Google’s FLoC Is a Terrible Idea

> That framing is based on a false premise that we have to choose between “old tracking” and “new tracking.” It’s not either-or. Instead of re-inventing the tracking wheel, we should imagine a better world without the myriad problems of targeted ads.

I don't want to be tracked. I never have wanted to be tracked. I shouldn't have to aggressively opt-out of tracking; it should be a service one must opt-in to receive. And it's not something we can trust industry to correct properly. This is precisely the role that privacy-protecting legislation should be undertaking.

Stop spying on us, please.

edit: apparently credit bureaus are exempt from CCPA

I hate the use of new/uncommon acronyms/initialisms without immediate clarification, a form of clickbait. So many paragraphs down to see what it's called. Expected more from EFF.

I'm sorry but Google has no any competition. If you don't want to limit oneself to, say, Facebook users, you pretty much have to buy Google's ad services.

Privacy is a freedom which has many parasites (state and private entity driven) attacking it and I welcome changes to perception, regulation, and law which places safeguards around it.

Let's go back to banner ads that are "targeted" based on what type of website you're looking at, rather than based on vacuuming up as much private info as possible about users.

Being able to do content recommendation for fresh visitors without any tracking effort of your own would be pretty cool. It will probably come with a dialog, so users will likely opt out often for ads or on page load, but not if they just clicked "show me movie recommendations" in your app.

I'm sometimes confused what is covered under this term and I'd kinda like to know where the line here is drawn. What exactly are we talking about here?

Even the mighty Apple still tracks analytics data and separates that into a separate switch from the ones limiting non-Apple tracking.

Maybe just use Tor.

> Stop spying on us, please.

It was probably a mistake to equivocate the kind of data gathering that ad-tech companies do with the kind that oppressive governments do.

They've purposely done nothing about it. They've even bragged on their blog and in their annual statement that they've done nothing about it :(

Please support Web Monetization.

It also seems like FLoC could make it more politically viable to crack down non-consensual tracking. Publishers wouldn't be able to say "we have no choice but to deal with this [third party tracker] scum" but could continue to gate content by subscription or (consensual) FLoC as necessary for their business model.

Pushing publishing and advertising towards proactive consent about targeting puts them into a dialog with the market about what's ok, instead of letting them hide behind a bunch of shifting tracker businesses.

The best default is not to track at all.

https://webmonetization.org/

It barely exists so far and is only implemented by a single browser that I'd never heard of (Puma). Hardly fair to demand if people are using it yet.

> how do you propose things work?

We go back to advertising without tracking.

Ban advertising targeted by tracking, and you remove the incentive to track in the first place.

That it would independently identify you to Site A and Site B as a person in a particular cohort.

That alone means direct payment will never replace ads.

Most people are not reading The Financial Times or Bloomberg, they are reading rags like The Sun and Facebook gossip. I would love for that content to go away, but really, ad supported models work great for that demographic.

The simplest definition of tracking I can come up with is "collect data about me that can (and often, is) used to build a profile of me and my behavior". The NGinx log could or could not be tracking, depending on whether you use it to diagnose issues ("we should optimize this picture, it's loading too slow for too many people") or to profile me ("ID 12345 uses a 56K modem, let's sell him a new one"). But no perfect definition exists because everyone has different thresholds of what they are okay with.

Sadly without this tracking, the engines of the ad economy come to a stop. We have royally ducked up the ecosystem to the point where there's no fixing it. Ever. Even laws such as GDRP won't cut it, Facebook & co. are happy to flout the rules since paying the fines is worth the cost of breaking the rules.

In the case of Google ad money vs Content marketing economy, it really is a case where the chicken came before the egg.

X-Client-Data cannot be disabled (it's hard-coded) and ships telemetry to DoubleClick without disclosure.

Google Chrome is the DoubleClick browser. Why else would DoubleClick be hardcoded into the source as a place to send telemetry?

This seems backwards to me: the alternative to "targeted ads" are "untargeted ads", aka Spam. Who would rather have spam than targeted ads. Sure, spam might be easier to ignore, but it's also not effective from the company's perspective: showing the ad only to people who might be willing to spend money seems like a good thing to me. It's certainly economical. Which is why I feel like targeted ads are not something we can get rid of.

I would, because the targeting creeps me out entirely. Instagram were so good at it that I deleted the app. In the old days, you stuck luxury advertising in rich neighborhoods and used demographics for broadcast and other media. That'll do.

To me this seems like a win? It allows you as a person to control how your ad profile is built (and if it's sent at all) and doesn't send your data to servers anymore?

(Please correct me if I misunderstood the technology.)

I bet if a random open source project of the same kind were released, it would probably be pointed at as a reason why Google is evil ('see there are good alternatives!'). But because Google is doing it, people are (rightly) wary and (definitely not rightly) calling it evil without doing research.

If I was to receive an unwanted phone call from a travel agency while I am browsing plane tickets on the net, that would be creepy and annoying to me: I prefer to make thoughtful decisions by myself, thank you.

I realize not everyone thinks the same way. But in my opinion, advertisement has a severe net negative impact on our society, and would like to get rid of it altogether.

I already pay for targeted advertisement that comes in the news articles I read, no need to force-feed me.

I've seen that fun video (in French [1]) where a person asks various advertisers their opinion on the role of advertising in the society, then asks them about an "electric knife" ad that was then running. The cognitive dissonance that follows is hilarious.

[1] (1990, no subs): https://www.dailymotion.com/video/x869qr

This way I feel there will be less legislative and lobbying pushback while still achieving major privacy wins.

There are so many hobbies and interests where the rich, meaty information people can benefit from is found on old-school blogs and websites that their owners have maintained without expecting to make much money at all, besides the occasional click-through to an Amazon referral link.

