What is Google FLoC and How Does It Affect Your Privacy

Google Chrome, the world’s most widely used web browser, wants cookies to FLoC off.

In January 2020, Google announced that it will block third-party cookies by default from Chrome by 2022 -- a move that other browsers, including Firefox, Safari, and Avast Secure Browser, made years ago to protect users’ privacy. Although the company has since extended its deadline to late 2023, with a 64% market share and 2.6 billion users, Google Chrome’s plans rang the death knell for the digital ad industry’s most valuable advertising and monetization method.

How does tracking work today?

Cookies are currently the most common method of identifying and tracking users online. First-party cookies are used by site owners to remember your username, password, language preferences, and items added to your online shopping carts, to provide users with an easier, faster, and more convenient browsing experience.

But cookies can also pose a danger to your browser’s security and privacy. Advertisers use third-party cookies to follow you around the web - recording your interests and habits - which can then be used for targeted advertising or sold for profit.

What is Google FLoC?

Instead of automatically blocking cookies entirely, Google wants to completely overhaul the way users are tracked online. And it’s got something new in the oven - an experimental tracking feature called FLoC, or Federated Learning of Cohorts.

Instead of exposing details on individual users, FLoC replaces the tracking cookie with a “cohort” identifier, which is then used to group people with similar interests together.

The idea is that digital advertisers can then use these cohorts to build a list of sites that all users in a cohort visit, and if the interests of those users are similar, this cohort identifier can be used for ad targeting.

FLoC aims to give digital advertisers a way of targeting ads without exposing details on individual users. It does this by grouping people with similar interests together. FLoC replaces the tracking cookie with a new “cohort” identifier which represents not a single user but a group of users with similar interests. Advertisers can then build a list of the sites that all users in a cohort visit, but not the history of an individual user. If the interests of users in a cohort are truly similar, this cohort identifier can be used for ad targeting.

FLoC may be designed to provide users with increased privacy, but industry experts are concerned that this new functionality won’t be enough to truly protect users’ identities. Digital advertisers are already working on ways to improve the accuracy of existing tracking technology, such as developing techniques to associate FLoC IDs with other information (like your internet browsing history). By associating someone with multiple cohort groups, it’s theoretically possible to place them within a much smaller cohort (i.e., within the center circle where the groups overlap, which makes the users easier to identify. Because only a few thousand people will share a given cohort ID, trackers can narrow down the set of users very quickly, so long as they have sufficient information.

With FLoC IDs, companies will no longer have to drop a cookie when you visit a site on your web browser in order to track you. Experts are concerned this will allow companies to harvest user information more easily. Scanning your FLoC ID when you first visit a site would now give the companies a lot of information upfront. Essentially, your FLoC ID would constitute an additional data point for advertisers to use, allowing them to fingerprint and track you. With current tracking practices and FLoC IDs, companies may potentially be able to make more accurate identifications.

While Google may have created FLoC to increase users' privacy, digital advertisers plan to leverage it to increase the accuracy of their tracking efforts and make it easier for them to do so.

Aside from Chrome, no other browser at this time has shown interest in implementing FLoC IDs. Although Avast Secure Browser is built on Chromium (not to be confused with Chrome), our browser does not support FLoC for the reasons mentioned above in order to ensure users’ privacy is fully protected.

Have you been FLoCed?

On July 13, Google concluded its initial trial of FLoC. This “origin trial” was deployed to millions of Chrome users at random in selected regions, including Australia, Brazil, Canada, India, Indonesia, Japan, Mexico, New Zealand, the Philippines, and the United States. In response, the Electronic Frontier Foundation, or EFF, launched Am I FLoCed, a new site that will check whether FLoC has been enabled in your browser.

While this initial trial may have concluded, the company said it plans to make improvements on FLoC and share more information on future tests in the coming weeks.

How to opt-out of FLoC in Google Chrome

Chrome users in the initial trial were opted into FLoC by default, so if you find yourself an unwitting participant in the next trial, you may need to go into your Chrome browser’s settings and opt-out. Here’s how:

1. Click the menu and select Settings to open (on Windows), or select Chrome and then Preferences (on Mac)
2. Select “Privacy and Security” in the left panel.
3. Click “Privacy Sandbox” at the bottom of the Privacy and Security section on the right panel.
4. On the Privacy Sandbox page, click the “Privacy Sandbox trials” switch to disable this feature (gray indicates the feature has been disabled).

Or you can avoid the automatic inclusion of FLoC by using virtually any other browser - preferably a privacy-first alternative, like Avast Secure Browser. Our privacy browser gives you granular control over cookies, plus automatic AdBlock, built-in VPN, and powerful encryption.

Bet on Private-By-Design

Perhaps tracking cookies’ impending curtain call is long overdue. Between now and that cookie-free future, there are things you can do to thwart online tracking and safeguard your privacy.

1. Switch to a privacy-first browser
2. Utilize an adblocker
3. Turn on device-wide VPN protection
4. Enable DNS-over-TLS

If companies like Google (and its parent company, Alphabet) truly want to put privacy first, it’s a good idea to start with solutions that minimize potentially unsafe tracking practices. Online advertising’s infrastructure could use a good re-work, but in doing so, we should prioritize the privacy of the users rather than focusing on the needs of advertisers.