Nobody is joining Google's FLoC | Hacker News Reader

Nobody is joining Google's FLoC

theverge.com

269 pointsAnalemma_173 comments

I'm definitely in the minority of commenters on these FLoC threads. I hate that 3rd party cookies exist, and support FLoC if it would hasten the demise of 3rd party cookies. It seems like many consider the alternative to FLoC to be an anonymous web where content can be accessed without login. The migration of content into walled gardens like Instagram seems more likely to me.

The idea that FLoC is a more privacy-friendly alternative to third-party cookies is deeply flawed, please read [this](https://github.com/WICG/floc/issues/100).

Thanks. Good thread. Sounds like FloC is definitely more anonymous than third party cookies that are already in use today. There might are some hypothetical situations with FLoC where some information might be able to be inferred given sufficient data, but this is not trivial/direct like it is today.

No, that attack is trivial and direct, that's the problem.

I have my doubts about the "more anonymous" part, mainly because 3p cookies are constrained to a single browser on a single device and can be easily erased or blocked, but your browsing habits that will land you on a certain cohort will remain the same across devices so you could technically be tracked cross-device even if you don't sync your browsing history or cookies (if I am reading right the way FLoC works).

Quick edit: you are certainly right that it will be less direct and more effort than cookies.

Not to mention that this only really makes it more difficult for businesses who haven't already infected the web with things like social media buttons, widgets, or analytics scripts.

Neither Facebook nor Google require third party cookies to function, and I doubt FLoC would make any difference when they can already slurp up so much data that is voluntarily provided by other people without your consent (your address book, for example). Google even goes one step further by connecting your Google account directly to the browser, but there's also a reason why your Facebook login will never expire unless you force it to.

This whole thing feels like paying lip-service to privacy to keep people distracted from the reality that a cadre of 90s/00s tech giants have essentially usurped the web.

Most people on the internet use a web browser developed by a search engine company that evolved into a faceless advertising giant, after all.

Facebook ads and Google ads do not need third party cookies ?

How are they serving contextual ads if they don't know what you are doing on different websites if the myriad of trackers they offer to content websites do not track you by third party cookies ?

there are several ways. ETags for one, another is to have all the various sites that use an ad network to send the relevant visitor fingerprint data to a central broker that correlates the information and attempts to determine that entity A and entity B are really the same person because a bunch of attributes match.

> Sounds like FloC is definitely more anonymous than third party cookies that are already in use today.

Not at all.

My browser deletes cookies from any website (by default) as soon as I close the last tab for a given open site.

If the browser itself starts tracking me, my privacy is reduced, not enhanced.

I would think that whenever the "clear cookies" command is given to a browser, it also clears the FloC ids. Is that not the case?

You just might be right. If you clear the history, the FLoC machine will have to calculate the cohort ID afresh. There are other use cases for this as this form of identification can be manipulated. Don't want to see cat ads anymore, google more dog memes next week.

Third party cookies are already on the way out, allthough it is going very slowly. But if that is already happening, I see no reason to replace it with something that is going to stay and is only slightly better. Being patient is easier and better, it will be a question of a few years I suppose, instead of, I don't know, forever? :)

Content providers want third party cookies. Users have no idea what third party cookies are. Any deprecation of third party cookies will have to come from the user-agent (Safari and Chrome being the only ones that matter).

Content providers don’t. Advertising networks do. If the whole industry moved to content-based advertising, the content providers would be just fine.

Yes even the advertisers don't care. It's the networks themselves that build value worth big data that keep the myth alive that tracking is necessary for advertising.

One of the contenders for replacing 3rd party cookies is The Trade Desk's Unified ID 2.0, which if I understand correctly, would require users to login in everywhere and be tracked in exchange for free content. But it's going to compete with other companies like Google and Facebook for managing users' online identities.

What’s wrong with just showing normal ads like we had for over 100 years? Is tracking really needed to prevent walled gardens?

CPM price for targeted ads is lot more than untargeted ads. So likely the publishers will increase the number of ads per page to maintain the same eCPM yield. Also the ads will optimize for top of the funnel (clicks) than bottom (conversion). So we will start to see aggressive & intrusive ads. (remember the "punch the monkey" ads from the early 2000s?)

But does the money go to the publisher? I’ve read somewhere that most of it (like 90%) goes to the ad tech middlemen. If the ad does not track, there is no ad tech, so more money goes to the publisher.

> CPM price for targeted ads is lot more than untargeted ads.

Only because they're viewed. If we can get everyone to install an ad blocker, that price will plummet, and business models that aren't based on abusing users will be allowed to succeed.

If that happens many many websites won’t be able to operate for free like they do now.

I'm still not convinced that's a bad thing. Does this not ensure profitable sites will be around because they provide enough value to their users to charge a fee, everything else will be stuff like passion projects.

I really just feel that 1. Advertising is manipulative and evil in its' modern form, and 2. Targeting further multiplies its' ability to do evil.

I'm not convinced that what we receive in exchange for empowering 1 and 2 is in any way worth it.

This means that the only way to make money is via subscriptions or cross promoting something that makes you the real money. The walled gardens, being able to both avoid Adblock and sell targeted ads, will do quite well.

If your goal is the open web of yore, that doesn’t exactly sound like a win.

How do you think web rings worked exactly? Before SEO, you'd land on some person with a niche interest's page who'd generally know of someone else in that niche space. Those two would link to one another, effectively syndicating each other.

It wasn't until everyone started fighting SEO-wise that you ran into the issue of fraud pages of nothing but links and sketchy ads that were the byproduct of reverse engineering Google's PageRank algorithm of the time. In fact, before SEO, there really wasn't that much of a niche for "Social Media" proper. A creator's web page and web ring were basically the social networks of the time, and arguably much less addictive or prone to scraping in the sense most back and forth was BBS/IRC/Email/Forum.

