by Geeek on 1/25/21, 1:50 PM with 292 comments
by Medicineguy on 1/25/21, 2:42 PM
EDIT: The official description [https://github.com/WICG/floc], does a better job in explaining the point. They try to cluster (="cohort") users interests and exchange that with the ad-service. This could maybe help to increase transparency and authority over your data as it's saved locally. But I don't see a way to limit the access to the users cohorts (they even say that themself, see link above). Everybody could access my interests - not just Google and other ad services. And of course, if you have 1000 categories and some meta information (region based on IP address etc.), you will be able to track down individual users with pretty good accuracy.
by kmeisthax on 1/25/21, 3:43 PM
The problem with targeted advertising isn't the use of cookies, the problem with targeted advertising is the targeting. It doesn't matter if you're using fancy machine-learning and on-device targeting to avoid technically collecting targeting data. People don't like seeing their web history funnel into their advertising.
by cookiengineer on 1/25/21, 3:30 PM
It means that Google has found out that among 1000 people, your browsing criteria with HTTP headers alone is unique enough to identify you with 95% accuracy, which is actually even more frightening.
by dessant on 1/25/21, 2:30 PM
by holtalanm on 1/25/21, 2:42 PM
Sure, cookies are used for tracking, but they are also used for authentication, which is something that nearly every webapp needs to do.
I just think that, due to articles like this, cookies end up being viewed as nothing but bad, when they are an important tool for the web when used properly.
More on-topic of the article:
this doesn't look like it really changes anything, to me. Like, so instead of cookies being used to track your data, they use a _browser extension_?? that is potentially even _more_ invasive. Sure, if it does what they say it will do, it kind of obfuscates your personal data. Really, what people want is just....less ads. Less targetted ads. This doesn't achieve that.
by PedroBatista on 1/25/21, 2:35 PM
Also there's no "privacy-friendly" tracking technology, it's an oxymoron an slick marketing/corporate strategy ( that works ).
by topspin on 1/25/21, 3:32 PM
"A flock name would essentially be a behavioral credit score: a tattoo on your digital forehead that gives a succinct summary of who you are, what you like, where you go, what you buy, and with whom you associate."
https://www.eff.org/deeplinks/2019/08/dont-play-googles-priv...
BTW, Chrome users have been part of this system for nearly a year now.
by nousermane on 1/25/21, 9:35 PM
I understand how first-party cookies are useful - you take a stateless protocol (HTTP) and make it aware of "sessions". And those in turn are a nifty block to build upon - login/authentication, "shopping cart", whatever...
But having one website to be able to save state that is only accessible to a chosen different site - what's the use for that?
by flerchin on 1/25/21, 3:30 PM
by zffr on 1/25/21, 5:12 PM
This is only "privacy friendly" because Google limits the accuracy of the fingerprint provided to advertisers by bucketing users into cohort groups. These groups are supposed to be large enough to prevent advertisers to identify individual users.
Google would still retain the ability to uniquely identify individual users.
by ogre_codes on 1/25/21, 6:23 PM
The other big thing that concerns me about this is how it still allows for some of the worst abuses. They are still going to possess entirely too much information about people and will continue to sell advertising that takes advantages of that information.
by alexfromapex on 1/25/21, 2:45 PM
by downandout on 1/25/21, 3:40 PM
At the time I was laughed out of the room. Turns out I was just 24 years too early.
by ocdtrekkie on 1/25/21, 3:10 PM
Tracking a group of 1,000 people to cater bad political ads isn't meaningfully better than targeting 1,000 individuals with bad political ads.
Targeted advertising needs to be treated like unfair gambling practices. Banned across the board, and the industry that remains needs to be heavily regulated and forced to be completely transparent about the process.
by masswerk on 1/25/21, 5:51 PM
Dear advertisers, I do not want to be herded in a bubble (designed by you or anyone else), I actually like to know the world around me.
(And this is even more valid for the things I'm not that familiar with anyway. How would I learn about those segments of reality, if not from your adverisment that you would prefer to rather not show me?)
by fixmycode on 1/25/21, 2:46 PM
Advertisers and trackers have been doing the same thing this thing is supposed to do for years. And where will they implement it? the only way would be at the application level, so every browser now also has to implement internal tracking services to aggregate all the data in their flocs, to then come back to the user to spice up their request? come on...
I'll keep supporting efforts to make the Internet a more privacy focused place. Advertisers have been buying TV ads for decades and I my TV hasn't asked me what I want to share with it, yet.
by dilap on 1/25/21, 2:31 PM
No but seriously, does being in a group of "thousands" of people really preserve privacy particularly well? It seems quite likely that with groups that small, membership itself could be considered privacy-compromising, e.g., a group of people that all have some medical condition.
