Google considers switching FLoC to a topic-based approach, as exec acknowledges cookie replacement has fingerprinting potential

google reaper

Now that Google has postponed its plan to disable third-party cookies in its Chrome browser, the digital ad giant may be considering a transition away from the cohort-based ad targeting approach to a cookieless system oriented around topics.

A lead engineer helping guide Google’s Privacy Sandbox development has revealed signs of what may be next for the firm’s most advanced cookieless ad targeting method. The potential update of the Federated Learning of Cohorts targeting technique detailed at a recent engineering research event would involve assigning topic categories to websites and people rather than assigning opaque numerical cohort IDs to them. Even if the company does not go forward with the approach, consideration of the change indicates a recognition inside Google that the original version of FLoC was not only opaque to the ad industry but also presented new privacy infringements for users.

“It might make sense to stick to topics instead of cohorts,” said Josh Karlin, a tech lead manager of Google’s Privacy Sandbox team in its Chrome browser division at a July 26 Internet Engineering Task Force meeting. A video of the meeting was published on YouTube and is embedded below.

During a 20-minute session, Karlin explained how an updated version of FLoC could enable interest-based ad targeting without cookies. To do so, the algorithmic system might generate topic-centric IDs associated with subject matter on websites people visitthink “performing arts” or “fitness” — as opposed to assigning an opaque numerical cohort ID, which Karlin said “was still hard to express and still hard to understand.” Despite the apparent incomprehensibility, FLoC’s original cohort-based approach raised some clear red flags among privacy advocates for how they could be used to identify people, and those fears turned out to be fairly well-founded.

“Nothing has been decided yet,” a Google spokesperson told Digiday regarding future versions of FLoC. The company concluded testing of the original iteration on July 13 and plans to incorporate feedback from the web community into future versions before launching updates for testing.

Adopting a topic-based approach could give advertisers, ad-tech firms, website publishers and people a clearer understanding of how ads are targeted through the technique. “Topics have a number of advantages over cohorts. Users can see what’s being said about them and understand it,” said Karlin. 

Though Karlin did not go into extensive detail on how the browser-based FloC process would change, he provided some clues:

  • Google might assign a site topic based on a variety of interests reflected by the sites people visit in a given week.
  • As opposed to choosing from thousands of cohort IDs, topics would be derived from a much-shorter list of publicly-available, standardized topics akin to the Interactive Advertising Bureau’s content taxonomy. “Say, 256 topics as opposed to the roughly 30,000 cohorts,” Karlin said — which would make them less useful when connecting with other types of data in order to identify people.
  • People may be able to opt themselves into or out of topics assigned to them.

In general, many observers and industry stakeholders are in the dark about the concept Karlin introduced at the meeting, and Google does not appear to have formally introduced the new topic-based concept to participants in the Worldwide Web Consortium forum where Google formally operates its Privacy Sandbox initiative. 

“It’s possible that the next version of FLoC will work much the same as the recent origin trial, except that they’ll use topics or keywords from the page instead of, or in addition to, domain names,” said Don Marti, vp of ecosystem innovation at CafeMedia, who keeps close tabs on Google’s Privacy Sandbox efforts. However, he said, “I don’t know anything about how the next release of FLoC will be different from the last one.”

FLoC facilitates fingerprinting 

The topic-centric approach Google is mulling, at least in part, is aimed at quelling privacy concerns. Karlin himself acknowledged that, by generating new data points, FLoC IDs could be used to enable fingerprinting techniques that piece together someone’s identity.

“FLoC adds new fingerprinting surface, and that’s true,” said Karlin. He said the topic-oriented update “can dramatically drop the usefulness of FLoC for cross-site fingerprinting.” He said the new approach could impede fingerprinting methods because it would reduce the number of “bits” of information or signals that might have been used to detect identity with the older version. Adding random topics to a site is another way an updated version of FLoC might mitigate fingerprinting capabilities, he said. 

“Google might be switching to a more topic-based ID, because I think the demand is there from advertisers to understand interest behavior, and it might deter companies from trying to enrich the cohort IDs themselves,” said John Goulding, U.S. head of strategy at MiQ, which builds tech and offers services to help agency and brand clients conduct programmatic ad campaigns. “This is a good thing because if publishers or ad tech companies had tried to ascribe interest behaviors to the old cohort IDs, that could have risked undermining the privacy protections of the whole framework,” he said.

The original FLoC approach came under fire from privacy advocates who argued that, instead of targeting ads in a way that safeguarded people’s privacy, it created new ways for companies to track and possibly even identify people. Throughout development of the technology’s original iteration, Google publicly pushed back on privacy-related criticisms, and said the firm would mitigate privacy infringements, for instance by removing correlations with sensitive website content categories.

But once the system’s cohort IDs began trickling into the digital ad ecosystem, ad agencies and tech firms began tinkering with them to see what they could learn, peeling away some of the system’s arguably privacy-preserving veneer. Digiday reported that identity tech providers expected to use cohort IDs to improve the accuracy of systems that detect people’s identities and that ad agencies and other tech providers were intercepting the IDs and analyzing how they could be used in conjunction with existing user profiles.

“We are always exploring options for how to make the Privacy Sandbox proposals more private while still supporting the free and open web,” said the Google spokesperson.

During his talk, Karlin added, “Ideas are still being evaluated; none of this is locked in. We plan to discuss these ideas in the open, refine them and test them to better understand their privacy [implications].”

Clarification: The story originally stated Karlin is Google’s tech lead manager of the Privacy Sandbox team in its Chrome browser division; however, Karlin is one of several Google’s tech lead managers working on Privacy Sandbox efforts at Chrome.

More in Marketing

As the line between B2B and B2C marketing blurs, Workday taps humor in consumer-facing media channels

As the crowded digital landscape challenges marketers to stand out, B2B company Workday tests a B2C marketing strategy.

How the NBA’s broadcast rights tussle could affect advertisers

Streaming could change the NBA advertising landscape, say media experts.

Ad tech vendor Colossus faces scrutiny for alleged mismanaging IDs

Concerns stem from a report by ad transparency startup Adalytics, which discovered that Colossus was mislabeling IDs, leading to unintended ad purchases.