However, those blogs and websites have now become hard to find because they have been pushed down in search results due to Google's changed algorithms and ad-supported websites heavy on SEO – sometimes those ad-supported websites are literal copies of earlier advertising-free blogs where a developing-world freelancer was paid to rewrite all the content just enough to avoid a DMCA takedown. Also, the advertising-supported world of mobile social-media apps has made people today less likely to step outside of their walled gardens and consider small third-party independent websites.

So, to a degree, things would work better in certain cases if targeted-advertising-supported websites disappeared; their decline would reveal a whole world of useful free content that was there the whole time.

But, what about the people who don't use Chrome? I would hope that most people who know what EFF is already don't. Firefox will surely come with a way to disable it, or you'll configure it to always send "my little pony" or something like this.

In the end, this seems to really be about Google (with a browser) competing against Facebook and other ad providers (who don't have a browser).

I wonder if websites are going to block you out if you don't have this enabled. Like they do with adblockers.

You appear to understand the situation, so I'm not sure why you bring this up as a problem. If a business is utterly incapable of operating without resorting to an unethical business model, then the solution is to shut down the business rather than abandon ethics.

It’s interesting that influencer promotion is already out-of-band from general internet advertising. They are paid directly to promote products to people who have proactively followed/engaged with the influencer already.

I have no expertise in this, but I don't see why anyone would pay for banner ads for more than pennies on the dollar if tracking is an option.

Wouldn't removing tracking change the economics?

Also, this specific situation seems like a good candidate for regulation, which removes the need for businesses to be ethical of their own accord.

Don't get me wrong, I'm not keen on getting tracked, either. But I can totally see that from a company's perspective, if you can make sure that only people who are interested in your product actually see the ad, that's better. You don't annoy people who aren't interested (not everyone in a rich neighborhood cares about a BMW ad, some already have a Tesla) and you increase effectiveness.

If most browsers aggressively blocked ads then more sites would test to see if blocking ads breaks the site.

>You appear to understand the situation, so I'm not sure why you bring this up as a problem.

It is a problem, just not one that I think is more important than the benefits it comes with.

>If a business is utterly incapable of operating without resorting to an unethical business model, then the solution is to shut down the business rather than abandon ethics.

I agree, but weigh the impact of other industries that rely on that business as well. It would be a very unpopular move, and given the lobbying in the US, it's unlikely to pass here. And if it passes in the EU that might have other negative impacts in partitioning the web even more. It's a balancing act, and the solution is not as clear cut as "ban tracking in advertising". Knowing lawmakers, do you think this would differentiate between a paid service keeping a user logged in and, say, google ads? I bet the paid service would have an option in the subscription menu to upgrade, is that tracking in advertising? Probably not to 99% of sane people, but can lawmakers (or anyone for that matter) express what they want out of such a law in a concise enough manner to not be misconstrued in a major way?

On the other hand, it can be that people detected the change on their results metrics, and decided to increase their spending because of the change. I really don't know how to differentiate this scenario from a normal increase on internet advertising that should naturally happen at the earlier days of a fast growing web. I don't think even Google (that has all the numbers) can tell them apart either.

Businesses providing paid services on the internet will still want to get noticed before those free smaller websites and will do whatever they can to appear first in relevant search engines results regardless. The reasons to get people on their sites would shift from showing them ads to selling them a paid product, but reeling people in is still going to be the objective.

There are many great arguments against tracking, but IMHO, SEO isn't one.

Yes.

> Sadly without this tracking, the engines of the ad economy come to a stop.

One more reason to eliminate tracking.

Youtube did not even think of charging premium so many years after launching as a free service.

Do you think they would have been that successfully were it not for the user base aka free eye-balls?

> There is nothing that says that we must be forced to tolerate ads in exchange for the internet

While true but this is the way the game and the field has been setup. Same thing that explains why you see ads on even on paid devices. Why be content with 5$, when you know you can shake 6$ from a customer?

I am for privacy. Believe me. But this battle is not winnable when you make up 5% of the sober group and the rest are happy and drunk in love with Clubhouse or whatever new social media drug that is the rage.

Without bug problems. Migrating away from Gmail would allow me to de it indefinitely.

Why should I have to jump through hoops and disguise myself? Why can't Google et.al. just respect the basic human right to privacy?

The way they've worked for the last 400 years. The ads are tailored to the content, not the individual reader.

At least, I have not figured out how to use it without enabling 3rd party cookies.

I do, and the amount of money webmasters made back then was much better.

Some of the sites I ran got $10-$15 CPM. Ad campaigns targeted to my sites' niches could be up to $25 CPM.

Ever since Google introduced AdWords and its race to the bottom, content-heavy web sites are lucky to get 10¢ CPM.

But since the new kids on the block have never experienced a profitable web without tracking, they don't know any better and think it didn't exist.

Cambridge Analytica didn't want to target a person. They wanted to track people. Flocks of people.

I have yet to play with it though, mostly because I do the vast majority of my browsing on a desktop.

https://chrome.google.com/webstore/detail/coil/locbifcbeldmn...

I agree that their web presentation leaves a lot to be desired.

That's what happens when no one trusts you. It's human nature, and logical arguments aren't going to change that.

If anything, it's a good thing for society if Google burns despite trying to do something genuinely good (not that FLoC is good), because it shows others that there are real consequences to betraying the trust of your customers.

We lose one untrustworthy company today, and gain many trustworthy companies in the future. That's a net positive for society!

That'd help.

Will look into this

These constant references to "the web" when discussing certain companies is annoying. The www does not belong to any incorporated middleman. I do not care how much traffic they are curently in control of. The www is a medium not a small, privileged group of messengers. How is this company even contemplating something like this. Answer: Because a majority of users choose a browser controlled by an advertising company. WTF.