At the most fundamental level, I feel like if you know which advertisments are targetted to me, and those advertisements are well-targeted, then my privacy has been invaded.
It seems to me there is a fundamental conflict between good targetted ads and protection of privacy.
by lxe on 1/25/21, 6:44 PM
by vorticalbox on 1/25/21, 6:14 PM
by throwaway189262 on 1/26/21, 5:54 AM
Invasive targeting is only 20 years old, a blink in the history of advertising. If it was gone tomorrow these companies would just go back to targeting based on the ad placement rather than unique person viewing it. What we have now is the dystopian sci fi movie where ads shift as different people look at them.
If you don't think it's dystopian, consider that every ad your coworkers see when you're sharing your screen is based on the best targeting data advertisers can find. Your screen is disclosing your interests, wealth, medical history, kinks, etc to anyone looking at it. It's fucked up.
by baybal2 on 1/25/21, 3:01 PM
by qwerty456127 on 1/25/21, 3:35 PM
by yalogin on 1/25/21, 3:19 PM
They are using privacy preserving techniques, and even if we assume they are doing it well, it just means that we will never get rid of the profiling and paying to get privacy will not happen with google services
by WhyNotHugo on 1/26/21, 3:36 PM
There's few websites that break without them (e.g.: logging into Atlassian), and that's mostly due to bad design (given that every other login flow out there works fine).
Their main use has been to track people, hence, we don't really need them at all.
by throw14082020 on 1/25/21, 7:26 PM
It's worse than that. Google is an advertising company that makes a browser (63.38% of browsers globally) and mobile operating system (72.48% of phones globally) to vertically integrate, controlling your privacy choices. They're also trying their hand at PC's (ChromeOS, 1.72% globally). They invent technology across the stack, providing software for free or paid, and open sourcing some to commoditise the technology and to starve competition. I'd be interested to see how many people use Gmail.
https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/os-market-share/mobile/worldwide https://gs.statcounter.com/os-market-share/desktop/worldwide...
by lemax on 1/25/21, 6:04 PM
"Cookies are considered third-party data, or user data that's collected indirectly from users via browsers or websites."
This statement seriously requires qualification. This is exactly what contributes to unreasonable regulation and confused users.
by dillondoyle on 1/25/21, 11:48 PM
Attributions is a big pain too.
Without those two things this simply makes google more valuable while killing everyone else who doesn't have their own browser which tracks everything from your login, analytics on basically every website, and more.
by mfer on 1/25/21, 3:21 PM
The proposed system deals with large groups and machine learning. It requires a browser ad on or changes to the browser. This is not approachable for startups, small businesses, or those who are independent. It's targeted at Google and further helps solidify their position.
As people want to cut Google off from constantly monitoring them they are looking for ways to work around being cut off to keep the data flowing. Branding and marketing their work to make people want it.
[1] https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut...
by jrochkind1 on 1/25/21, 6:03 PM
anatomized? Is that a typo for anonymized? Or does this mean something?
by dang on 1/25/21, 8:30 PM
by gnud on 1/25/21, 3:19 PM
Instead of the user disabling third-party cookies, every single page author would have to set a new HTTP header to have their page excluded from the machine learning.
It also looks like a massive GDPR pitfall. Say you track conversions to a campaign, and track what "cohorts" a user entered your sales pipeline through. The moment you connect this data to the customer, it's personal data IMHO. If you operate in Europe, the user should be able to retrieve/delete the data, and request it changed if they say it's wrong.
by etxm on 1/25/21, 3:41 PM
by foolinaround on 1/25/21, 9:03 PM
by cblconfederate on 1/25/21, 5:06 PM
by tpoacher on 1/25/21, 4:02 PM
by devops000 on 1/25/21, 6:45 PM
by m_eiman on 1/25/21, 3:07 PM
I get full access to everything you do online, and get to do anything I want with the information. Perhaps I'll use it to maybe target ads slightly better in some cases, and put myself into every value chain you're involved with so I can get a cut at every step.
Oh, and I'll do my best to move all computing online, so that 'everything you do online' equals 'everything you do with a computer'.
In exchange you'll get a web browser that is at times more performant than the others. Hell, I'll even throw in a free email account (where I can gather all the best bits of info)!
It's a pretty good deal, don't you think?"
by foxhop on 1/25/21, 6:54 PM
by godelmachine on 1/25/21, 6:05 PM
Whenever I visit any website, courtesy the GDPR laws, we are asked to request the terms and cookies. I make it a point to disable all cookies (barring the strictly necessary ones), partners and also the "Legitimate Interest" section, where I click "Object all", and then click "Save and exit".