I remember the first time I overheard someone pitching SEO while eating lunch with the lunch pool from the office. If I were more the type to barge in at that time I'd have called them out as the fool they were being for corrupting a seachable index. Little was I expecting at the time that engineering indexes was the New Big Business and that the Web I knew was in the process of being obliterated and replaced with the shark infested botnet and data hoard-i-tron we have today.

Imagine a world without ubiquitous IP geolocation. One without rampant browser fingerprinting. Without everyone and their brother wanting you to subscribe for a recurring revenue stream. Without widespread collusion amongst industry actors to embed DRM circuitry or backdoors into every General Purpose piece of hardware under the sun.

It was a completely different world and tone to computing. It was your tool, and it was there to empower you; not to shovel crap through your bloody hardware whether you wanted it or not.

How do you get users into your walled garden though? I just walk away when I encounter a paywall and I'm sure most people do.

Examples of walled gardens that many people use are Instagram, FB, even Reddit to some extent which hamstring their mobile sites and push you to an app.

Good point.

I couldn't get out of all these either but I keep them strictly separated in Firefox tab containers. I think it works because Facebook always suggests friends to me whom I don't know at all, and its ads have no relevance to me (only to the 1 or 2 topics I use FB for).

Ads will be rendered server-side, and nothing will plummet.

In exchange you'll get completely opaque and abusable serverside user tracking systems and encrypted html pages.

This isn't what you want.

That is only true because targeted ads are possible.

In a world where there is no targeted ads, companies still need to get clients and compete. The marketing budgets of companies would not miraculously go down if targeted ads ceased to exist, the money would just go to other means, and non targeted ads are a very good candidate (also they can be extremely hard to block as they can be served first party if needed)

> The marketing budgets of companies would not miraculously go down if targeted ads ceased to exist

If marketing returns drop, all other things being equal, budgets being cut is the natural consequence, because less spending will be possible before declining marginal returns result in negative net returns to further spending.

Most of the internet ads are direct response. As long as companies get back more than they spend they keep spending. So there is no set "budget". If direct response goes away there is not enough brand budget to buy all the ad impressions so the prices go down a lot.

Yes. TV advertising is actually much more targeted than web advertising. (In the sense than TV advertisers know precisely their target audience and its response.)

The various annoying remarketing schemes are a tiny part of advertising technology and really only exist because of the well-meaning but poorly thought-out ideas about privacy on the web.

Is content-based targeting really so much less effective than user-based, or is this more of an arms race between ad providers where even a small difference gives them a large edge? Youtube doesn't need to know someone is a snowboarder in order to show them snowboarding-related ads. They can just show those ads on snowboarding videos and they don't need to invade the user's privacy to do that. The targeting is not as accurate, but it's how ads have basically always worked, how they worked on the internet before the ad networks and tracking, and how they still work in other media.

I think it's probably naive to assume that, if FLoC was implemented, advertisers would just stop using their existing tracking technologies, which allow for better tracking than FLoC offers. I imagine most would continue to use these, plus FLoC.

Advertisers will not have the option to use third party cookies when they are disabled by default in Chrome (what Google is working toward).

But the existing tracking technologies will be going away. 3rd party cookies soon enough will be blocked by default on the major browsers.

When 3rd party cookies are gone, we won't need floc either!

> if it would hasten the demise of 3rd party cookies

Will FLoC speed this up?

As far as I know, Firefox, Chrome, and Safari are already largely publicly committed to phasing out 3rd party cookies over the next couple years. I guess FLoC might move that deadline up a bit?

But I suspect some critics of FLoC are looking at the proposal as a compromise that we don't need to make. The thinking is, at the point where we have public statements from every single major browser, including Chrome and Edge, that 3rd party cookies are going to get phased out, why do we need to throw the advertising industry a bone? We won this particular fight, 3rd party cookies are going out the door. Now (the thinking is) we just need to make sure that counter-proposals like FLoC and FPS[0] don't reverse the gains we've made.

I'm not completely sure how to characterize Google's recent proposals, but an arguably reasonable take that I've seen online is that Google somehow got peer-pressured into making a very public commitment to remove 3rd-party cookies, that they no longer feel they can back down from that commitment, and that a lot of their recent proposals seem to be attempts to find some way to get out of that deal. First Party Sets in particular are just a very conveniently timed proposal. I suspect this take is at least a little simplistic, but if it is at all accurate then now is a very good time to increase pressure on Google, not decrease it.

So I think we might be in a situation where the onus is on people proposing compromise to prove that compromises will make a difference, because I don't take it for granted at this point that FLoC's acceptance or rejection will change anything about how 3rd party cookies are handled in the future.

[0]: https://github.com/privacycg/first-party-sets

> Will FLoC speed this up?

If you look back at Chrome's original announcement about phasing out third-party cookies, they are explicit about replacements like FLoC being how it happens:

"After initial dialogue with the web community, we are confident that with continued iteration and feedback, privacy-preserving and open-standard mechanisms like the Privacy Sandbox can sustain a healthy, ad-supported web in a way that will render third-party cookies obsolete. Once these approaches have addressed the needs of users, publishers, and advertisers, and we have developed the tools to mitigate workarounds, we plan to phase out support for third-party cookies in Chrome. Our intention is to do this within two years." -- https://blog.chromium.org/2020/01/building-more-private-web-...

(Disclosure: I work on ads at Google, speaking only for myself)

Running a content site with a premium ad network (Cafe), they seem pretty affirmative about RPMs dropping later this year once Chrome phases out third-party cookies. They aren't really saying this will only happen once an alternative solution is found.

I could see ad agencies start to buy well-known https endpoints per client domain that makes 3rd party cookies into 1st party cookies. This whole problem isn't going way -- it is just going to shift.

