates of the emergency-only covid vaccine, or legitimacy of Biden's presidency: "... There are also continued, non-specific calls for violence on multiple online platforms associated with DVE ideologies or conspiracy theories on perceived election fraud and alleged reinstatement, and responses to anticipated restrictions relating to the increasing COVID cases. ..." [1] So browsing thegatewaypundit.com, gab.com and theconservativetreehouse.com might get you jailed, or 'suicided', and, certainly, economically ruined -- by federal law enforcement of the wealthiest country on Earth... [1] https://www.dhs.gov/ntas/advisory/national-terrorism-advisory-system-bulletin-august-13-2021 https://www.dhs.gov/ntas/advisory/national-terrorism-advisor...
googlryas 5y ago
Please don't type like that, it is hell for screen readers. I stopped reading at LGBTQ+.
- btown 5y ago
  Thanks for pointing this out, and I'm so sorry. My original text without styling, for what it's worth, is the three sentences that follow: > Do not allow anything LGBTQ+ related to be a topic unless it's opt-in. People live in unpredictably unsafe places. People will die. I try to write in an accessible way generally, but in this specific case I wanted a message that would stand out visually to sighted people, because they are the most likely (probabilistically) to be both the group leading this project at Google, and also the group who might have not thought about how their technical choices can impact people with diverse backgrounds. I definitely tripped over the trolley problem here, and I sincerely apologize for hurting you.

by btown 5y ago

shuckles 5y ago

Can you say more about how FLoC introduces new risks that don’t already exist with targeted ads?