This company will no doubt exert influence/control over the "standards" process and next thing we know, every developer working on a browser will feel obligated to "implement FLoC". Maybe this is an either-or question. Who is the www for: users or advertisers. The middleman needs both. Advertisers need the middleman and users. But users do not need advertisers. And, truly, they do not need the middleman. Users are creating the content. The middleman just sits in between, spying on everything.

Maybe there needs to be more than one www. Maybe there needs to be a non-commercial www for smart people.

> Well of course $company gives $oppressive_regime access to data they collect on their users. They have to comply with local laws!

Even with some existing laws, the profits are enough that they are willing to flagrantly violate these laws and simply pay meager fines.

It's also unlikely that we will ever get significant legislation to protect us from this either, because all these tech profits allow big tech to buy our government, because policy is heavily swayed by corporations.

Even with some existing laws, the profits are enough that they are willing to flagrantly violate these laws and simply pay meager fines.

It's also unlikely that we will ever get significant legislation to protect us from this either, because all these tech profits allow big tech to buy our government, because policy is heavily swayed by corporations.

If that's a desired future we should be honest about it, but it's a future without as many independent journalists who can't afford a team to sell their content, for example.

It's not just Youtube/Vimeo; for instance, Flickr was a premium paid service around the time that Facebook launched, and it wasn't under water, either.

These "freemium" services were able to act as _hideously unprofitable_ loss leaders for the large advertisement firms, and so take down the non-advertisement-funded competition.

It was predatorial monopolistic practices that gave us the current web.

Consider, for example, that it's uncommon to expand military program acronyms because their meaning is often less useful than saying "it's just a word."

But if FLoC requires the browser to do the tracking itself, would it be possible to fork Chromium, disable tracking, and have FLoC return fake or random data instead?

Paid content, product placement, YouTubers pitching Audible book related to video.

Ironically, it seems that FLoC makes user tracking easier, not harder.

I see no upside in FLoC for me as a user, and plenty of potential downside. I'm glad I use Firefox.

Re: obnoxiously bad service, frankly I think sites should run however they want as long as they are truly transparent about it (not just a buried EULA). I prefer open sites, but nobody should be forced into service just because I have an IP.

If you want you can use duckduckgo with ads disabled in settings, visit HN and wikipedia and stackoverflow (although they have the #hireme thing), pay $10/month for youtube and spotify premium so you don't see ads there, etc. And then use ghostery to disable third-party cookies and things of that nature. What more do you want the industry to do?

That would be an actual win. Not showing me ads at all would be an additional icing on the cake. I even don't want to see ads about things I'm interested in. Just nothing.

The responsibility isn't on the user to either consent to tracking or to come up with an alternative business model that allows people to monetize things. The responsibility for monetizing things falls on the people who want to do the monetizing. They have to figure out a business model that works and that users consent to.

[0] https://twitter.com/__jakub_g/status/1365400306767581185

Google is the farmer, websites are the dogs, and we are the livestock.

Some might say, in a fit of charitability, "but it's a bird reference", citing prior work. To which I say no; don't convince yourself for one moment that Google's army of PhDs didn't notice the sheep allusion. They are not that dumb. But they are this arrogant.

- hidden and confusingly worded opt-out dialogues - different cookie banners on ever site - dark patterns such as requiring far more clicks to opt-out than in - opt-out dialogues with lots of technical wording - sites that just don't provide opt-out options - sites that purposely degrade the ux if you opt-out

All these mean that the average "not technical" user (such as my parents) cannot reliability opt-out.

We ought to have opt-in be the default.

The actions of Cambridge Analytica-type groups are an important issue, but I don’t think FLoC is trying to solve that.

> This is precisely the role that privacy-protecting legislation should be undertaking.

Say, for example, an payday lender buys a banner on example.com/r/povertyfinance – could that not be construed as predatory in the same way as building a poverty FLoC based on browsing history?

Wasn't this already the idea behind the DNT (Do Not Track) header?

> "Whether the browser sends a real FLoC or a random one is user controllable."

FLoC stuff is client side. You can send nil FLoC IDs. You can randomize them on every request. You can swap them with your friends. Whatever.

Vanilla Chrome might not let you (my money would be on an off-switch but not anything fun) but that's hardly going to be a blocker.

(googler but works on something completely unrelated)

The only one of those I ever interact with on purpose is Youtube, only via youtube-dl, and only because other people refuse to use reasonable means of distributing video content (eg bittorrent).

No I meant it's easy to just not send those cookies back.

At the very least it is not harder than letting the browser profile you and choose what it should and shouldn't share with advertisers.

But, the reality we need to accept and work from is that with vested corporate interests aligning so well with intrusive governmental and military interests, nothing is going to change.

Don't hold your breath for privacy protection legislation.

If we rely on old pre digital tactics with no targeting, it's like going back 50 years and using a machine gun in the dark.

Combine the Google cookie depreciation, Apple's recent changes in 14.5 and the general mood around 3rd party data sharing which makes effective outbound lead gen more difficult. I think we are witnessing death by a thousand cuts in terms of increasing the barriers to entry for smaller business.

Beside Séguéla who dares asserting that advertising makes people more intelligent and is a public service for democracy, the angry one is now congressman (for the right-wing party of course, 20 years of mandate and counting) :-)

You're dreaming. You'll also expose to Google IP and website URL via Referer in requests for fonts and jsquery bundles, in Google cookies masqueraded as first-party via CNAME tricks, in Chrome identifier and so on. Chances are you're using Google DNS 8.8.8.8 too.

I wont trust a company to disable the data source for their main revenue. Just don't use any of Google software and services. Android included, sadly.

Good. The sooner that happens, the sooner people start building alternatives out of necessity.

One place this shows up is a frequently-expressed sentiment that the internet is a less magical, less weird, and more corporate place than it was 10-20 years ago. Part of this may be because SEO has diluted the voices of individual creators. But part of it is also because way more average, everyday, tech-unsavvy people are on the internet now.