Yup. Instead of adcookies.adco.com, it will become adcocookies.<populardomain>.com. Also there are lots of other ways to fingerprint a person. I'm 99.95% sure google wouldn't commit to supporting the end of 3rd party targeting cookies if they didn't have a plan for sustaining their ad revenue.

Google's whole business is selling ad data from their first-party cookie.

This is nothing but another anti-competitive move from the Google monopoly.

It's really the other way around. Major browsers have decided to phase out 3rd party cookies (with some pressure from outside forces), so now advertisers are scrambling to find alternatives. Whether or not FLoC catches on is related to whether or not it's a good alternative -- there are others out there. It's not driving the demise of 3rd party cookies, but if 3rd party cookies become useless for targeted ads, then FLoC is one of the contenders to fill the space.

Why do you prefer empowering Google even more to walled garden model?

Walled gardens are good, at least in that there are several of them. This means the Web as seen by the average consumer is still somewhat decentralized.

I'm minority as well, as I think that targeted ads are important for the Internet.

First of all, I think that ads in the Internet are important, it's a driving force. Without ads there will be no Internet with lots of "free" resources, everything valuable will be paywalled which is a problem for poor people and nuisance for the rest. That's already an issue for many information websites because of abundant adblock usage and those websites are paywalling their articles.

If ad is not targeted, you'll get terrible click rate for niche ads. So your advertisement budget will cost more and some businesses just won't work, as you won't be able to attract enough customers for reasonable budget. Another issue is that advertisement budgets are paid by customers and inefficient advertisement lead to higher costs of the end product.

It's basically like TV where ads cost a lot and small players just can't afford it. And that's because those ads can't be targeted.

Because of mentioned issues, I think that targeted ads are needed for the Internet, they're making world a better place in the end.

Google clearly tries to find a balance between privacy and ads targeting. And that's a good thing. May be FLOC is not perfect, although I'm not sure if it could be implemented in a significantly better way. But just disregarding targeted ads for me sounds like a wrong solution. What should be done is regulation of advertisement platforms which should be prohibited by law to track individual users and just use anonymized information, voluntarily provided by the user agent.

And those who don't like FLOC idea, probably will be able to use browser extensions to modify its behaviour.

>I'm minority as well, as I think that targeted ads are important for the Internet.

Citation required.

Not one Ad was required for the Internet to be useful. Hell, the WWW started as a bunch of hobbyists sharing info about what they liked. Google's killer product their search index. Not Ads.

I don't need to pay anyone for me to host something aside from the domain name, and a connection to an ISP. I just have to want to host it. The rest of the world at some point decided the Net MUST be monetized. Cookies came soon after, then JS, then all the familiar trappings of the web as a monetized medium.

Note; it becomes relevant for scaling or platforming to be able to be paid, but evven then, there are other ways to do that besides selling everyone else's privacy, comings and goings, etc.

Once you add money to something, you lose anonymity and safety from surveillance. No one would care one iota about what went on in Cyberspce if there wasn't a buck to be made.

I miss those days so horribly. Information shared and organized for it's own sake...

You're requiring a citation of a person's thoughts?

I never said I was practical. Or in that case apparently paying as much attention as I should have been. Happy Friday everybody!

Well the internet was a lot more useful, and pleasurable, before targeted ads were a thing. So I’d quite like to know how you came to that conclusion as well

You're so right. I miss the old internet.

And yeah hosting is so cheap the cost of it is pretty irrelevant per user. Definitely not necessary for tracked ads to pay operating expenses.

However content creation might take more money. And the whole marketing, admin etc circus at most sites.

> First of all, I think that ads in the Internet are important, it's a driving force. Without ads there will be no Internet with lots of "free" resources, everything valuable will be paywalled which is a problem for poor people and nuisance for the rest.

Wikipedia might just be the most valuable information resource there is with the Stackexchange network also ranking highly. The former has no ads and the latter has a negligible number. High-quality traditional media are often already pay-walled.

"It seems like many consider the alternative to FLoC to be an anonymous web where content can be accessed without login."

I consider the alternative to FLoC as no FLoC. I consider the alternative to 3rd party cookies as no cookies. I can read HN just fine without 3rd party cookies. Or FLoC.

Developers, paid from advertising budgets, may be eager to comment and share their opinions on these matters but, let's be honest, they themselves are making such comments via a website (HN) that has no requirement for 3rd party cookies. What is good for the goose is good for the gander.^1

If cookies must be enabled to make a purchase or login, then I will enable cookies and accept a cookie, but only from that website and only for that purpose. However the requirement for cookies in these specific situations^2 has been taken as license for "modern" browser authors to make "cookies enabled" a default setting. This has been abused to no end.

1. I am commenting as an end user. I do not rely on the existence of online advertising to make a living.

2. It seems to me that the real problem here, the one which we should be trying to solve, is that web developers have no available solution for "shopping carts" and logins other than to use cookies. (Maybe the web was not designed for commerce.) Instead, Google is proposing a "solution" that makes business better for Google and its customers (advertisers, not end users), while making business more difficult for any company hoping to gain insight into end user browsing habits, except Google of course.

"... an anonymous web where content can be accessed without login."

It is always interesting how comenters make the jump from one company's software (e.g., Google Chrome) or website (e.g., Instagram) to "the web".

The web is more than a handful of "tech" company monopolies that rely on advertising to exist. It is a medium, not a set of commercialised content. I starting using the web before Google or Facebook existed. Before user contributed content was usurped by "tech" companies to sell online advertising services.

Today, I still get nearly 100% of content from the web without ever logging in to any website. Without Javascript, and without cookies.

If one takes comments like the parent at face value, then this should be impossible.

You can block 3rd party cookies today. In my experience it breaks less than 1% of sites and those that break can be replaced with other sites.

> It seems like many consider the alternative to FLoC to be an anonymous web where content can be accessed without login.