tyingq 5y ago
It's front-loaded with misleading phrases like "privacy first".
vineyardmike 5y ago
Targeted ads use data that are owned by each company targeting. Sure you can buy/sell data in the market, but its somewhat decentralized. FLOC is centralized at the individual. That means YOU are profiled completely and all the profile info is centralized for everyone to grab.
- shuckles 5y ago
  I thought targeted ads let you buy an audience using all the information the ad network had about them. So in your framing, the “company targeting” would be Google, and they already know more than a FLOC cohort worth of information about you.
  - josefx 5y ago
    Officially Google doesn't hand out information who belongs to what group. With FLOC your browser tells everyone in what "cohort" you are, if a cohort can be used to identify gay people just visiting government websites in an anti gay country could end very badly.
    - Spivak 5y ago
      Some additional context because it's not super clear how you turn some opaque cohort ID into something that can find gay people. Being gay is a really strong really specific signal online. Every content recommendation algorithm once it gets even a whiff you like girl in red will start recommending you other queers like there's no tomorrow. Content for gays is niche, doesn't have much broad appeal, and is a strong predictor you'll like other content aimed at gays. So all you need to do to find closeted gay people is to look at the cohorts of an out gay person.
  - vineyardmike 5y ago
    Yes this is true of major ad networks, but there is also straight data brokers who "just" buy/sell data. FB and google used to (idk about now, don't care to check) allow you to upload data you gathered/bought and use it for tracking. To prove a point, i created a fb ad to target my parents and family (uploaded their email, phone number, identifiers, interests, locations they frequent - only data i knew fb already had) and watched as their ads became "hey vineyardmike's parents. the internet is not private".
- danShumway 5y ago
  To expand on this: with targeted ads, if I want to find out if you're gay I need to figure out a way to track you across sites that give me that information, or to specifically buy that data from a company that's already tracking you. With FLoC, anyone can get that data without entering into an expensive agreement. I can get that data as a single person from a personal blog with no cookies. I can get that data directly, I don't need to sign up with another 3rd-party tracking company that might not tell why they're serving my users a specific ad or what data they have about them. And it's all scaleable with no extra cost to my operations. This opens up additional attack vectors that might not exist otherwise: in a small operation it may be a lot easier for me to fingerprint you using your IP address, login information, or other data I have access to and to correlate that to a real-world identity. When that happens, I also have access to all of the information about you from your FLoC categories, for free. On some level, Google is taking a gamble that users will be difficult to fingerprint or identify using FLoC so it won't matter that some sensitive information is leaked. But it's just not the case, users can be fingerprinted. And in scenarios where they are fingerprinted/identified, FLoC provides a much more complete picture of that person based on activity from sites that might not have ever sold that information, that might have never intended to leak information about them in the first place.
btown 5y ago
With cross-site cookies, adnetwork.com has full information about what sites you've visited (among sites that incorporate their cookies). This isn't good either! But generally speaking, an individual site using adnetwork.com for advertising won't have or want access to that vector of your interests; many site operators don't even have visibility into what ads win real-time bidding, just that they're receiving money for providing their inventory. Certainly there are players that can provide demographic targeting metadata to site operators, but to my knowledge they are less widely known and certainly not cheap, and I imagine (or hope) any players with wide enough cookie reach would be discouraged from maintaining a database that could associate metadata with PII. With FLoC, though, the idea was that the browser would provide document.interestCohort() and the individual site's JS could react accordingly: https://github.com/WICG/floc https://github.com/WICG/floc . This means that any site, regardless of its contracts with ad networks, could immediately identify your cohort and associate it with your activity. Web developers working in good faith would be encouraged to have user.cohort or user.topic fields from day one "just so you have it" - imagine all the ways someone could use this in bad faith. Inevitably this data would leak (or be intentionally leaked) and could trivially become a target list for doxxing closeted people. It's a dangerous, dangerous proposal.
- shuckles 5y ago
  I didn’t understand that the browser would make FLOC cohorts directly available to anyone running JavaScript in my browser. Unless Google also solves fingerprinting (not to mention that I identify myself on many websites), I’m not sure I understand how this is viable. It seems even worse than the old criticism that Google was selling my data. It never did that, but now it’s giving away my data for free!
  - vineyardmike 5y ago
    > it’s giving away my data for free It shows that google no longer things owning data is a competitive advantage. This seems like it should be bigger news.
  - jefftk 5y ago
    > Unless Google also solves fingerprinting FLoC is one of a collection of proposals, which does include preventing fingerprinting: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... If you're not going to prevent fingerprinting, why even get rid of third-party cookies? Fingerprinting is a step backwards from cookies, since, for example, closing and reopening a private browsing window gives you a new cookie jar but the same fingerprint. (Disclosure: I work for Google, speaking only for myself)
Spivak 5y ago
Because it exposes cross-site data to every website that didn't have access to it previously and tracks users on websites that they weren't previously being tracked. FLoC is fundamentally is a proxy for your aggregate browser history which is something that hasn't really be exposed before.

kodah 5y ago

I've been trying to talk privacy with people for a while. Some folks see targeted advertising as "good" because it introduces them to new products or services. To some milquetoast person with nothing "special" going on in life that's just fine, however, if you are involved in anything that you don't want the average Tom, Dick, or Harry to know about then you're fighting an up-hill battle against a monster that you can't really see but from a distance. To me, in the United States, there are two major camps of thought: * Targeted advertising is useful to me and I don't mind someone knowing everything about me * Targeted advertising is dangerous to me for x, y, and z reason A world that allows both is optimal. Allow companies to collect data, but have federal agency oversight and requirements up to and including the right to be forgotten. It should be possible to pull a level and dump most (if not all) collected data associated with you.

