Google’s FLoC Is a Terrible Idea

> That framing is based on a false premise that we have to choose between “old tracking” and “new tracking.” It’s not either-or. Instead of re-inventing the tracking wheel, we should imagine a better world without the myriad problems of targeted ads.

I don't want to be tracked. I never have wanted to be tracked. I shouldn't have to aggressively opt-out of tracking; it should be a service one must opt-in to receive. And it's not something we can trust industry to correct properly. This is precisely the role that privacy-protecting legislation should be undertaking.

Stop spying on us, please.

I'm sometimes confused what is covered under this term and I'd kinda like to know where the line here is drawn. What exactly are we talking about here?

Maybe just use Tor.

> Stop spying on us, please.

It was probably a mistake to equivocate the kind of data gathering that ad-tech companies do with the kind that oppressive governments do.

It also seems like FLoC could make it more politically viable to crack down non-consensual tracking. Publishers wouldn't be able to say "we have no choice but to deal with this [third party tracker] scum" but could continue to gate content by subscription or (consensual) FLoC as necessary for their business model.

Pushing publishing and advertising towards proactive consent about targeting puts them into a dialog with the market about what's ok, instead of letting them hide behind a bunch of shifting tracker businesses.

The best default is not to track at all.

https://webmonetization.org/

It barely exists so far and is only implemented by a single browser that I'd never heard of (Puma). Hardly fair to demand if people are using it yet.

> how do you propose things work?

We go back to advertising without tracking.

That it would independently identify you to Site A and Site B as a person in a particular cohort.

That alone means direct payment will never replace ads.

Most people are not reading The Financial Times or Bloomberg, they are reading rags like The Sun and Facebook gossip. I would love for that content to go away, but really, ad supported models work great for that demographic.

The simplest definition of tracking I can come up with is "collect data about me that can (and often, is) used to build a profile of me and my behavior". The NGinx log could or could not be tracking, depending on whether you use it to diagnose issues ("we should optimize this picture, it's loading too slow for too many people") or to profile me ("ID 12345 uses a 56K modem, let's sell him a new one"). But no perfect definition exists because everyone has different thresholds of what they are okay with.

Sadly without this tracking, the engines of the ad economy come to a stop. We have royally ducked up the ecosystem to the point where there's no fixing it. Ever. Even laws such as GDRP won't cut it, Facebook & co. are happy to flout the rules since paying the fines is worth the cost of breaking the rules.

In the case of Google ad money vs Content marketing economy, it really is a case where the chicken came before the egg.

To me this seems like a win? It allows you as a person to control how your ad profile is built (and if it's sent at all) and doesn't send your data to servers anymore?

(Please correct me if I misunderstood the technology.)

I bet if a random open source project of the same kind were released, it would probably be pointed at as a reason why Google is evil ('see there are good alternatives!'). But because Google is doing it, people are (rightly) wary and (definitely not rightly) calling it evil without doing research.

There are so many hobbies and interests where the rich, meaty information people can benefit from is found on old-school blogs and websites that their owners have maintained without expecting to make much money at all, besides the occasional click-through to an Amazon referral link.

However, those blogs and websites have now become hard to find because they have been pushed down in search results due to Google's changed algorithms and ad-supported websites heavy on SEO – sometimes those ad-supported websites are literal copies of earlier advertising-free blogs where a developing-world freelancer was paid to rewrite all the content just enough to avoid a DMCA takedown. Also, the advertising-supported world of mobile social-media apps has made people today less likely to step outside of their walled gardens and consider small third-party independent websites.

So, to a degree, things would work better in certain cases if targeted-advertising-supported websites disappeared; their decline would reveal a whole world of useful free content that was there the whole time.

If most browsers aggressively blocked ads then more sites would test to see if blocking ads breaks the site.

Businesses providing paid services on the internet will still want to get noticed before those free smaller websites and will do whatever they can to appear first in relevant search engines results regardless. The reasons to get people on their sites would shift from showing them ads to selling them a paid product, but reeling people in is still going to be the objective.

There are many great arguments against tracking, but IMHO, SEO isn't one.

Yes.

> Sadly without this tracking, the engines of the ad economy come to a stop.

One more reason to eliminate tracking.

Youtube did not even think of charging premium so many years after launching as a free service.

Do you think they would have been that successfully were it not for the user base aka free eye-balls?

> There is nothing that says that we must be forced to tolerate ads in exchange for the internet

While true but this is the way the game and the field has been setup. Same thing that explains why you see ads on even on paid devices. Why be content with 5$, when you know you can shake 6$ from a customer?

I am for privacy. Believe me. But this battle is not winnable when you make up 5% of the sober group and the rest are happy and drunk in love with Clubhouse or whatever new social media drug that is the rage.

Without bug problems. Migrating away from Gmail would allow me to de it indefinitely.

Why should I have to jump through hoops and disguise myself? Why can't Google et.al. just respect the basic human right to privacy?

The way they've worked for the last 400 years. The ads are tailored to the content, not the individual reader.