How do you arrive at this conclusion? Authentication does not depend on third party cookies. Third party cookies are used to track visitors across multiple sites, independent of authentication to the first party site. I haven't seen suggestion elsewhere that third party cookies are about anything else.

You: Here's a cute picture of my cat, I'll post it on Instagram for my friends

Instagram: cool! We're showing this to all your friends. BTW it costs us money to do this but don't worry, we don't charge you, we just show some ads to your friends.

You: Hey, my kitten is really popular, a lot of people are liking it.

Instagram: High five! You're popular. We ended up making a lot more money from selling ads than it cost us to show it! Thanks!

You: wait, that was my cat picture, where's my cut?

Instagram:

Your “cut” is having a place to store, view, and share your cat photos online.

The web only has two business models: users pay for a service or advertisers pay for a service.

I’m all in favor of paying for services, but it turns out most people prefer ads to breaking out their wallet.

This always gets said, and I don't exactly think it's untrue, but it carries this strong implication that the problem is that people are too cheap to pay.

And I'm not sure that's entirely true.

My own pet theory is that - payment method and model issues aside - the largest contributor is the uncomfortable questions it makes us ask ourselves.

When you pay for something, you ask yourself if whatever you are buying is actually worth the price. And a lot (most?) of what people seem to do on the web these days is feed their dopamine as much novelty as they can, as quickly as possible.

I don't know how much value people are expecting to get out of their browsing activities. Do they even think it's actually worth the time, if they stop and think about it? Asking them to pay for it is forcing them to confront this issue.

No wonder nobody pays.

The social media services like us to think the users (people with the pictures of kittens) don't add any value individually. The let us believe that it's the network effect, plus their infrastructure, that is the value, and because those wouldn't exist without the service, that is what generates revenue. But of course individual users add value. Without people sharing their kitten pictures, there'd be no network, no content, worth selling ads around.

For ad-supported social media, we're all just unpaid labor and we're told that labor has no value anyway.

Of course, by selling that position, they've also convinced the end user that the service is not worth paying for. But when there's nothing the end user wants to pay for, and ad revenue drying up, social media services will have to pivot to make money elsewhere.

The end result, not surprisingly, will result in a mixed model of subscription and ad revenue supporting content that the service has, in some way, paid for. Sound familiar? Of course, the end user will still not be paid for the labor contributed, but then the less the ad revenue depends on the user-generated "free" content, the closer the value of that labor tends to zero.

Your cut is the free hosting and services... and both you and Instagram are subsidizing the people who use the service and don't generate many views.

Anonymous web makes sense. The very idea that we need an ad profile that follows us as we traverse the web is ridiculous.

Contextual advertising works. Visit a popular website covering PC hardware .. and advertisers can pay to put ads to parts, chips, cases, etc. Visit a website that covers hiking trails and companies can purchase ads for camping gear, travel lodging, etc.

The very notion that it should be normal for an ad profile to be built around everything I do on the web is frankly dystopian and depressing.

And even that's a second order thing. Even if Patreon (or hey, onlyfans) aren't the dominant model now, I'm fine with breaking nearly any invisible system of content payment in favor of visible ones just to see what happens.

At this point, I think it's become a "too big to fail" argument for the industry.

We have several near-trillion-dollar companies that basically have no viable business model other than doubling down on targeted advertising. If third-party cookies get demonized or GDPR'd to death, they need to pivot to SOMETHING else that still fits into the same profiling paradigm.

I suspect it's not about results or innovation anymore, it's about being a moat. Only a trillion-dollar company with huge scale and scope can possibly build and maintain "high quality" profiles, so it's a great way to spread FUD against any competing, potentially actually privacy-first, ad-tech upstarts.

I'm sort of waiting for the "Emperor has no clothes" moment. We see the occasional "Brand stops advertising for 6 months and sales stay on trend" story, or the "our best conversions come from real content and relevant direct ads" story. We have the fact that ad spend grows and yet publishers starve, implying the middlemen are taking an ever-larger chunk of value out of the ecosystem in exchange for their services. It's gonna be ugly when the dots are joined.

I believe ads work — but I’ve seen little evidence anything beyond contextual ads work.

But yeah, show someone on a blog about new GPUs an ad to buy a GPU and there’s an uptick. Turns out some of those people do want to buy GPUs.

Showing me an ad for GPUs on the YouTube page for cat videos because I visited that blog previously is weird.

Like a friend going, “so looking at these cats reminds me — do you want my friend Dave’s GPU?”

I understand your point. Though when email campaigns came out the goal was to send the email to everyone. Then it was to target people. I think that targeted emailing obsession then led to the natural conclusion of targeted adverts on the web through personalisation. I'm not sure the ROI on the adverts is what companies think it is. Just like it isn't for email campaigns.

I feel there may be a better market like roody15 has said for contextual analysis of websites and provide adverts based on that. Enhanced with Anon user traffic and buy paths. Which could slowly overtake if done well.

Also on the effectiveness: https://thecorrespondent.com/100/the-new-dot-com-bubble-is-h... https://news.ycombinator.com/item?id=21465873

https://www.mercurynews.com/2018/10/16/facebook-lured-advert... https://news.ycombinator.com/item?id=18234626

Then if you cross reference this with how procurement works, bullshit jobs and similar (can't find that article) starts to make some sense.

Though there may be arguments such as manipulation as to why the focus is on the advert personalisation and not the nefarious things that can come out of it. Think McCarthy. https://en.wikipedia.org/wiki/McCarthyism#Blacklists

Regardless of your persuasion consider if the other side gets in and you end up on the black list.

'I don't mind adverts tracking me' vs 'I can't get a job because of X opinion'

Is it just me, or is FLoC simply an act? A way for Google to say, "See, regulators, we're trying! You don't have to regulate us, we're doing it on our own!"

While they know full well the web will never get on board with this.

