Root Causes 228: Getting the FLoC out of Here

Hosted by

Fellow

Original broadcast date

June 1, 2022

In a follow-up to our recent episode on cookies and browser tracking, we discuss Google's Federated Learning of Cohorts (FLoC) initiative, why it failed as a response, and other directions the industry is looking in.

Podcast transcript

Lightly edited for flow and brevity.

TCTim CallanIn an earlier episode, you did I think a very good job of defining a baseline of trackability of individual browsers through browser footprinting, cookies, tracking pixels and things along those lines and why that is potentially troubling and we are gonna follow up on that and talk about the response to that.

Jason SorokoWe talked a lot about how the issues of privacy while you are browsing on the web have kind of come to a head and a lot of this is due to initiatives in Europe with regards to privacy and so, therefore, if you are an industry – a really, really big industry it turns out – that uses the underlying technology such as cookies and tracking pixels and etc., etc., and then some major chunk of the world market basically legislates you to not use that technology, you are gonna want to try to come up with something else very quickly.

There’s been a number of technologies and I just want to use this podcast to go through some of them, not in enormous depth but try to keep it close to our chest and make people understand what’s happening with identity while you are browsing because it used to be – and this is what we talked about in the last podcast – you can basically be uniquely identified and there are so many really clever ways that people who are involved in marketing, people who are nefarious and people who are even trying to do really legitimate, very good things, such as try to make sure that is this actually you doing your banking?

TCTim CallanGive you a better user experience.

Jason SorokoThere are a lot of good and not good reasons to track you. A lot of good, bad reasons to actually want to know you are you while you are browsing around the web. Here is something that Google came up with and this has since been dismantled, taken down, it kind of has reemerged. Let’s just put a name to it. FLoC. That’s the acronym.

F-L-o-C and that stands for Federated Learning of Cohorts. Tim, you love words. I love words. Those are interesting words to pack together aren’t they?

TCTim CallanThose are interesting words. The word cohort in particular I am very interested in but go on.

Jason SorokoLet’s just go through why first even before what it is. Basically, cookies are tracking you. Cookies are evil. Or they could be used for evil.

TCTim CallanPotentially evil. Yes.

Jason SorokoPotential. So, your identity could be profiled down to the person. That’s a privacy issue. The ability to manage that. The ability for a website to allow you to manage the storage of the underlying mechanism which is a cookie. Oh my God. Who even knows what that is. It took us a whole podcast to explain it. What a pain in the butt. So, therefore, I think people like Google, a major vendor in the advertising space that uses these underlying technologies, they took the initiative to come up with Federated Learning of Cohorts, which basically is, they are worried for their revenue ad dollars. They were trying to come up with an idea to say, alright, some of these things that Europe is afraid of, let’s address these kind of directly which is we want to target people, still want to do that. We want to target people with advertising but we want to do it, yes, in a targeted way but not down to the individual person and will also give them some better ability to be able to manage what we know about you and what we are tracking about you and isn’t that great. So, they came up with Federated Learning of Cohorts.

TCTim CallanThey want to be able to tell, to pin a salient quality onto somebody so that they can target a message. For instance, to use our example from the last podcast, you were shopping for pants but they don’t care that it’s you. It’s not important that I can isolate this down to the individual who will then proceed to also go to this bank account, by way of example or the individual that has this name. They just want to be able to say I have a high degree of confidence that you match this particular profile need so that I can give you something that’s targeted at that profile. Am I getting that right?

Jason SorokoThat’s it, Tim. So, therefore, let’s get down into the nitty-gritty of FLoC here. This is really a Chrome browser-based technology. It doesn’t exist at the web browser. It’s not something the web browser has to do anything about. Where it used to be you had to manage asking for cookies within a web server software. It was an interplay between the browser and the web server.

What Google is now saying is, you know what, let’s just keep this at the browser level and one of the advantages to that at a privacy level is the web server is not doing any of the tracking. So, in other words, information about your identity is not being tracked right at the server level. You as the browser user, your acceptance of using Chrome is essentially a tacit agreement to say, you can track me because I’m using Chrome. What you are agreeing to with FLoC is basically saying, alright, I’m agreeing so that Chrome will learn my interests using a machine learning algorithm and will store that information about me inside my Chrome browser so that when I go to a website that is participating in FLoC basically what will happen is Chrome will then say, oh, you are a FLoC participating website. By the way, this person who is this browser that is browsing to you, by the way, they are interested in clothing. They bought some pants. You don’t have to know that. I’m not gonna tell you that but yes, this is a clothing buyer that you are talking about here and so if you want to shoot a banner ad to them that has something to do that, that’s your choice but we’re gonna let you know a number of things that we’ve learned about this user based off of their browsing history and based off of our machine learning algorithm.

And so, what essentially happens is these things that you are interested in, you as an individual are kind of bundled into a cohort of interested parties.

