5 ms·

Can you say more about how FLoC introduces new risks that don’t already exist with targeted ads?

tyingq 5y ago
It's front-loaded with misleading phrases like "privacy first".
vineyardmike 5y ago
Targeted ads use data that are owned by each company targeting. Sure you can buy/sell data in the market, but its somewhat decentralized. FLOC is centralized at the individual. That means YOU are profiled completely and all the profile info is centralized for everyone to grab.
- shuckles 5y ago
  I thought targeted ads let you buy an audience using all the information the ad network had about them. So in your framing, the “company targeting” would be Google, and they already know more than a FLOC cohort worth of information about you.
  - josefx 5y ago
    Officially Google doesn't hand out information who belongs to what group. With FLOC your browser tells everyone in what "cohort" you are, if a cohort can be used to identify gay people just visiting government websites in an anti gay country could end very badly.
    - Spivak 5y ago
      Some additional context because it's not super clear how you turn some opaque cohort ID into something that can find gay people. Being gay is a really strong really specific signal online. Every content recommendation algorithm once it gets even a whiff you like girl in red will start recommending you other queers like there's no tomorrow. Content for gays is niche, doesn't have much broad appeal, and is a strong predictor you'll like other content aimed at gays. So all you need to do to find closeted gay people is to look at the cohorts of an out gay person.
  - vineyardmike 5y ago
    Yes this is true of major ad networks, but there is also straight data brokers who "just" buy/sell data. FB and google used to (idk about now, don't care to check) allow you to upload data you gathered/bought and use it for tracking. To prove a point, i created a fb ad to target my parents and family (uploaded their email, phone number, identifiers, interests, locations they frequent - only data i knew fb already had) and watched as their ads became "hey vineyardmike's parents. the internet is not private".
- danShumway 5y ago
  To expand on this: with targeted ads, if I want to find out if you're gay I need to figure out a way to track you across sites that give me that information, or to specifically buy that data from a company that's already tracking you. With FLoC, anyone can get that data without entering into an expensive agreement. I can get that data as a single person from a personal blog with no cookies. I can get that data directly, I don't need to sign up with another 3rd-party tracking company that might not tell why they're serving my users a specific ad or what data they have about them. And it's all scaleable with no extra cost to my operations. This opens up additional attack vectors that might not exist otherwise: in a small operation it may be a lot easier for me to fingerprint you using your IP address, login information, or other data I have access to and to correlate that to a real-world identity. When that happens, I also have access to all of the information about you from your FLoC categories, for free. On some level, Google is taking a gamble that users will be difficult to fingerprint or identify using FLoC so it won't matter that some sensitive information is leaked. But it's just not the case, users can be fingerprinted. And in scenarios where they are fingerprinted/identified, FLoC provides a much more complete picture of that person based on activity from sites that might not have ever sold that information, that might have never intended to leak information about them in the first place.
btown 5y ago
With cross-site cookies, adnetwork.com has full information about what sites you've visited (among sites that incorporate their cookies). This isn't good either! But generally speaking, an individual site using adnetwork.com for advertising won't have or want access to that vector of your interests; many site operators don't even have visibility into what ads win real-time bidding, just that they're receiving money for providing their inventory. Certainly there are players that can provide demographic targeting metadata to site operators, but to my knowledge they are less widely known and certainly not cheap, and I imagine (or hope) any players with wide enough cookie reach would be discouraged from maintaining a database that could associate metadata with PII. With FLoC, though, the idea was that the browser would provide document.interestCohort() and the individual site's JS could react accordingly: https://github.com/WICG/floc https://github.com/WICG/floc . This means that any site, regardless of its contracts with ad networks, could immediately identify your cohort and associate it with your activity. Web developers working in good faith would be encouraged to have user.cohort or user.topic fields from day one "just so you have it" - imagine all the ways someone could use this in bad faith. Inevitably this data would leak (or be intentionally leaked) and could trivially become a target list for doxxing closeted people. It's a dangerous, dangerous proposal.
- shuckles 5y ago
  I didn’t understand that the browser would make FLOC cohorts directly available to anyone running JavaScript in my browser. Unless Google also solves fingerprinting (not to mention that I identify myself on many websites), I’m not sure I understand how this is viable. It seems even worse than the old criticism that Google was selling my data. It never did that, but now it’s giving away my data for free!
  - vineyardmike 5y ago
    > it’s giving away my data for free It shows that google no longer things owning data is a competitive advantage. This seems like it should be bigger news.
  - jefftk 5y ago
    > Unless Google also solves fingerprinting FLoC is one of a collection of proposals, which does include preventing fingerprinting: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... If you're not going to prevent fingerprinting, why even get rid of third-party cookies? Fingerprinting is a step backwards from cookies, since, for example, closing and reopening a private browsing window gives you a new cookie jar but the same fingerprint. (Disclosure: I work for Google, speaking only for myself)
Spivak 5y ago
Because it exposes cross-site data to every website that didn't have access to it previously and tracks users on websites that they weren't previously being tracked. FLoC is fundamentally is a proxy for your aggregate browser history which is something that hasn't really be exposed before.