danShumway 5y ago
> Allow companies to collect data, but have federal agency oversight and requirements up to and including the right to be forgotten. I agree with your overall sentiment, but I think the solution you propose is bad. It allows companies to collect data automatically behind users' backs, and then tries to address the extreme power imbalance that creates with regulations and escape hatches that users can take after that data has already been created. But ideally, we want to prevent problems from occurring at all, not just to try and fix them after the fact. To your point about voluntary tracking, users may want to signal interest in some topics but not others. They may want to signal interest about some topics only in certain situations. They may want to signal interest about a topic to one site, but signal interest about another topic to a different site. They may want to "freeze" the topics that they signal interest about, so that they don't need to worry about accidentally revealing new preferences in the future, or to think about how browsing a set of sites will change the ads that they get. All of these are valid things for a user to want to do. It is better if users have complete agency over what data is transmitted, and if companies do not fingerprint or correlate users behind their backs at all. Attempting to determine user cohorts clientside is the correct move, arguably the only part of FLoC that Google got right. The problem with FLoC is that even if cohorts are determined completely clientside, the user still does not have agency and transparency about those cohorts. There is theoretically a version of FLoC that would be really good for privacy, and that would also allow the kind of optional tracking that some users want. Such a system would need to be easy for users to toggle on and off on the fly on a site-by-site basis. It would need to be transparent to users about what categories they're in, it would need to allow users to edit and delete their categories, to add new categories, and to turn off category aggregation. It would need to not send new categories to a website without the user's permission. It would need to block websites from determining whether they're being given an automatically generated category, or a user-defined category. And importantly, it would all need to be opt-in. Right now, tracking is an invisible system that happens automatically, with (rare) escape hatches that the majority of users are not expected to pursue, and that give little to no granularity about how users can customize how they present to the world. This kind of tracking is inherently invasive. We should pursue a paradigm shift where users proactively volunteer information about how they want to present to the world in any given situation -- in other words, we should give users agency to choose their own identities online. Most regulatory suggestions that I see online (including the one you give) consciously or unconsciously focus on preserving the invasive nature of tracking while adding safeguards to try and prevent advertisers from abusing the inherent power imbalance. Instead, that power imbalance ought to be totally flipped in favor of the user. We need to reject the underlying idea that preferences should be extracted from users, rather than something that users consciously choose to volunteer. ---- I've commented to the same effect a couple of times in the past: - https://news.ycombinator.com/item?id=25906791 https://news.ycombinator.com/item?id=25906791 - https://news.ycombinator.com/item?id=26353494 https://news.ycombinator.com/item?id=26353494 - https://news.ycombinator.com/item?id=25907079 https://news.ycombinator.com/item?id=25907079 This isn't only true for advertising. Think about how little control users have over how personalized algorithmic content filtering/ordering works on sites like Youtube, and you'll see similar conceptual problems with how the systems are designed. But it's really apparent in advertising, moreso than in other contexts. I want to fight back against policy changes that (in my mind) cement and normalize the current philosophical approach to advertising. It's not OK to be tracked without your permission, and regulations or safeguards and escape hatches around tracking aren't enough to make it OK. The system would still be fundamentally broken.

audit 5y ago

Same for people questioning efficacy and mandates of the emergency-only covid vaccine, or legitimacy of Biden's presidency: "... There are also continued, non-specific calls for violence on multiple online platforms associated with DVE ideologies or conspiracy theories on perceived election fraud and alleged reinstatement, and responses to anticipated restrictions relating to the increasing COVID cases. ..." [1] So browsing thegatewaypundit.com, gab.com and theconservativetreehouse.com might get you jailed, or 'suicided', and, certainly, economically ruined -- by federal law enforcement of the wealthiest country on Earth... [1] https://www.dhs.gov/ntas/advisory/national-terrorism-advisory-system-bulletin-august-13-2021 https://www.dhs.gov/ntas/advisory/national-terrorism-advisor...

googlryas 5y ago

Please don't type like that, it is hell for screen readers. I stopped reading at LGBTQ+.

btown 5y ago
Thanks for pointing this out, and I'm so sorry. My original text without styling, for what it's worth, is the three sentences that follow: > Do not allow anything LGBTQ+ related to be a topic unless it's opt-in. People live in unpredictably unsafe places. People will die. I try to write in an accessible way generally, but in this specific case I wanted a message that would stand out visually to sighted people, because they are the most likely (probabilistically) to be both the group leading this project at Google, and also the group who might have not thought about how their technical choices can impact people with diverse backgrounds. I definitely tripped over the trolley problem here, and I sincerely apologize for hurting you.