Another example is the periodic highlighting of somewhat garish HTML-based websites. I like these too! My own personal website falls in this category! But as far as I know, the generic internet user likes the generic slick-graphics-and-whitespace style, and so go the websites that want to attract them.

More relevant to the topic at hand, many comments in this thread argue that targeted ads are unnecessary for a functional internet, since the internet of 20 years ago seemed to work just fine without targeted ads. But, again, it's less clear to me that general internet users -- that is, mostly people who never experienced the internet of 20 years ago -- have the same preference.

It's funny, because I'm to a large extent on HN's side on this one. But my enthusiasm is tempered by my sneaking suspicion that the other side is a lot bigger, and my side is actually powered by more elitism and nostalgia than I thought.

https://adnauseam.io/

I tried this, but after some time your IP just gets flagged for click fraud.

It's interesting because you won't see ads anymore, but you also won't be able to pollute more datasets.

Overall it’s been a “meh”

People hate ads, but the alternative is so much worse.

> A browser with FLoC enabled would collect information about its user’s browsing habits, then use that information to assign its user to a “cohort” or group. Users with similar browsing habits—for some definition of “similar”—would be grouped into the same cohort. Each user’s browser will share a cohort ID, indicating which group they belong to, with websites and advertisers. According to the proposal, at least a few thousand users should belong to each cohort (though that’s not a guarantee).

> If that sounds dense, think of it this way: your FLoC ID will be like a succinct summary of your recent activity on the Web.

> Google’s proof of concept used the domains of the sites that each user visited as the basis for grouping people together. It then used an algorithm called SimHash to create the groups. SimHash[0] can be computed locally on each user’s machine, so there’s no need for a central server to collect behavioral data. However, a central administrator could have a role in enforcing privacy guarantees. In order to prevent any cohort from being too small (i.e. too identifying), Google proposes that a central actor could count the number of users assigned each cohort. If any are too small, they can be combined with other, similar cohorts until enough users are represented in each one.

[0] https://en.wikipedia.org/wiki/SimHash

> In computer science, SimHash is a technique for quickly estimating how similar two sets are. The algorithm is used by the Google Crawler to find near duplicate pages. It was created by Moses Charikar.

So...in addition, Google can use all the users' CPUs instead of their own.

It's okay to say that you personally don't believe in a right to privacy or don't believe that it's an issue to vacuum up the data of own's own citizens, etc, but what I don't understand is saying that other people are paranoid elitists if they hold the view that they think it's wrong to spy on citizens. It seems incredibly uncharitable.

Furthermore your comment reads like you're addressing an argument the GP never made. What's the relevance of this section:

> Does the average voter care enough to vote one way or other for it? I would suspect not.. they have bigger problems to deal with and they seem ok with government knowing something about them.

The GP never insinuated that the average voter cares about such things (indeed by mentioning that the HN userbase does that implies that the general population does not otherwise it would not be worth mentioning)

If you say shit like this unironically, you can't ever accuse someone else of having a "warped perspective".

In other words, you can track the normies all you want as long as your app doesn't do something "creepy" that reveals how much it really does know about them

It strikes me that, as you say, even "normies" don't like tracking.

I think the problem is when sleek services obfuscate how they work and users don't understand what happens.

The average "normie" doesn't realise that, by default, a cloud service provider sees all their data in the clear. They assume it's somehow private, but haven't seen behind the veil to understand how services work. And the increasing complexity of the tech stack means understanding it becomes harder and harder every day that goes by.

Oh Christ I hope not. Any replacement for the current setup has to get rid of that blight. Should be a single opt in/out decision when you start using the browser.

Unless this ends up as some closed source DRM style blob (in which case we might as well kiss goodbye to the open web that can be accessed by standards compliant browsers), I can't see how anyone can stop this.

On the other hand, given the widespread use of ad blockers and tracking block lists, perhaps this simply isn't a design goal - just accept that 20% of techies will block it anyway and return 0 or simply not run a browser that supports it, and focus on the majority who think Chrome is synonymous with "the internet" and run it without add-ons.

Two for the price of one? No tracking, no ads? Sign me up.

Textbook illegal, but major high-street global brand names do this, and there's no easy way to make them stop - regulators just can't move quickly enough or show enough teeth. We would need thousands of convictions per day to even scratch the surface - I'd estimate at least 9 in 10 sites I visit breaks the law in one way or another around their cookies and consent prompt.

Perhaps we need a way to commercialise and earn revenue from identifying the sites breaking the laws as you describe? The law demands "opt in" for Europe, yet everyone tries to skirt this and use dark patterns like forgetting the cookie settings of anyone who dares not accept everything. Many of these dark pattern techniques are actually illegal.

If you could commercialise each of these findings, we would have everyone compliant in a matter of weeks. SEC style whistleblower model (albeit on a smaller scale)?

I'm not sure that's a reasonable assumption.

Many sites actively break their own user experience and hide their content as best as possible for users with adblockers. It's also understandable, because these sites don't want users but adviews and adclicks. They would rather intensify their efforts to force the user to turn on adds than make sure the website works without generating revenue.

I also don't think we would see much more subscription or pay once models, because they are just not viable for many websites. These websites would simply cease to exist and we end up with less diverse available information on the internet.

They're stuck in the mid 2000s, in all the best ways.

Technologically they're ancient (usually HTML tables), the amount of users grow slowly (if at all) and are limited to maximum a few thousand (usually just a few hundred actively using the forums though). Users won't risk their treasured accounts by acting badly, and since very few join private trackers for the forums you get a wide specter of different people participating, in their different ways.

Some users are silly and post memes, others post long and thought through replies, often in the same thread. Everything is discussed, from politics to the latest movie. There's no "karma" to earn.

