floc VS AmIUnique

"The browser uses machine learning algorithms to develop a cohort based on the sites that an individual visits. The algorithms might be based on the URLs of the visited sites, on the content of those pages, or other factors. The central idea is that these input features to the algorithm, including the web history, are kept local on the browser and are not uploaded elsewhere — the browser only exposes the generated cohort." Source: https://github.com/WICG/floc

It's pretty complicated and my understanding could be wrong and definitely not an expert. All the stupid CIA-style names that keep changing don't help. Turtledove, fledge, sparrow lol.

But from what I think I know that's kind of right technically, but kind of not in terms of actual real privacy.

Yes, the actual browsing data, e.g. for the basic floc cohorts only what amazon product page you visited, is no longer 'sent' to ad networks (that's a pretty big oversimplification of how ad networks track you but for brevity). That data is parsed in your browser to generate a cohort ID for you.

But this cohort ID is exposed to the world document.interestCohort() and is what's used for targeting and tracking.

To me it seems that the cohorts are so small "thousands of people" + IP or UA it's basically the same as a semi-long lasting uuid.

Here's an image from google's site.

https://web-dev.imgix.net/image/80mq7dk16vVEg8BBhsVe42n6zn82...

It also seems like Chrome/google might be still defaulting browser settings to give themselves even more data just like they currently do?

https://github.com/WICG/floc#qualifying-users-for-whom-a-coh...

BUT when you layer on the other proposals (Fledge/Turtledove/Dovekey or whatever) - which I don't understand that much maybe someone else can explain - it seems like it basically collect this page/product level data and makes it available to DSP etc for tracking/ad serving (again if not technically 1:1 basically in consequence given the sizes of these groups).

Like one of the proposals talks about a 'trusted' key/value server which doesn't seem that different from what already happens? The original proposal wanted to move the entire ad bid/target/serve process into the browser.

and how FLoC works here: https://wicg.github.io/floc/

FLoC as a source of fingerprinting bits has been an issue in W3C discussions of the project.

https://github.com/WICG/floc/issues/69

As a fingerprinting surface FLoC has similar properties to the Battery Status API -- not stable for the same user over long intervals, but can be used to help match pageviews from different domains that were close in time.

https://www.schneier.com/blog/archives/2016/11/firefox_remov...

FLoC has a well defined API like (all) standards: https://wicg.github.io/floc/

There's no reason why the website would not be reliable at detecting whether FLoC is enabled on your browser.

You can also used https://floc.glitch.me/ which was linked in one of the blog posts from google.

you can target an Economist reader a week later on a different website. If FLoC works, you can still do that.

https://github.com/WICG/floc won't really let advertisers do that, this is what https://github.com/WICG/turtledove is for

(Disclosure: I work on ads at Google, speaking only for myself)

The issue is that the replacement that are currently in the works (https://github.com/WICG/floc and https://github.com/WICG/turtledove/blob/main/FLEDGE.md) are extremely complex, will still dramatically impact adtech performance and only improve privacy for a very contrived definition of the concept which incidentally benefits once again big tech vendors...

As to the effectiveness of advertising, removing tracking will have a huge impact. And this affects all players in the value chain, not only adtech providers but also publishers and more importantly advertisers which will see their return on ad spent severely impacted. There is a real of loss "social welfare" (I mean in a game-theoretic sense, but also for real if you believe in capitalism) if tracking is disabled.

Additionally, uBO causes all websites to opt-out of being part of FLoC calculation by injecting the appropriate response header.

Maybe he should explain it on this repo (https://github.com/WICG/floc) of which he is a co-author then since that is where I got my misunderstanding from.

You are. Compare the fingerprints of your two browsers: https://amiunique.org, https://coveryourtracks.eff.org. Very likely, the fingerprints are very similar. For anonymity, use Tor.

Browser Fingerprint Checker

https://amiunique.org/

https://coveryourtracks.eff.org/

Hey, what do you think about amiunique.org? Seems to get fingerprinted even when using Tor Browser with Safest security setting. Of course JS enabled on TLD.

I recommend you try out amiunique.org. It gives a slightly better overview.

They are better at some aspects, yes, but also easier to track because of others. So few people use FF that your setup is likely unique, making it very simple to track around the web. Go try a sight like https://amiunique.org/ and test your browser.