What is FLoC (Federated Learning of Cohorts)?

On 25^th January 2021, Google provided a deep dive into its vision of a cookie-free, but ad-rich future for the web. In a blog post ‘Building a privacy-first future for web ad­vert­ising’ the search engine giant detailed how per­son­al­ised ad­vert­ising could work if third-party cookies are no longer supported. One important element of its Privacy Sandbox is the so-called Federated Learning of Cohorts (FLoC) method.

Find out what FLoC is and how this privacy-friendly al­tern­at­ive to generate and use in­di­vidu­al user profiles could work.

Google announced that it would extend its Chrome browser by an API called Federated Learning of Cohorts (FLoC) on 14^th January 2020. The goal of the interface is simple: users will receive per­son­al­ised ads without a browser needing tracking cookies. This has important ad­vant­ages for user privacy. The FLoC API is based on an algorithm that points the browser user to various cohorts. Members of a cohort, which can also be un­der­stood as audiences with certain interests, have similar browser be­ha­viours in common. The cohort ID allows Google and ad partners to target relevant ads in a privacy-friendly manner. It conforms to both the ePrivacy reg­u­la­tions and the GDPR.

Ad­vert­ise­ments are an in­dis­pens­able means to generate traffic for web projects for many small companies. They are an equally in­dis­pens­able means of making money for many pub­lish­ers. Users, on the other hand, prefer ads that are relevant and useful to them. Methods such as cookies or browser fin­ger­print­ing have long been the easiest and most targeted way to create the user profiles necessary. However, because they interfere with the privacy of browser users, they have attracted growing criticism. FLoC promises an al­tern­at­ive approach that could satisfy ad­vert­isers, pub­lish­ers, and users alike while also guar­an­tee­ing data pro­tec­tion.

The algorithm, the ele­ment­ary component of the FLoC tech­no­logy, is still in an ex­per­i­ment­al state. Its function can be described as follows: Based on browser history, it assigns a user a cohort ID that rep­res­ents the user’s interests. The in­di­vidu­al user cannot be re­cog­nised by this ID, because it is shared with at least x other Chrome users (the number of users is currently not specified). Based on the ID, pub­lish­ers and ad­vert­isers can then target their ads to match varying interests.

Google bases the de­vel­op­ment and re­fine­ment of the algorithm on the following prin­ciples:

1. Cohort IDs should prevent cross-site tracking, i.e., cross-website tracking of user behaviour.
2. A cohort rep­res­ents users with similar browser be­ha­viours.
3. The algorithm should be based on un­su­per­vised learning, i.e., learning in­de­pend­ently without in­ter­ven­tion.
4. The algorithm must limit the use of ‘magic numbers’. In other words, it should be char­ac­ter­ised by the simplest and clearest possible para­met­ers.
5. The cal­cu­la­tion of a FLoC cohort should be easy and require little com­pu­ta­tion­al effort.

The prin­ciples ensure that the gen­er­a­tion and man­age­ment of interest groups remain trans­par­ent and easy to un­der­stand and cannot be in­flu­enced from the outside. In addition, they ensure the best possible data pro­tec­tion, since according to the FLoC principle, user data will continue to be collected and used, but the users are an­onymised within their cohorts.

The way Google’s Federated Learning of Cohorts works is best described using a concrete example. The basic par­ti­cipants in our exemplary FLoC mind game are as follows:

• User 1: Browser user who is assigned to cohort 123; wants to purchase trainers.
• User 2: Browser user who is also assigned to cohort 123; checks the news online.
• Ad­vert­iser: Online fashion shop which uses ad platforms to place targeted ads for its products across websites.
• Publisher: News page featuring the latest news which uses ads including those of the Ad­vert­iser.
• Ad platform: Platform which provides tools and data for digital ad campaigns; mediates between Ad­vert­iser and Publisher.

In the first step, the browser or better the browser-based FLoC algorithm creates the various interest groups. Each cohort is given a unique ID.

Based on the browser history of User 1, the browser de­term­ines the ap­pro­pri­ate cohort, which in this case carries the ID 123. The browser of User 2 also analyses the usage history to assign the ap­pro­pri­ate iden­ti­fi­er. Although the history differs slightly from the usage history of User 1, it still has suf­fi­cient sim­il­ar­ity to that of User 2 and so is assigned the FLoC ID 123.

User 1 begins to search for trainers online. They browse the online shop of the Ad­vert­iser and search the products for suitable trainers and related items. The ad­vert­iser gains access to the cohort ID of User 1 and shares this data on the user behaviour of members of cohort 123 with col­lab­or­at­ing ad platforms.

User 2 visits the news page of the Publisher while browsing for the latest news. This means they share their cohort ID with the Publisher. To display per­son­al­ised ads to User 2, the Publisher accesses the same ad platform as the online shop (Ad­vert­iser). As part of the request, the Publisher transmits the FLoC ID 123.

The provider of the ad platform can now determine per­son­al­ised ads for User 2. Thanks to Federated Learning of Cohorts, it has access to the following data:

• The cohort ID of User 2 (123), trans­ferred by the Publisher
• Own data about interests of browser users in cohort 123
• Data provided by the Ad­vert­iser about product interests (trainers) of users in cohort 123

The ad platform de­term­ines that an ad for trainers would be a suitable result for User 2, who will im­me­di­ately be shown the ad on the news page. All without the use of cookies.

At first glance, Federated Learning of Cohorts seems to be the perfect solution for dividing browser users into interest groups without in­ter­fer­ing too much with their privacy. And when it comes to the American market, Google does not seem to doubt that as­sump­tion. The pre­par­a­tions for the full im­ple­ment­a­tion of FLoC in Chrome are in full swing in the USA. The first ads on the Google ad network Google Ads based on FLoC tech­no­logy are to be displayed on a test basis as early as the second quarter of 2021.

In Europe, Google has put the Federated Learning of Cohorts tests on hold. The main problem is a lack of clarity about who would control the data and who would process it when creating cohorts. But con­sid­er­ing Europe’s legal stance on data pro­tec­tion and privacy, it’s far from the only point of con­ten­tion. The assigned cohort ID, which links users to an interest group, and all related in­form­a­tion could be regarded as ‘personal data’. In addition, the pro­cessing of data that is collected and used to generate the cohorts could violate the GDPR if Google does not obtain user consent first.

In his role as Google Product Manager for Privacy Sandbox, Marshall Vale announced the following in March 2021:

However, persons re­spons­ible at Google remain confident that FLoC tests can begin soon in Europe as well.

Website operators will have the op­por­tun­ity to subscribe or un­sub­scribe from Federated Learning of Cohorts. That means it is up to them whether a visit to their website or online shop should be included in the creation of FLoC cohorts or not. This is an important point, es­pe­cially for websites with sensitive topics. In addition, Google would like to establish a central pro­tec­tion authority that auto­mat­ic­ally deletes certain cohorts if they contain a high number of users visiting websites in sensitive cat­egor­ies. These cat­egor­ies include, for example, websites on financial hardship or mental health.

FLoC is blocked from a website when you embed the following per­mis­sions policy header:

If you have blocked FLoC tech­no­logy in this way and want to allow it again at a later point in time, just remove the header entry.