After a while you start recognizing the same people. I'm really glad I still have access to it, otherwise I would feel kinda lost in today's internet, where you need to find a new site/subreddit for every topic. No tracking either for that matter.

If you've every made the buying decisions for an organization, you've been targeted individually before. Through digital economies of scale, it's less expensive to do with consumers now and allows for publishers to get paid to generate content at the same time.

Google, Youtube, Facebook, Twitter, Reddit were all magical. Digg was also magical but it died out when tried to scoop returns in inelegant way.

Rich people did not become rich and don't stay rich by giving money away. When Youtube was advertiser unfriendly it was magical but it was also burning a billion $ a quarter, the same goes for all those "evil" companies. It all was a scheme to create and grow a market up until they run out of people. When they run out of people, it's time to make the money back out of it. Hmm, maybe I should remove the " " of "evil" but I am not sure. What was the alternative? The French "internet" maybe, but it died if in the face of capital fuelled frenzy of the American internet.

BTW, that's why I am an Apple fanboy, I like the idea of directly paid services. The relationship is simpler.

It sounds pseudo-englightening without any substance. Ok, you've observed this meta aspect of HN. So, what?

Do you remember how f'in hard it was to find stuff online back when a) there was less stuff online and b) you had to use a metasearch engine like Metafind or Dogpile to aggregate the terrible results from multiple engines into something remotely useful? Remember surfing because actively searching fog data was next to impossible? Remember 300ms-per-hop latency and being impressed by 6KB/sec downloads, taking a week to download a Linux distro and rarely upgrading your packages because it took forever? Remember that day in 1998 when the world changed because some Stanford project called 'Google' appeared? I do. I won't go back. I have a few PDP-8s and a PDP-11/03 and various 8-bit micros and some Teletypes and 80s-90s UNIX systems and Winboxen if I want to go back to the old days. They're not dead, they're still here and they still do exactly what little they did in the past. I don't love how dystopian tech has become, but it's a ton more useful to me and most other people than it was 10, 20, 30 years ago.

Because "better [for advertisers]" is a euphemism for "worse for advertisees".

> Why stop there?

Because it's deeply unethical.

On the flip side, if opting out of FLoC is a single switch that turns off all third party tracking, then it makes opting out a breeze (compared with ad blockers now).

The hatred of targeted advertising comes more out of what it systemically enables, and incentivizes. The mapping and realtime exploitation of UUID like-metadata collected through ubiquitous surveillance. Dossiers were the things of novels and intelligence agencies, nowadays marketers have sold people (even those like you) that somehow this gratuitous invasion of your privacy is normal, desirable, acceptable, and even more insidiously, always was.

Nothing could be further from the truth. You now have multiple dossier's that will follow you around the world. Some governments will deny you entry unless you surrender access to any social media accounts.

None of what is normal about the web today was ever at all what made the early web magical. You weren't monetized. You were reaching out and leaving something of yourself out there, and finding that there were like minded individuals to you the world over!

You also had the cloak of anonymity. Anything on the net was a non-issue. Controversial viewpoint? Whatever. Really need some insight on XYZ? Trawl the BBS's or a chat room.

Nothing was as centralized as it is now. People didn't do daft things like trying to put things you shouldn't on a fundamentally insecure network. People weren't so dependent on things that the ne net was more... Relaxed. Not a full time deal.

I have no illusions the magic has faded not just due to age and familiarity, but to what it has become, and what it has enabled the world to become.

You may want to see https://en.wikipedia.org/wiki/Draft:Effects_of_the_2007-2008...

The proposed designs never expose segments (err, cohorts, whatever) to the page. This machine works for managing targeted advertising in Chrome, and... that's it.

A browser leaking browsing history was considered an outright bug (https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...).

One could standardize a list of things people would want to fill out about themselves (i.e. please put in your age and sex or else we can't guarantee you won't be hassled with ads of things completely irrelevant to you), but your software inferring things about you and snitching to the world is outright malware.

> The draft specification states that a user’s cohort ID will be available via Javascript, but it’s unclear whether there will be any restrictions on who can access it, or whether the ID will be shared in any other ways.

Is this incorrect?

Everyone complains about the evils of Google, but revealed preferences show that focusing on what people actually care about has substantial value.

It's like no one follows what people say about cookie popups. Does your average non-tech user praise the EU for adding the popups and allowing opt outs? Of course not. They complain about these stupid fucking popups they have to click through on every site now!

(Disclosure: I work on ads at Google, speaking only for myself)

I agree that it's not a very deep observation, or maybe even not true. But it 1) seems to explain several different reactions I see on Hacker News, and 2) it illustrates a trap that I, as a Hacker News user, find myself falling into without realizing: the belief that the thing I want is the thing that other people want. To me, it's good to be aware of that.

This may be the case, but i don't think we can draw the conclusion from that that they like the new internet, only that we dont know if they do. Which is a very different conclusion

That said, i think the real reason is that the internet sold out and went corporate. I think its pretty similar to what happens when an indie band makes it mainstream - all the original fans tend to hate the change.

They're doing it to improve their ability to coerce me to purchase products and services; not to make the world a better place.

Rampant consumerism has not made the world a better place, not by a long shot.

The technique is designed to encourage consumption. This does not necessarily make society more efficient; having frequent nags to consume product one does not need is wasteful.

It's more than likely that targeted ads make humanity less efficient, due to the widespread coercion to consume products and services that are not necessary for a healthy and happy life.

That's a pretty big philosophical difference.

Her response was "No thank you. I like the ads. Sometimes I see things I like".

Perhaps it’s because the net of the past used to be a “wild frontier” not owned by a couple companies is why people have nostalgia. Those companies can make major decisions for the web based on solely on securing their own profit.

They use underhanded, arguably immoral, technological tricks that most general internet users might not even be aware of, much less understand how to defend themselves. It has nothing to do with the fact they never experienced the ‘old’ internet, they just don’t understand how or why they are being taken advantage of.