However, on many websites I don't see any option to "reject" or "object" to cookies, partners, vendors and especially legitimate interest. Particularly concerned about Legitimate Interest since the number of vendors there is humongous.A good example of a site where we cannot choose would be the BBC[1]. We get an option only to read their terms and conditions but no option to reject and object.
1) Can anyone please guide how to reject to cookies on such sites where they don't have a reject option present?
Also, in my iOS, in Safari settings, I have chosen "Block all cookies" to yes.
2) How far will blocking all cookies safeguard me from unscrupulous cookies? If my blocking all cookies is enabled in safari settings and suppose I visit some malicious site and accept their cookies, would the owners of malicious site be able to do anything sinister or adversarial to my privacy and integrity? Will the be able to breach my security?
Ref. → [1]https://www.bbc.co.uk/
by nelgaard on 1/25/21, 5:24 PM
Now Google want to offload Machine Learning to our browser. That will be bad for battery life, electricity bills, and the environment.
On the other hand I use free software. So I can make a version of their extension that just claims that I am obsessed with Ironing. That will also make it easier for the Ad-blocker to do its filtering.
by bigsteve90 on 1/25/21, 5:52 PM
by tomaszs on 1/25/21, 5:50 PM
It is not a replacement. It is a proposal how to replace a free, standardized and open world wide web feature with a commercial service.
by st3ve445678 on 1/25/21, 4:05 PM
by st3ve445678 on 1/25/21, 4:06 PM
by danShumway on 1/25/21, 6:54 PM
Say we had an Open, standardized, human-readable list of categories/groups that people could opt into (rather than a bunch of on-the-fly groupings determined by an AI). We could give users the ability to choose 0-X of those categories that they want to associate with. We could even let them choose on a site-by-site basis, so they could decide how ads would be targeted (or if they would be targeted at all) on parts of the web.
We could build UIs that helped them with that. We could have easy ways to opt into or out of categories. We could allow them to turn on category suggestions, so with their permission if a user visited a site about a specific kind of product, we could show a one-click option in the browser to add themselves to an associated category and see ads for similar products.
We could allow them to group sites together and say things like, "I want news sites that I visit to know that I'm looking to buy a specific brand of car, but I don't want any of the car dealership sites that I'm looking at to know what brand I want."
For users that don't want that level of detail, we could still have a 'smart' system that consumers could run (clientside) that looked at the websites they visited, or even more personal data, and auto-placed them in categories without them needing to think about the system at all. They'd just need to select an option to let the browser handle all of their categories for them.
But importantly, all of this would be based on consent. And instead of offering users a single choice to opt out, they would have an entire spectrum of choices that allowed them to decide how they presented themselves online, what specific data they shared, and who they shared it with.
If users genuinely benefit from targeted ads, then they'll opt into the system and pick categories that are relevant to them and send them to sites. If they think Google's data collection is accurate, then they'll turn on the smart system in Chrome that locally categorizes them. But at any point, for any site, they could choose to turn off the data entirely, or to add themselves to a specific category, or to remove themselves from a specific category. In human-understandable terms, they would know exactly what data they were transmitting to websites.
----
For all that Google says they're working on data privacy, very few of their proposals, even their good proposals, approach privacy from an angle of giving users more control over their identities. Google is still stuck in a world where they think of data collection as something that has to happen without the users knowledge, without the user's ability to easily inspect what's going on, without the user's ability to form multiple identities or even to just opt-into the system at all.
What I want is control over my data. And what Google (and companies like them) keep on saying is, "we'll be somewhat more responsible with your data, but only if we keep control of it."
And this represents a general attitude that comes up in so many modern tech products, from Youtube, to social feeds, to modern UI design, to device security. These companies are like a controlling, overbearing parent. People want agency over their ads/recommendations/feeds/etc, but the companies think the problem is that they're just not good enough at controlling all of that for us. It's a way of thinking about UX/product/process that's divorced from user consent and agency as an ideals that we should strive towards.
by coldtea on 1/25/21, 3:23 PM
by interestica on 1/25/21, 3:08 PM
What is the public understanding/perception of cookies? The past couple of years since the implementation of the GDPR has probably been the biggest and weirdest public education campaign (done entirely through brief pseudo-consent popups).
by chopin24 on 1/25/21, 5:17 PM
Don't fall for it. Break up with Google. They are abusive.
by frongpik on 1/25/21, 7:16 PM
by acvny on 1/25/21, 3:22 PM
by up2isomorphism on 1/25/21, 3:27 PM
by chovybizzass on 1/25/21, 3:10 PM
by craftinator on 1/25/21, 2:39 PM