Seems like just a way to buy time, to muddy the waters. Make the ecosystem more complicated. Pin the blame on others for not getting on board with your attempt to "fix" the situation. "We tried our best, but Mozilla won't join us!!"

I don't agree with this, but there is evidence that kind of supports it. The W3c group set up to build on privacy sandbox that came up with floc/petrel/etc wrote an open letter to the w3c advisory about how google was refusing to work with the group.

https://www.theregister.com/2020/07/17/aggrieved_ad_tech_typ...

Kinda Gates or Ballmer era Microsoftish?

If it is, it's a pretty poor act. It doesn't matter if Firefox, Brave and Edge don't want to use Floc. Google controls Chrome and almost all of the non-FB digital ad ecosystem. They can still derive enormous benefits from it once third party cookies are extinct.

The way I see FLoC is that it's nothing more than a compromise.

This isn't a web standards feature like WebMIDI or WebHID that fulfills the (ever expanding) requests for features from web developers. It isn't a feature that the average user would ever ask for. It's simply a way for Google's ads business to continue functioning in spite of a web community that is gradually becoming privacy-conscious.

"Okay, it is true I can do nothing to force you to eat this pile of poo and I have nothing as means of payment, but let's make a compromise: How about you eat half?"

How about no, Google?

DRM made its way into browsers only barely, and in that case they at least had something people wanted.

> DRM made its way into browsers only barely, and in that case they at least had something people wanted.

What did DRM have that people wanted?

Netflix.

People are giving out about browsers and devices not supporting widevine now :(

No it's much more than an act it's a way for Google to keep doing business as usual while skirting regulation, and at the same time establishing a monopoly on the advertising technology of the future. Because Google will be the gatekeeper of FLoC. Whereas with cookies they're just one of the players, albeit a huge one.

Your can bet they will throw every bit of lobbying power they have at this. No wonder some larger companies like Microsoft are not giving a hard NO.

Just have it default-off, allow the user to turn it on if they want to be "ad targeted".

I mean I keep hearing how, as a consumer, I want this.

As a consumer, i want targeting features default-off.

As a consumer, I want targeting features default-on, but I also don't mind too much having to turn them on manually.

why do you want them default on?

I am okay with targeted ads, and I know others are too. The other day, my Dad said he's happy that Amazon and Google are showing him the products he's been browsing for recently. They bought a mattress and are looking at buying another to replace the other beds.

I think it's pretty simple. drusepth wants targeting on, so of course drusepth also wants default on. It is generally desirable for defaults to match what you want since it saves you effort to configure.

I'd guess the majority of people don't hold a strong opinion on them one way or the other, and being default-on for more people results in more data that can be used to make ads more relevant for everyone, instead of just relying on whatever subset of users actually know to opt in.

The thing is that I could actually see this working, because advertisers and publishers would have to incentivize people for turning the feature on. If it became widespread known that turning targeting on resulted in seeing relevant 10% discount ads a lot of people would give up privacy for that, probably for less.

You can see this behaviour in the success of browser extensions like Honey which are privacy nightmares to people like us, but totally acceptable to most people.

I've spoken with more than 1 non-tech person who has said if they're going to see ads, they want them to be at least relevant, targeting nor not.

Surely they'd be happy to opt-in to FLoC.

I've blocked ads for so long that I can't remember the last time I saw one. However, if I had to have them, I think I could tolerate ads that were relevant to the content of the page.

If I'm reading an article about gardening, I could understand seeing an ad or two about gardening tools. It's what my mind is focused on, it's relevant, and it's even potentially something I might want to buy. This doesn't require FLoC, cookies, or any other form of tracking.

What I do not want to happen after reading my gardening article, is to be dogged relentlessly for days with ads for gardening tools on every website I visit, and in apps on my phone. It's creepy, it's irrelevant to what I'm currently focused on, and it's creating a negative impression in my mind about the businesses that are appearing in the ads.

There is no evidence tracking-based ads are more fruitful than contextual ads. That is what you should tell your non-tech person.

If you're going to hold a gun to my head and force me to give you the contents of my wallet, you can at least be polite about it and say please and thank you.

If I have to be on the receiving end of non-consensual sex, I at least want the perpetrator to wear protection and be STD free.

The particular phenomena at play there is an early stage of Stockholm Syndrome/learned helplessness, and it isn't a good thing. It is also a byproduct of intentioned shaping of dialogue and expectation normalization that has been an ongoing effort by Big Tech for decades.

Don't be fooled.

I don't understand why isn't this default already. Why do I need to install add-on for google not to track me? Shouldn't it be exactly opposite, install one to allow them to track me?

People say how they hate surveillance tech, but at the end of the day, it pays half of the bills on this website.

Most probably, there is Google Analytics and Facebook pixel on the very site you are building right now.

So all these horribly, horribly outraged comments ring kind of hollow to me. I mean look at how many trackers are on The Verge site itself.

Yeah FLoC is horrible. I hope it dies in a fire.

It's just, people that build websites want tracking. And it works. Retargeting works, banners work. That's why it's everywhere, nonstop. We all do it, we secretly crave all the tracking data from our users. We are addicted to A/B testing and referrer tracking and ad revenue. So, I donno.

There is a reason why Google does this.

> People say how they hate surveillance tech, but at the end of the day, it pays half of the bills on this website.

HN has surveillance tech?

> Most probably, there is Google Analytics and Facebook pixel on the very site you are building right now.