The HN crowd isn’t mad about obscene privacy practices because of nostalgia. They’re mad about it because they understand the actual technological mechanisms behind it, and how they work. And why the way big advertising exploits those mechanisms is so f’ed up.

Edit: Sorry, maybe I’m getting too angry. I think I see what you were going for, about many HN frequenters pining for the days of old. But I don’t agree with the idea that general internet users who weren’t online back then are okay with the current state of big advertising tracking technology. I think they just have no idea how or why it works.

I think many people are confused and frustrated that seemingly every random site or social media app they use seems to be aware of everything they do and look at online.

They’ve squandered that trust over the years. Frankly they should be broken up.

Most of the web tech are open source so it's just a matter of forking an existing tech and convincing others to use your thing instead. If your thing breaks half the existing workflows that's your problem, not others'

https://github.com/WICG/floc describes something open source and running on the client. Will that be sufficient, or is there additional disclosure you'd like to see?

Mellanox seems to think I'll drop 50k on NICs again, and I need to be reminded that last time I bought from them. It's been 11 years since.

> Each user’s browser will share a cohort ID, indicating which group they belong to, with websites and advertisers.

Sorry, I'm out. My browser is my agent. I don't want it to analyse my browsing data and send the resultant classification to random machines over the internet. Why is this even a thing? Browser's job is to display websites, not spy on the user.

If advertisers want to track me, they can create their own software and entice me to install it. Oh wait, that's exactly what Google did with Chrome :(

> cohort = await document.interestCohort()

I mean it‘s a proposal. I‘ll believe it when I can use it, but maybe actually look at the proposal.

Web service should be nationalized, and so should Chrome.

Those "rich people" are in the position they are due to consumer ignorance and apathy, but above all, they are our guests at the trough.

Show me someone complaining about over-regulation, and I'll show you someone whos being a hog.

Isn't that tautological? "The average person" knows nothing (or almost nothing) about the Internet of 20 years ago.

The point is the individual user doesn’t need to be tracked for advertising to work.

It’s a false choice thinking we need 3rd party cookies or a. special browser based UUID ad profile.

The truth is we don’t need either and advertising can still be effective.

To abuse a metaphor, we're not advocating throwing the baby out with the bathwater, but that bathwater still _has to go._

Ask her if she would give up on the ads that she sometimes likes if she learned that ad tech makes us addicted to our computers, more socially isolated, less likely to connect to our family and community, etc. IOW, ask her if she would trade the ads on Youtube for better quality time with her children and (potential?) grandchildren.

Giving in to ads because "some ads are nice" is no different to think that a diet based only on heavily processed foods are nice because "some of it taste good".

"The ads are annoying" is the last of the problem with the ad-based economy. People do become ad-blind after a while. The problem is all the tracking, profiling and the "eyeball-based website funding model".

This is far fewer bits than one's IP address (> 32), unless you're using a VPN or have some weird ISP doing NAT for its users.

My approach here is just stay off the internet. Go outside. Play board games. Imagine there was a world before computers and people entertained themselves just fine

.. unaccountable to them storing their personal information. Period.

But like you said, we'll see what they actually ship.

A tech-unsavvy user often dislikes "targeted advertising", as much as I could observe. For one, for the weird cross-media targeting effects, when a person sees the same ads, or ads about the same thing, like a fridge, following the user on many unrelated sites. It's most annoying when this keeps happening after the user has bought a fridge, and is unlikely to buy another just yet.

A less recognized but more annoying effect of ads is that they consume as much CPU and network latency as possible without making some sites outright unusable. The user says: see, I have this new and powerful computer, and this new and fast network thingie — why is the internet so slow? This is when installing even a simple ad-blocking extension shows the difference very vividly.

BTW I think that truly targeted ads can be useful — such laser-precision ads in Facebook showed me a few niche communities that interested me, e.g. dedicated to chiptune music creation. But most ads I see when I browse without ad-blocking are pretty lame, maybe 2% are well-targeted (and then I click on them). I keep a separate browser profile without ad-blocking to see what the internet is like for a vanilla user. OTOH the amount of tracking normally present on innocuous sites is surprisingly large, and slows things down rather unpleasantly, even if the ads are served instantly.

So yes, the internet full of ads is the norm for last 20+ years, and no, "normal users" do notice the impact of it.

Anyway, back to the topic... Why are you assuming the user is not intelligent/capable of making an informed choice ? Most people by now (we are talking about Internet users after all here) already know the implications of these ads towards their privacy. Yet 9/10 times they will choose convenience over it.

You are also assuming that time spent on YouTube is eating on time they would (rather??) spend on their families. What if the user watches Youtube at night when the family is asleep?

On to advertising. Some ads are indeed useful, despite of their tracking-based nature. Some are informational. Some are non-intrusive at all. I can't tell you how many times I've taken up a promo (on products I already use) because of a simple ad.

Putting all ads on the same bandwagon hurts the players who just care about serving marketing info and nothing more.

Foregoing ad-funded products or even ads themselves is not a binary decision. We need to get away from this mentality.

We had the same choice on Read the Docs, but didn't really have any other way to make money but advertising. We decided to build ethical advertising, so that we could be proud of the ads we show, knowing we weren't adding to massive pool of data out there. I talked a bit more about it here: https://www.ericholscher.com/blog/2016/aug/31/funding-oss-ma...

Or your IP address changing frequently, a properly not really applying to FLoC.

Do you want to have ads without tracking to fund the development of your service? Fine. Is that the case with Youtube?

What's interesting is that since these "FLoC cohort" identifiers are generated by the browser itself, it's even easier than "disabling" it.

They just won't implement it in the first place.

Google had a fully working, very lucrative business model in search term based ads. You search for "office rent Arizona", and Google shows you ads about offices in Arizona. No privacy violations.