I do, and the amount of money webmasters made back then was much better.

Some of the sites I ran got $10-$15 CPM. Ad campaigns targeted to my sites' niches could be up to $25 CPM.

Ever since Google introduced AdWords and its race to the bottom, content-heavy web sites are lucky to get 10¢ CPM.

But since the new kids on the block have never experienced a profitable web without tracking, they don't know any better and think it didn't exist.

I have yet to play with it though, mostly because I do the vast majority of my browsing on a desktop.

https://chrome.google.com/webstore/detail/coil/locbifcbeldmn...

I agree that their web presentation leaves a lot to be desired.

That's what happens when no one trusts you. It's human nature, and logical arguments aren't going to change that.

If anything, it's a good thing for society if Google burns despite trying to do something genuinely good (not that FLoC is good), because it shows others that there are real consequences to betraying the trust of your customers.

We lose one untrustworthy company today, and gain many trustworthy companies in the future. That's a net positive for society!

That'd help.

Will look into this

These constant references to "the web" when discussing certain companies is annoying. The www does not belong to any incorporated middleman. I do not care how much traffic they are curently in control of. The www is a medium not a small, privileged group of messengers. How is this company even contemplating something like this. Answer: Because a majority of users choose a browser controlled by an advertising company. WTF.

This company will no doubt exert influence/control over the "standards" process and next thing we know, every developer working on a browser will feel obligated to "implement FLoC". Maybe this is an either-or question. Who is the www for: users or advertisers. The middleman needs both. Advertisers need the middleman and users. But users do not need advertisers. And, truly, they do not need the middleman. Users are creating the content. The middleman just sits in between, spying on everything.

Maybe there needs to be more than one www. Maybe there needs to be a non-commercial www for smart people.

> Well of course $company gives $oppressive_regime access to data they collect on their users. They have to comply with local laws!

Even with some existing laws, the profits are enough that they are willing to flagrantly violate these laws and simply pay meager fines.

It's also unlikely that we will ever get significant legislation to protect us from this either, because all these tech profits allow big tech to buy our government, because policy is heavily swayed by corporations.

If that's a desired future we should be honest about it, but it's a future without as many independent journalists who can't afford a team to sell their content, for example.

It's not just Youtube/Vimeo; for instance, Flickr was a premium paid service around the time that Facebook launched, and it wasn't under water, either.

These "freemium" services were able to act as _hideously unprofitable_ loss leaders for the large advertisement firms, and so take down the non-advertisement-funded competition.

It was predatorial monopolistic practices that gave us the current web.

But if FLoC requires the browser to do the tracking itself, would it be possible to fork Chromium, disable tracking, and have FLoC return fake or random data instead?

Paid content, product placement, YouTubers pitching Audible book related to video.

Re: obnoxiously bad service, frankly I think sites should run however they want as long as they are truly transparent about it (not just a buried EULA). I prefer open sites, but nobody should be forced into service just because I have an IP.

If you want you can use duckduckgo with ads disabled in settings, visit HN and wikipedia and stackoverflow (although they have the #hireme thing), pay $10/month for youtube and spotify premium so you don't see ads there, etc. And then use ghostery to disable third-party cookies and things of that nature. What more do you want the industry to do?

That would be an actual win. Not showing me ads at all would be an additional icing on the cake. I even don't want to see ads about things I'm interested in. Just nothing.

The responsibility isn't on the user to either consent to tracking or to come up with an alternative business model that allows people to monetize things. The responsibility for monetizing things falls on the people who want to do the monetizing. They have to figure out a business model that works and that users consent to.

Google is the farmer, websites are the dogs, and we are the livestock.

Some might say, in a fit of charitability, "but it's a bird reference", citing prior work. To which I say no; don't convince yourself for one moment that Google's army of PhDs didn't notice the sheep allusion. They are not that dumb. But they are this arrogant.

- hidden and confusingly worded opt-out dialogues - different cookie banners on ever site - dark patterns such as requiring far more clicks to opt-out than in - opt-out dialogues with lots of technical wording - sites that just don't provide opt-out options - sites that purposely degrade the ux if you opt-out

All these mean that the average "not technical" user (such as my parents) cannot reliability opt-out.

We ought to have opt-in be the default.

> This is precisely the role that privacy-protecting legislation should be undertaking.

Wasn't this already the idea behind the DNT (Do Not Track) header?

The only one of those I ever interact with on purpose is Youtube, only via youtube-dl, and only because other people refuse to use reasonable means of distributing video content (eg bittorrent).

No I meant it's easy to just not send those cookies back.

At the very least it is not harder than letting the browser profile you and choose what it should and shouldn't share with advertisers.

But, the reality we need to accept and work from is that with vested corporate interests aligning so well with intrusive governmental and military interests, nothing is going to change.

Don't hold your breath for privacy protection legislation.

If we rely on old pre digital tactics with no targeting, it's like going back 50 years and using a machine gun in the dark.

