Hacker News new | ask | show | jobs
by granzymes 1834 days ago
> people assured me that FLoC was an improvement to privacy

It is an improvement to privacy. Cookies uniquely identify me with no other information required. FLoC does not uniquely identify me with no other information required.

The opt-out is similar too: block cookies in the browser or block FLoC in the browser.

3 comments

You're talking about FLoC as an alternative to third party cookies, but major browsers had already done away with those before the rollout of FLoC. If getting rid of third party cookies was two steps forward, FLoC is one step back. We're technically further ahead than where we started, but that certainly wasn't thanks to FLoC. Without it we'd be even further ahead, so that's what we should be advocating for.
It was created so that well-behaved adtech companies could target based on FLOC alone, without having to resort to fingerprinting. Just as before, less-reputable adtech will continue to fingerprint to try to advertise to people with third party cookies turned off. As chrome continues to implement fingerprint resistance technologies, these techniques will continue to be less useful for people trying to advertise not based on FLOC alone.

Basically, it’s a way for google to implement fingerprint resistance in chrome and default to blocking third party cookies without killing their own funding source.

> It was created so that well-behaved adtech companies could target based on FLOC alone, without having to resort to fingerprinting.

I think this is a pretty good take. With floc there is a possible storry to tell companies that want to target/customize, but only in the amount tolerated by the users.

Once thats established, it's much easier to go after shutting down businesses using less ethical means.

If you care about privacy, "well-behaved adtech companies" is an oxymoron.
> major browsers had already done away with those before the rollout of FLoC

No, not really - ETP only blocks the most technically literal meaning of "third-party cookie" while still allowing plenty of tracking scripts to work with shared first-party data.

Chrome has well over 50% of the desktop browser market share, which by some measurements makes it the only major browser, and FLoC is definitely a prerequisite to Chrome disabling third-party cookie support.

Despite Google's marketing, FLoC has nothing to do with the removal of cookies.

Cookies were going away regardless, every other browser is doing it, Chrome is not powerful enough to go against the grain on this issue.

Separately from removing cookies (which was always going to eventually happen), Google proposed FLoC because they claimed it would help advertisers accept the change without encouraging them to build another equivalent tracking method using fingerprinting. Unsurprisingly, advertisers immediately took FLoC and used it to build another equivalent tracking method using fingerprinting.

The mistake here is meeting the advertising industry halfway. Just remove cookies. You don't need to propose anything else beyond that.

It has everything to do with the removal of cookies: Google has very clearly been waiting to have a viable alternative before they start blocking them.

It’s been something like 4 years since Safari started blocking cookies. You say Google isn’t powerful enough to resist, but Chrome has >60% market share.

Google can delay, I do not believe that even with 60% market share they are strong enough to resist permanently.

It is definitely in Google's best interest to act like FLoC is necessary to remove cookies, but I don't take their marketing at face value. They care about being competitive with Apple; they were even forced to pretend to care about advertising IDs after iOS's recent changes.

:shrug: pretty much every other browser has rejected FLoC as well, so I guess we'll find out if Chrome is really able to just go their own direction. But I think this is one of the rare instances where people are overestimating Chrome's power.

I don't believe Chrome's team would be doing any of this at all if they didn't see the writing on the wall about where the industry is going. My take is that they're trying to get in front of an inevitable industry-wide change to mitigate it's impacts on their core business. It's not out of charity or real concern for user privacy that they're proposing any of these compromises, Google would be perfectly happy to stay in a world with 3rd-party cookies if they thought they could get away from it.

A lot of their recent proposals start to make sense when viewed through that lens. See their effort to propose a standard where 3rd-party sites can be treated like 1st-party. See also their increased efforts on moving away from URLs for domain scoping. See also Manifest V3. Google is scared about this. The are scared of the situation getting out of their control.

And even if Chrome is powerful enough to resist removing 3rd-party cookies forever, I'd almost prefer they do that. It'll make it easier to get people to switch off Chrome when it is objectively less private than every single other browser in meaningful, easily demonstrable ways. And we do need to figure out a way to break up Chrome's stranglehold on the web anyway, so every reason helps. With the addition of FLoC, Chrome will already be less private than other browsers since FLoC is a strict privacy downside over just removing cookies. So it's good for that loss of privacy to be even more private, and to remove Google's ability to hide behind a confusing narrative about how actually their fingerprinting vectors are good.

Maybe this will make people switch off of Chrome, but I doubt it. In just the last 3 years Chrome has gained >6.5% market share.
So what, those third parties will then request that first-parties run a cookie proxy to generate and relay your unique ID, in order to get better payout rates?
I would guess it won't be long until the guides/kits on how to proxy your requests roll out. With some incentive that makes it financially dumb not to do it.