There was no other problem with search term based ads except that Google wanted to pump up shareholder value faster than what that could give them.

And perhaps the terrifying privacy implications of such a system.

When I saw one on Facebook I was insulted, because Facebook thinks I am the kind of person who is so stupid they believe in them. You can write this of as not actual harm because it is only emotions, but it had a negative impact on me, which I consider actual harm.

The other issue is information leakage. If you want to show an article on your phone to a buddy you don't want the ads to be for adult diapers.

Last time FLoC came up, I commented that the idea of FLoC missed the point of why we oppose tracking: https://news.ycombinator.com/item?id=25906791

The EFF writes:

> The power to target is the power to discriminate.

I would extend on this point: the power to target information that the user is not choosing to share is the power to discriminate. Part of recognizing people's agency online is giving them the ability to choose how they present themselves and to choose what they share. It's not inherently wrong to say that someone might want to signal something about themselves that they find important or even just convenient to share. But that should always be their choice, it should not be a top down decision about what information is "safe" or "dangerous".

FLoC has some benefits (although they won't matter once every website decides to use FLoC as a fingerprinting vector), but even saying that FLoC has benefits, it is still based on the idea that users should not be in charge of their identities. It's got to be automated, it's got to happen in the background, it's got to use machine learning and be something that users can't inspect. I oppose the philosophy behind both current tracking systems and proposals like FLoC.

Last time this came up I also theorized about what a privacy-respecting version of FLoC could look like for people who do want to see ads or who do want personalized content online -- what a version of FLoC could be that I would be more supportive of: https://news.ycombinator.com/item?id=25907079

None of those ideas are fleshed out, but they try to get at the heart of what the fundamental difference is between allowing a user to easily signal that they want to see personalized content about shoes, and trying to intuit behind a user's back that they will buy shoes if you show them a particular ad.

Their only concern is maximizing their revenue in any way possible, because otherwise they will cease being competitive and go out of business. Ergo this lovely new "Privacy Sandbox" that provides advertisers with a standardized, direct way to get to you. As long as Google or any other advertiser has sway over Internet standards, there will be a fox guarding the henhouse type situation. Moral of the story: don't use Chrome.

This article talks about simhash. My understanding is that simhash does NOT perform any such analysis but generates a fingerprint based on the content that is comparable to those of similar content - for example, a checksum of my HN homepage is different to yours, as it contains user-specific information. Simhash, however, gives us a comparable "fingerprint".

In short, this only works for identifying pages of similar content - by itself i cant see how it could be used for cohort analysis unless there is either a client-side ML model involved, or millions of simhashes are shipped with the browser.

I raised this question the other day, and a googler pointed me to the "code". That code contained no reference to an ML model, its construction, or datasets. The code also contained no pool of simhashes. To me, that means that there is no way to label the browser with cohorts. Furthermore, the code appears to generate these simhashes, and then sync them to google via (the account identifiable) chrome sync. It is there that analysis is performed. Maybe this is why it's called "Federated LEARNING", instead of "Federated INFERENCE"?

Is this truly what we can expect from this? That instead of google tracking our behaviour from ONLY their analytics and advertising partners, they will now be secretly collecting a hash of EVERY page we visit and sending it to google directly? How is this private? The whole point of a simhash is to establish similarity between pages - and google has a huge rainbow table of simhashes for their search.

I got downvoted for raising this concern before. I would appreciate if someone would tell me what I have wrong instead of piling on the downvotes. Noone seems to be talking about this.

Advertisers and publishers don't really want tracking and data collection. It carries huge costs (technical as well as social) with very little benefit for advertising. Advertisers want statistically significant and unbiased population samples, and that's not something you can arrive at by blindly throwing more data at it.

Data collection by Google et al., is really because they eventually want to pivot from adtech to govtech - think "social credit" or "Minority Report". From their vantage point of course it's a much more lucrative and advantageous place to be than a mere seller of internet clickbait.

Think about the “filter bubble” effect that we experience on platforms like YouTube where we are always being “recommended” content that confirms our pre-existing beliefs.

Targeted advertising is no different except that it follows you across multiple devices and multiple online platforms in order to sell your attention to the highest bidder.

This might be fine if you are a capable, healthy and intelligent individual seeing ads for computer parts or shoes. What about the recovering alcoholic who is being “targeted” by alcohol advertising? Or the homeless schizophrenic girl I worked with a while ago who couldn’t escape a constant barrage of ads for highly addictive online gambling products?

Our brains are all wired differently and not everyone has the same level of “free will” as you do. The entire purpose of the advertising industry is to push you away from reasoned decision making and towards compulsive consumption.

As adtech becomes better at exploiting our psychological weaknesses and influencing human behaviour, I worry that we will not only see an increase in negative outcomes for the most vulnerable among us - but also an increase in mental illness among the general population as our borderline, compulsive and narcissistic traits are enabled and encouraged by soulless algorithms.

The Cambridge analyticas and the Russian bots happened because the average internet user was not paying attention to ad tech.

We need better education around ad tech, we need more people to understand what these ad companies are enabling so more average internet users can stay better protected, and make better and more informed choices.

None of this would be possible without ads. No one is going to pay for all that.

On a more positive note, I bought my 81 year-old Dad 'Mindf*ck: Inside Cambridge Analytica’s Plot to Break the World' for his birthday in January. He's so knocked out by it that he sends me PDF scans of certain pages. So probably the way to go is starting with a little covert education.

That would hide me rather well, especially if implemented by a large browser like safari or Firefox.

It enhances the ability to fingerprint me, effectively exposing my browsing history.

If Google offered it as an "opt in", giving me some reward for sharing my personal information that Google sells to advertisers, then that is a fair deal. In return for some form of sharing the revenue, Google gets to sell my information.