Nope. I haven't used any of those since 2016. None of the apps I build for iOS have third party analytics, trackers or even ads. I solely rely on a single one time only in app purchase for monetization. Even my OCR app does all its processing locally on the device itself and none of the data leaves the device. I have a mood tracker app which obviously has a lot of intimate, confidential and private data from users - the data stays on their device and if they use iCloud syncing, then to Apple's server (despite all of Apple's flaws, they do seem to be doing much better when it comes to privacy). I have a school timetable app which also has lot of confidential data. Same thing on that app too - everything stays locally on the device or iCloud if user chooses. I DO NOT want user data. I have a site which is a resume builder which users input a lot of confidential data. Even that site never transfers any of the user data and everything is stored locally on the browser. There isn't even any ads or analytics on the site as can be confirmed by sniffing network requests. I had to spend couple extra weeks to get the PDF generation done locally in the browser instead of sending the user data to some server. This took extra time but it was worth it because I DO NOT WANT USER DATA. My Hacker News client app also has the same attention to privacy. I disclose to the user in the privacy policy that the only time the app accesses my own network is when it needs to fetch the favicon for the articles and I don't log these requests. I plan on adding notifications to that app and I will be disclosing that in the privacy policy that I will need to store the device token to be able to deliver the notifications. And the notifications will be opt-in so the user knows what data they are giving me to store. Other than that, I won't be using this for any tracking or other purposes.

Obviously I am aware I can make a lot more money if I put ads and trackers etc but I have been at a point for many years now where I would lose money and business if it means I get to starve the beast of some money. My customers appreciate my privacy policy and often email me or leave reviews appreciating the privacy policy. So there's a market for it (less money though and I am fine with that).

https://apps.apple.com/us/app/hack-for-hacker-news-developer...

https://docs.google.com/document/d/1Cb282k7rrSi4awr0HizuRciX...

Here's another example of my resume builder's privacy policy:

https://resumetopdf.com/privacypolicy.html

Here's privacy policy for my MoodWell mood tracker:

https://docs.google.com/document/d/19bIdiLwlnQxSIASNatVz8UpI...

https://docs.google.com/document/d/1f05TVHqZPnj8aM1d0b6y6u6H...

Simply saying one cares about privacy and users isn't sufficient. I think one has to really want to make less money and also have bitter feelings towards the beast to purposefully starve it if they want to care about user privacy.

> HN uses surveillance tech?

HN is fully funded by Y Combinator. The suggestion is that YC make half their money from surveillance tech, but I can’t speak as to whether that is true.

Fair point. I see what OP means now. Though that is like saying one won't use React Native or Flutter because it's made and funded by FB and Google.

> people that build websites want tracking. And it works. Retargeting works, banners work.

do they? I've never once bought anything because and ad made me aware of it, or because an ad convinced me I needed it. not once.

has anyone? I'm sure someone has, but how many? I would not be surprised if studies were done that computed a purchase rate overall for all the ads people see or hear in their lives, that the number is less than one purchase per billion ads exposed.

One thing to note is that the purpose of ads might not just be to get you to directly click on it and buy something. It might also be to make you remember the brand name so the next time you think of lets say baby diapers, you remember "Huggies" because they are the most advertised ones even though there are better and cheaper alternatives.

As for how impactful the ads are - you don't need a study. Simply run an ad and you will know how many people click your ad and how many then follow up with purchasing. That's where terms like cost per acquisition (CPA), customer acquisition cost (CAC), cost per click (CPC), Cost Per Thousand (CPM) etc come into place.

https://www.investopedia.com/terms/c/cpm.asp

It's not one purchase per billion ads. You can look up google Adwords cost per acquisition by industry (WARNING - might be blocked by ad blocker):

https://www.wordstream.com/blog/ws/2016/02/29/google-adwords...

Cost per acquisition on the app stores is much cheaper too.

There’s a saying in finance, the more complex a financial product is, the more money banks make on it.

I feel it quite aptly applies to advertisement industry as well. Massive amounts of complexity and red tape over getting people to buy things

Honestly wondering why this is getting downvoted, if it's not against the rules to wonder.

I hate targeted ads as much as anyone, and I don't buy the ad tech bs that they are vital to human survival, but I think the GP is a bit naive to think that ads have no effect on them.

There's long-standing research that people unconsciously prefer familiar things, so exposure to ads is enough even if you don't remember it.

https://en.wikipedia.org/wiki/Mere-exposure_effect

Of course if you would have never ever bought something, an ad is unlikely to make you change your mind. Same if you do thorough research on what to buy, you're probably not swayed by familiarity. But claiming that they have no effect is a bit naive.

EDIT: I guess GP never claimed that they have no effect, but what I'm trying to say is that ads probably have a bigger effect in people in general, and even to you personally whoever is reading this, than you'd think. Targeted ads though? I hope we can live without them.

> to make you remember the brand name [later, while not viewing any ad.]

maybe, but that seems so untraceable that it wouldn't be worth the effort to even think about. but, ad people definitely think differently than I do, so who knows what they think about every day.

Yes, retargeting and tracking is extremely effective.

You've fallen into what I'm gonna call the "HN fallacy".

- I would never click on an ad, therefore no one clicks on ads.

- I don't have a need for a better file syncing UX, therefore no one would ever use Dropbox.

- I don't see the point in crypto, therefore no one would ever use Coinbase.

Specifically, let's say you've seen 100,000 ads in your lifetime and literally zero have had any impact on you, much less driven you to click through and purchase immediately. It's reasonable for you to question the utility of these ads.

There are, however, entire populations of users whose behavior is vastly different from yours. They may be very willing to click through an ad to purchase.

A good marketer will only target their ads at the people most likely to purchase (i.e. not you). This puts you on a negative feedback cycle where you only get ads from companies that are spray-and-praying or too unsophisticated to target their ads more specifically.

I've been told this my entire life. People make statements like "everyone does X" and I say "really? I have literally never done X in my life and I know many people who say the exact same thing; in fact I'm not sure I've ever met anyone who does X" and the response is "yes, but you're different from everyone else. You and everyone you know are not like most people!" I find it extremely unconvincing.

> People say how they hate surveillance tech, but at the end of the day, it pays half of the bills on this website.