It's front-loaded with misleading phrases like "privacy first".

Targeted ads use data that are owned by each company targeting. Sure you can buy/sell data in the market, but its somewhat decentralized. FLOC is centralized at the individual. That means YOU are profiled completely and all the profile info is centralized for everyone to grab.

shuckles 5y ago
I thought targeted ads let you buy an audience using all the information the ad network had about them. So in your framing, the “company targeting” would be Google, and they already know more than a FLOC cohort worth of information about you.
- josefx 5y ago
  Officially Google doesn't hand out information who belongs to what group. With FLOC your browser tells everyone in what "cohort" you are, if a cohort can be used to identify gay people just visiting government websites in an anti gay country could end very badly.
  - Spivak 5y ago
    Some additional context because it's not super clear how you turn some opaque cohort ID into something that can find gay people. Being gay is a really strong really specific signal online. Every content recommendation algorithm once it gets even a whiff you like girl in red will start recommending you other queers like there's no tomorrow. Content for gays is niche, doesn't have much broad appeal, and is a strong predictor you'll like other content aimed at gays. So all you need to do to find closeted gay people is to look at the cohorts of an out gay person.
- vineyardmike 5y ago
  Yes this is true of major ad networks, but there is also straight data brokers who "just" buy/sell data. FB and google used to (idk about now, don't care to check) allow you to upload data you gathered/bought and use it for tracking. To prove a point, i created a fb ad to target my parents and family (uploaded their email, phone number, identifiers, interests, locations they frequent - only data i knew fb already had) and watched as their ads became "hey vineyardmike's parents. the internet is not private".
danShumway 5y ago
To expand on this: with targeted ads, if I want to find out if you're gay I need to figure out a way to track you across sites that give me that information, or to specifically buy that data from a company that's already tracking you. With FLoC, anyone can get that data without entering into an expensive agreement. I can get that data as a single person from a personal blog with no cookies. I can get that data directly, I don't need to sign up with another 3rd-party tracking company that might not tell why they're serving my users a specific ad or what data they have about them. And it's all scaleable with no extra cost to my operations. This opens up additional attack vectors that might not exist otherwise: in a small operation it may be a lot easier for me to fingerprint you using your IP address, login information, or other data I have access to and to correlate that to a real-world identity. When that happens, I also have access to all of the information about you from your FLoC categories, for free. On some level, Google is taking a gamble that users will be difficult to fingerprint or identify using FLoC so it won't matter that some sensitive information is leaked. But it's just not the case, users can be fingerprinted. And in scenarios where they are fingerprinted/identified, FLoC provides a much more complete picture of that person based on activity from sites that might not have ever sold that information, that might have never intended to leak information about them in the first place.

btown 5y ago

With cross-site cookies, adnetwork.com has full information about what sites you've visited (among sites that incorporate their cookies). This isn't good either! But generally speaking, an individual site using adnetwork.com for advertising won't have or want access to that vector of your interests; many site operators don't even have visibility into what ads win real-time bidding, just that they're receiving money for providing their inventory. Certainly there are players that can provide demographic targeting metadata to site operators, but to my knowledge they are less widely known and certainly not cheap, and I imagine (or hope) any players with wide enough cookie reach would be discouraged from maintaining a database that could associate metadata with PII. With FLoC, though, the idea was that the browser would provide document.interestCohort() and the individual site's JS could react accordingly: https://github.com/WICG/floc https://github.com/WICG/floc . This means that any site, regardless of its contracts with ad networks, could immediately identify your cohort and associate it with your activity. Web developers working in good faith would be encouraged to have user.cohort or user.topic fields from day one "just so you have it" - imagine all the ways someone could use this in bad faith. Inevitably this data would leak (or be intentionally leaked) and could trivially become a target list for doxxing closeted people. It's a dangerous, dangerous proposal.

shuckles 5y ago
I didn’t understand that the browser would make FLOC cohorts directly available to anyone running JavaScript in my browser. Unless Google also solves fingerprinting (not to mention that I identify myself on many websites), I’m not sure I understand how this is viable. It seems even worse than the old criticism that Google was selling my data. It never did that, but now it’s giving away my data for free!
- vineyardmike 5y ago
  > it’s giving away my data for free It shows that google no longer things owning data is a competitive advantage. This seems like it should be bigger news.
- jefftk 5y ago
  > Unless Google also solves fingerprinting FLoC is one of a collection of proposals, which does include preventing fingerprinting: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... If you're not going to prevent fingerprinting, why even get rid of third-party cookies? Fingerprinting is a step backwards from cookies, since, for example, closing and reopening a private browsing window gives you a new cookie jar but the same fingerprint. (Disclosure: I work for Google, speaking only for myself)

Spivak 5y ago

Because it exposes cross-site data to every website that didn't have access to it previously and tracks users on websites that they weren't previously being tracked. FLoC is fundamentally is a proxy for your aggregate browser history which is something that hasn't really be exposed before.