But that's not the model. It's still the "you're a product" model where Google not only gets to sell my search history, but now also continues to sell my browsing history.

I can see how it benefits Google and how it gives them/you something to sell to advertisers, but what's in it for me?

Except it does, it tracks how many times the image was loaded. That's tracking, even if you're not getting any user specific information.

FLoC is the same, you're not getting any individual user information, but you're tracking cohorts.

Honestly, as long as Firefox is still compatible with most sites, this won't hugely impact me. After that, I don't know.

Kudos to you for your recovery and sobriety!

https://news.ycombinator.com/item?id=9220098

Sure, google/FB and others sell that to advertisers as an advantage, but has anyone proven it works?

Google's original use of Adwords was based on my current search, didn't use my history, and didn't use anything else to identify/classify me.

Then they started adding geo location, using things like IP addresses and other out-of-band information, then cookies which allowed them to track me outside of their own site.

I don't care whether outbound lead gen is more difficult. I have no incentive to care. I have no incentive to offer my details to anyone.

Advertising has always been a manipulative business, by definition, its aim is to manipulate people into wanting to consume the product or service being advertised.

But it was constrained by the inability to target more than large demographic groups and locations.

That "pretty niche" product can still target its niche. What it can't do without the current dark patterns and tracking is target individuals. That would be a good thing.

Pre-digital tactics is not going back 50 years, it's going back 20. It's pre-9/11, pre-government-general-surveillance. That government surveillance has given tacit permission to business to do the same thing. The "if you've got nothing to hide, why are you worried about the government?" argument is applied to business now.

In short, fuck Google and FB and Amazon's need to sell targeted audiences. Their business model is flawed and has caused greater social disturbance than the overall reward.

It seems trivial to write a machine learning model that can correlate slowly drifting flocs with the other information. And this is especially true if one already knows the sites that the old floc has been visiting, for example via Analytics data, so you can predict the direction of the floc drift and uniquely identify the majority of web users.

Essentially, Google is not proposing limiting tracking, it proposes raising the entry bar into tracking so that a centrally placed company that can correlate all this data has a massive advantage. I wonder why.

And for the punchline, they call it... democratization!

TLDR: The ad industry promotes shit content, finances fake news, and wastes my resources.

All of the listed services will still be there, they just won't be making excess profits for their owners.

On the contrary, the most likely moment any random person online is to buy a fridge is just after they bought one: we know they had a need + awareness of the desired specs + intent to buy, so it's really just a question of convincing them that fridge B is better than the one they bought.

Buyer's Remorse is basically free in many countries, ex 14 days to return item in the EU.

It just wasn't bringing all the excess profits that advertising corporations wanted. So, enter the fingerprinting and tracking. Like a stalker following you around the web, gathering data on what you are and what you might want to buy.

That's like diving into a conversation about CCTV proliferation with "just wear a ski mask". It's inconvenient, hinders daily activities, makes you look like a criminal, and might not even help. It's unreasonable.

>It was probably a mistake to equivocate the kind of data gathering that ad-tech companies do with the kind that oppressive governments do.

Given that oppressive governments can obtain the data from the ad-tech companies... no, not really.

Except you don't really own your hardware :(

I've learned that the mainstream sees these and thinks "bot" or "fake" websites.

It took me quite a while to understand what they were saying, which was that my designs, ones that I'd considered minimalist, just plain sucked.

Are we supposed to be grateful now? Are we expected to celebrate this as a “huge win for the end user”?

This looks like a typical case of “fighting symptoms, not the cause”.

For myself, I enjoy their failures. It's better to be wrongly identified.

And that ad for adult diapers alongside another for a plausibly deniable grape de-seeding utensil... More entropy FTW!

> FLoC is meant to be a new way to make your browser do the profiling that third-party trackers used to do themselves

This seems to hint that avoiding FLoC is just a matter of avoiding Chrome, with no 'arms race' of any sort.

Two things in FLoC's favour: The algorithm is open-source and it's client-side.

It would be trivial for developers of ad-blockers to provide tools for anyone who cares about privacy to inject poisoned data into their stream. And for those who don't care, well it's a market and they are free to choose to partipate or not.

The devil is in the detail. So if FLoC and new third party tools to subvert FLoC became too mainstream, then I would expect Google to act in its own interest and provide value-added back-end services. Just as has happened with Android AOSP and Play Services.

Until then though, I feel FLoC being both client-side and open-source would be an improvement on the status quo

What you get in return is that ad-supported sites you visit are better funded because they can show better-targeted advertising.

As far as I am free to do whatever I want with the hardware I purchased, no matter how hard it is to do it, I do own it.

Let me put it this way, I can't put diesel in my petrol car in the sense that it wouldn't work because the manufacturer did not develop their engine to run on any fuel. They also made the refuelling hole in different size. This doesn\t mean that I do not own the car, if I feel so I can modify it to work with the fuel I like. Actually, it's widespread to install kits to make the car work with Propane but if I really want to I can convert it to electric or diesel too.

The same goes with any Apple product. Want to make the hardware do something that is not designed to do or actively prevented doing it? Hack your device. You own it. As long as the police doesn't knock on the door due to me fiddling with Apple made device, I do own it.

We are progressing more towards a dystopian reality where nothing is really in our control.

Yeah, my original post is not very clear about this. I'm not trying to argue that general modern internet users like the targeted advertising ecosystem. Instead, reading through some of the discussions here -- and past discussions of similar topics -- many of them at some point feature one user saying "tbh, i think it's fine if getting rid of targeted ads means losing a lot of revenue, because the old internet did just fine without all that revenue". But "how appealing is the old internet to modern internet users?" is a different question. And it's one where, I think, HN users overestimate the number of people that agree with them. My overall suggestion is that it's good to check whether or not this assumption is getting made somewhere along the way in these kinds of arguments, because I think for a lot of HN users, it is getting made.