It seems to me that HN is a gateway to advertise a bigger platform. It's more of a win-win situation than a "you're the product" kind of thing. Also right now µBlock Origin and Privacy Badger are blocking nothing.

And with more and more content producers soured by Big Tech creating their own private subscription based websites or opening semi-private platforms I wouldn't be surprised if we will see a decline ads revenue in the coming years.

These browsers make up less than 4% of market share and their actions are largely meaningless. Only fringe users (IE readers of hackernews) use these browsers.

If you're looking for info on adtech changes outside of chrome, look at safari. Apple has been making big pro-privacy moves for a couple years, and they actually have meaningful market share.

Safari is the browser for iOS, so your 4% number is not accurate.

Not only the browser for iOS, but the only browser that run on iOS.

It’s the only browser engine, but do all of the privacy protections carry over to iOS versions of Chrome, Brave, Firefox, or Firefox Focus? They all seem to have really different approaches to advertising and tracking and cloud syncing of user data.

Safari is one of the browsers mentioned in the article.

I don’t think the demise of 3rd party cookies is going to be the boon for privacy some think it will be. Marketers still want to advertise and track performance of ads and are all moving to first party cookies with Facebook and Google and other mar-tech vendors. This could lead to leakage of data as it gives anyone let into the fist party domain access to all the other tracking identifiers.

>I don’t think the demise of 3rd party cookies is going to be the boon for privacy some think it will be. [...] This could lead to leakage of data as it gives anyone let into the fist party domain access to all the other tracking identifiers.

Not really. They can still track users across visits, but they can't track users between websites. That's the privacy improvement.

This is actual blog by google https://blog.google/products/ads-commerce/2021-01-privacy-sa...

and it says "eliminate third-party cookies by replacing them with viable privacy-first alternatives, developed alongside ecosystem partners, that will help publishers and advertisers succeed while also protecting people’s privacy as they move across the web."

Am I the only guy who is distracted by the blog which uses 13 third party cookies on the same page? Interesting!

Is it just me or does that statement read like a PR virtue signalling? They are almost trying to change the meaning of privacy with that statement. If they want to eliminate third-party cookies but replacing them to achieve the same goal as the third-party cookies (help advertisers), then nothing is actually changing.

Rant ON.

Third party cookies are surveillance tech. So is FLoC. There is no need to track a person from one web site to another like some stalker. Any tech to stalk people like this isn't a good idea in general.

This is antithesis to multiple business models. I know. But I see no reason to accomodate faulty models. Ironically however, I'm not against advertising. But my experience with targeted ads is that they are useless anyway. I remember having gone to plenty of websites searching for very specific but commonly bought car parts. Google had full transactions as I wandered through various websites. Google searches etc all that data along with time of day. Did they provide useful ads? No. Really? That was with third party cookies enabled. I've been looking for parts and am actively buying parts and yet no useful ads, even from parts competitors? All that tech and I'm still having to dig around for suppliers? What about tools? Nope. Not a single relevant ad. Even with access to my search history. Not even when I have purchase receipts emailed to me. Amazon footprints, emails etc going to gmail. Searches done while logged into chrome.

Can't help the feeling that this stalking actually has little to do with real advertising and is more about authoritarian ideals. Real advertisers would have an advertising arrangement set up with each website. Then just cross reference the first party cookie ids in aggregate. Third party cookies were never necessary. So this leaves us with the third party cookies purely for stalking purposes.

So I gave up. Now I just use ddg and figure that the tracking is purely for surveillance. I have no guilt now in dropping third party cookies.

Perhaps, instead of using surveillance tech, why can't I tell google search I'm doing a project involving cars. And it goes and does its correlation magic to explore what I actually use and need. It could do actual linking. Show me actual suppliers. Affiliate links. I could add additional searches and attach them to the project as well. Eg add a line item for insurance, etc. now google knows I need insurance as well. Show me options. More opportunities...

But that would all be useful. It would help advertising and drive sales.

And this tracking is really about surveillance, isn’t it...?

I absolutely agree with your statement.

Anecdotally, the majority of targeted ads I see are for services or products I already use or pay for! That makes no sense to me. It does not drive loyalty, it simply annoys me. I’d opt out in a second if possible. Please give me contextual ads.

That's because underneath there's a primitive Bayesian engine with a simple rule of

    P(buying crap on the Internet) < P(buying crap on the Internet|already bought crap on the Internet)

there's nothing intelligent going on under the scenes and a massive tracking setup isn't needed here.

(And yes, the massive tracking by Google, Facebook et al isn't really for advertising purposes. It's so they are prepared to pivot from adtech to the much more profitable govtech, a la China's social credit system. TV advertising is actually much more targeted than web advertising and they do it with practically no tracking at all.)

Whether targeted ads work well from a user perspective is irrelevant to Google and FB. These companies only care about whether their ad tech can drive user engagement in such a way that advertisers think targeted ads work well.

After all, the advertisers are paying the bills.

If I was a paying advertiser I'd be angry that customers didn't know about my internet business, especially when the customer buys 10k in parts from a bunch of other suppliers and not me.

Its advertisers that should be angry.

As a website owner, you can opt out by setting the Permissions-Policy header to "interest-cohort=()". I rolled that out for pirsch.io today.

Cmon, this is as backward as the "do not track" header... asking websites to explicitly opt out... in order to protect users from the users's own browser!?

No, just don't build stupid things into browsers.

Yeah, it's stupid, but the only option we have right now if the user does not disable FLoC in Chrome. We also honor the DNT header btw :)

Chrome users should just run a local proxy that inserts the header for them.

That is a good solution for corporate networks.

Chrome users should seriously reconsider switching to Firefox. We've created another Internet Explorer.

So, I was experimenting with this concept yesterday but couldn't get it to work...