Combine the Google cookie depreciation, Apple's recent changes in 14.5 and the general mood around 3rd party data sharing which makes effective outbound lead gen more difficult. I think we are witnessing death by a thousand cuts in terms of increasing the barriers to entry for smaller business.

You're dreaming. You'll also expose to Google IP and website URL via Referer in requests for fonts and jsquery bundles, in Google cookies masqueraded as first-party via CNAME tricks, in Chrome identifier and so on. Chances are you're using Google DNS 8.8.8.8 too.

I wont trust a company to disable the data source for their main revenue. Just don't use any of Google software and services. Android included, sadly.

Good. The sooner that happens, the sooner people start building alternatives out of necessity.

People hate ads, but the alternative is so much worse.

If you say shit like this unironically, you can't ever accuse someone else of having a "warped perspective".

Unless this ends up as some closed source DRM style blob (in which case we might as well kiss goodbye to the open web that can be accessed by standards compliant browsers), I can't see how anyone can stop this.

On the other hand, given the widespread use of ad blockers and tracking block lists, perhaps this simply isn't a design goal - just accept that 20% of techies will block it anyway and return 0 or simply not run a browser that supports it, and focus on the majority who think Chrome is synonymous with "the internet" and run it without add-ons.

Two for the price of one? No tracking, no ads? Sign me up.

Textbook illegal, but major high-street global brand names do this, and there's no easy way to make them stop - regulators just can't move quickly enough or show enough teeth. We would need thousands of convictions per day to even scratch the surface - I'd estimate at least 9 in 10 sites I visit breaks the law in one way or another around their cookies and consent prompt.

Perhaps we need a way to commercialise and earn revenue from identifying the sites breaking the laws as you describe? The law demands "opt in" for Europe, yet everyone tries to skirt this and use dark patterns like forgetting the cookie settings of anyone who dares not accept everything. Many of these dark pattern techniques are actually illegal.

If you could commercialise each of these findings, we would have everyone compliant in a matter of weeks. SEC style whistleblower model (albeit on a smaller scale)?

I'm not sure that's a reasonable assumption.

Many sites actively break their own user experience and hide their content as best as possible for users with adblockers. It's also understandable, because these sites don't want users but adviews and adclicks. They would rather intensify their efforts to force the user to turn on adds than make sure the website works without generating revenue.

I also don't think we would see much more subscription or pay once models, because they are just not viable for many websites. These websites would simply cease to exist and we end up with less diverse available information on the internet.

If you've every made the buying decisions for an organization, you've been targeted individually before. Through digital economies of scale, it's less expensive to do with consumers now and allows for publishers to get paid to generate content at the same time.

Everyone complains about the evils of Google, but revealed preferences show that focusing on what people actually care about has substantial value.

It's like no one follows what people say about cookie popups. Does your average non-tech user praise the EU for adding the popups and allowing opt outs? Of course not. They complain about these stupid fucking popups they have to click through on every site now!

They're doing it to improve their ability to coerce me to purchase products and services; not to make the world a better place.

Rampant consumerism has not made the world a better place, not by a long shot.

The technique is designed to encourage consumption. This does not necessarily make society more efficient; having frequent nags to consume product one does not need is wasteful.

It's more than likely that targeted ads make humanity less efficient, due to the widespread coercion to consume products and services that are not necessary for a healthy and happy life.

That's a pretty big philosophical difference.

Mellanox seems to think I'll drop 50k on NICs again, and I need to be reminded that last time I bought from them. It's been 11 years since.

Except it does, it tracks how many times the image was loaded. That's tracking, even if you're not getting any user specific information.

FLoC is the same, you're not getting any individual user information, but you're tracking cohorts.

Sure, google/FB and others sell that to advertisers as an advantage, but has anyone proven it works?

Google's original use of Adwords was based on my current search, didn't use my history, and didn't use anything else to identify/classify me.

Then they started adding geo location, using things like IP addresses and other out-of-band information, then cookies which allowed them to track me outside of their own site.

I don't care whether outbound lead gen is more difficult. I have no incentive to care. I have no incentive to offer my details to anyone.

Advertising has always been a manipulative business, by definition, its aim is to manipulate people into wanting to consume the product or service being advertised.

But it was constrained by the inability to target more than large demographic groups and locations.

That "pretty niche" product can still target its niche. What it can't do without the current dark patterns and tracking is target individuals. That would be a good thing.

Pre-digital tactics is not going back 50 years, it's going back 20. It's pre-9/11, pre-government-general-surveillance. That government surveillance has given tacit permission to business to do the same thing. The "if you've got nothing to hide, why are you worried about the government?" argument is applied to business now.

In short, fuck Google and FB and Amazon's need to sell targeted audiences. Their business model is flawed and has caused greater social disturbance than the overall reward.

That's like diving into a conversation about CCTV proliferation with "just wear a ski mask". It's inconvenient, hinders daily activities, makes you look like a criminal, and might not even help. It's unreasonable.

>It was probably a mistake to equivocate the kind of data gathering that ad-tech companies do with the kind that oppressive governments do.

Given that oppressive governments can obtain the data from the ad-tech companies... no, not really.