X-Client-Data cannot be disabled (it's hard-coded) and ships telemetry to DoubleClick without disclosure.
Google Chrome is the DoubleClick browser. Why else would DoubleClick be hardcoded into the source as a place to send telemetry?
[0] https://twitter.com/__jakub_g/status/1365400306767581185
> "Whether the browser sends a real FLoC or a random one is user controllable."
FLoC stuff is client side. You can send nil FLoC IDs. You can randomize them on every request. You can swap them with your friends. Whatever.
Vanilla Chrome might not let you (my money would be on an off-switch but not anything fun) but that's hardly going to be a blocker.
(googler but works on something completely unrelated)