TCTim CallanPeople who meet that quality and you and I might be in a cohort for – like, I’m gonna use just real world examples, interested in technology. You and I would fall in the same cohort on that one but then there would be another thing where we are in different cohorts like resides in Canada. Where you’d be a yes and I’d be a no. Depending on what that let’s say advertiser was interested in, that’s how the cohorts would be divided up. So, if they wanted people interested in technology they’d get both of us but if they wanted people interested in technology who reside in Canada, they’d get you but not me. Is that right?

Jason SorokoYou got it, Tim. So, therefore, if you think about it, if you do the intersection – the huge number of Venn diagrams of those cohorts, my goodness, as a marketer you probably could do a pretty good job of targeted marketing based of at least a certain number of cohorts that you belong to.

TCTim CallanIf you are at FLoC and you’ve gotta decide what these cohorts are and how they are measured and how they are reported, this strikes me as being insanely complicated because am I gonna anticipate every possible quality of any human in the world and put a marker on them whether or not they have it? And maybe this is the wrong rathole for us to go down but I wonder was this nearly as precise I would say and granular as what people were doing otherwise or was it a necessary evil that we are gonna live with a certain amount of bluntness for the sake of being able to have anything at all?

Jason SorokoI think that question you are asking is part of the reason why there was ultimately a rejection of FLoC because when asked – and I’m not saying this happened – but this is the kind of thing that came up in conversations. If a browser user were looking up things such as mental health issues and they were looking up other things that were very, very sensitive – Google, would I have been put into a cohort saying, I have mental health issues market to me that way. The problem is the answers back from the industry were not clear about what are you gonna do about sensitive issues and so, therefore, there were a number of problems such as what are doing about sensitive cohorts? Not only is what you are doing very, very complex and we don’t know the level of aggregation that you are going down to but ultimately, could this be deanonymized? And the answer really kind of came back from the industry who was looking at this – this isn’t Google themselves saying it I don’t think – but the industry was basically saying, well, Google would have everything they needed to piece together you. Therefore, it’s private. Privacy. Private to all but Google.

Additionally, I think part of what Europe choked on as well is this became because of the fact that most of the industry basically said all of the other browsers are like, listen, we are not participating this. I think only Microsoft was the one that indicated that they might or they would. Europe basically said, look, if this is gonna be Google monoculture, forget it. This is just kind of unacceptable. That was FLoC. FLoC is dead. Long live FLoC. Because now there’s something else Google has come out with and believe it or not, Tim, it’s called Topics.

In other words, they are kind of a lot more clear on the level of aggregation. It was like, well, you are interested in fitness, you are interested in travel, we will limit it to five topics per browser. We will only share it for three weeks. There will be a total of 350 topics. We are going to ignore sensitive topics.

TCTim CallanThat’s incredibly blunt. If there’s 350 topics in total then my earlier example, which is interested in technology which was vastly oversimplified would probably be the level of complexity it was actually at. Cause you and I shouldn’t really be categorized as interested in technology. We should be categorized as interested in PKI. There’s no way that that’s making its way into a 350 topics. So, it gives you some amount of targeting. I can say, this person likes performance vehicles and I’m gonna advertise my performance vehicles but that is three orders of magnitude less granular and precise than what people enjoy today.

Jason SorokoTim, you are exactly right. Google has said that they speak in terms of revenue dollars. That’s the language in which they are speaking to people that they are trying to get involved, other marketers that they want to, who are going to spend their ad dollars with Google are saying, well, look, this level of granularity, I’m not going to be able to make the same amount of dollars I used to. Please I’m not putting words in people’s mouth, I’ve read different numbers – but Google I think is saying this topics idea is gonna be at the 90% to 85% level of where they were with the original cookies.

TCTim CallanThat strikes me as credible that for every marketer who is getting ridiculously detailed on how they are using this tracking information, there’s a whole lot of people who are painting with a broad brush and if I’m selling vodka or mid-priced sedans, I am advertising to a huge portion of the populous. The same people that you could advertise in ordinary primetime broadcast television and make that work and that’s the bulk of the dollars. Now it does hurt the people who are very scientific and very specific and, 85% ain’t 100% by any stretch of the imagination but if what you are facing is extermination of your business model, then 85% might look really good.

Jason SorokoYou got it, Tim. So, I want to leave it there. That’s FLoC and Topics. I think, Tim, it might be worth having one more podcast to specifically go through, alright, what about the non-Google world?

This podcast was really about the Google centric because they were kind of leading the charge with, alright, cookies are evil; therefore, what do we do about still doing some form of legitimate tracking. I just kind talk to the Google world as to where it is right now. There’s a whole other world outside of Google and that’s interesting to talk about as well.

Stay informed with expert insights

Subscribe to Root Causes for engaging discussions on PKI, digital security, and best practices for protecting your organization's critical assets. Don’t miss an episode!