How do you set up a local proxy to do this kind of stuff? I got up to the point of changing request/response headers but couldn't manage to actually edit the data going through, esp when dealing with ssl (which is the point really, of ssl).

mitmproxy

Let's say, Chrome has a bug that causes a crash unless you send Workaround-Chrome-Bug header. Why wouldn't you send the header until the bug is fixed in Chrome?

How is this situation in any way different?

Because the intent is the complete opposite, to add, not remove the bug... what else are they going to add, how many more headers are we going to end up with, what if the other browsers join in... this is not sustainable, but it's not supposed to be - they are betting on the fact that 99% of website owners will not even be aware of this issue let alone know how to configure their web server or be bothered to - it's purely for the purpose of saying "we allow you to opt out".

Saying "oh but we can thwart them with a header" is just naive, Google would like you to believe that. Look at the bigger picture.

How about sending random awkward cohorts to the browser ? If we are able to make targeted ads to be only about dildos and viagra, maybe we can increase Adblock usage drastically ? (While helping people with real erecting issues as a side effect)

If FLoC ever becomes standard in Chrome, I'm definitely going to search for a way to sabotage their statistics by giving fake or random data points.

Would it be viable to also add a pop-up asking users to toggle Chrome settings or use another browser? Something like Google has on its homepage for downloading Chrome when visiting from another browser.

I don't get it. Couldn't you also just... not record any cohort information that is sent to you? (Admittedly I have not looked very deeply into FLoC.)

GP seems to be misunderstanding how floc is implemented. If your site doesn't call document.interestCohort(), the site isn't factored into floc calculations.

https://news.ycombinator.com/item?id=26834624

Chrome has 65% market share, even if "nobody' joins, still it's a strong majority of users that have FLOC enabled

Aren't IP header fields granular enough for most tracking purposes?

On mobile, you can do interesting things with Header Enrichment, which helps even more.

IPv6 should "just work", but it seems there's fingerprinting available.

That leaves residential IPv4, which you can solve with some coordination between site owners.

This seems to say - Yes?

https://www.sans.org/reading-room/whitepapers/testing/paper/...

https://en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting

Once you get some sort of fingerprint, then all that's needed is for one site to share with another and they're back to tracking across devices and sites.

> It uses an algorithm to look at your browser history and place you in a group of people with similar browsing histories so that advertisers can target you.

No, just no. Just because cookies are a necessary evil that is being abused doesn't mean normalizing the abuse makes it not abuse. Also the normalization of unacceptable behavior only makes things worse since it implies permission.

I just want stuff that remember my settings and logins as for the rest just leave me alone.

Is FLoC considered more or less invasive than the advertisement ID used by platforms like iOS and Windows 10? I believe these systems are also opt-out.

iOS is now switching to opt-in.

Hopefully this isn't a new Coke kinda deal, where they are gonna reverse this idea, and secretly kill adblocking a little more.

Advertisers are gonna advertise!

We just need to find ways to stop them invading - and by extension, controlling, our lives.

Google's ~64% market share is bad enough as it is. Android being the dominant OS helps, I guess.

Does this affect Chromium at all?

Try running your Chromium with these flags[1] and see what that page says about it. If it says anything other than "not supported by this browser" then Chromium supports it (may not be enabled by default though).

[1] https://floc.glitch.me/

FWIW, I've been blocking all 3rd party cookies in Firefox for years.

Yes it's the first thing I do when I install a new browser. I'm not sure how well that protects me from tracking but I do notice that the creepier kind of stuff stops happening. I've also noticed that it's been getting harder and harder to find and activate the third party cookies block with successive version of Chrome.

Very good news. It might even hurt Chrome's monopoly.

Because the 3rd party cookies are still here.

...Google's FLoP

No wonder, it's a dead-hug for everyone but Google.

Good

I just googled that FLoC stands for Federated Learning of Cohorts ... excuse my superficial knee jerk reaction but I feel like nothing good can come from something named like that.

Between FLoC and AMP, Google's attempts to destroy the web have surpassed even IE levels of toxicity. It's good to see the consumer focused forks of Chromium take a stand here.

There are still Firefox and Safari free of FLoC

Using any version of Chromium still contributes to Google’s attempts to destroy the web. If they actually cared they would use a different engine.

You say that like there's another option.

Firefox is a good option!

Firefox is the FreeBSD of browsers. Only good for very specific reasons as compared to Linux (Chromium).

Been using firefox for years and haven't encountered a single usecase-breaking issue. Can you explain why you feel that way?

And I'd add the only subpar-in-Firefox issues are caused by Google "accidentally" crippling performance of their pages/services, coupled with others optimising just/primarily for Chrome.

(But also, what Mozilla has been doing to Firefox last few years if both a travesty and a good thing.)

Well that's incorrect. I only use Firefox at home. Works fantastic.

I'm not saying it's bad (FreeBSD is good too), but there's no denying it's pushing itself into a niche corner.

What niche corner might that be?

A poor imitation of Google Chrome. Firefox could go off in it's own direction, but it doesn't.

Hardly. It’s been around for longer than Chrome, and Chrome has copied many of its features.

In terms of what it does well, it’s far better than Chrome. Fencing alone makes it better for almost everyone.

And what's Firefox, chopped liver?

Isn't it? Marketshare is cratering, it's not keeping up with Chromium and Safari, and the Mozilla foundation is the poster child for dysfunctional organizations. Thank god it looks like Rust has escape from Mozilla and how has a nice support network of its own.

Do you honestly see any signs of Firefox's situation getting better and not continuing its free fall?

You claimed it was not an alternative. But it is an alternative; I use it all day every day at work and at home, and I have for years. It's obviously working.

Market share has nothing to do with whether something is an option.

I'm really curious how these alternative browsers (including Edge) went about choosing which engine to fork. You'd think these piracy-focused browsers would opt for forking either WebKit or Gecko.

Reply on news.ycombinator.com