Are you bored of cookie notices and bars?  Well, have no fear because Google is moving away from them!  But, the question is, do you still have something to fear? What will Google replace the cookies with? What does it mean for us? For FLoCs sake.

For those not in the know, a FLoC is an aggregate of anonymous users with similar interests. These similarities are gathered through predictive and contextual signals, such as a reader’s website and page visits. FLoC stands for Federated Learning of Cohorts. Advertisers can then identify FLoCs relevant to them, and show ads to those FLoCs.

What are FLoCs?

FLoCs are, in essence, the “new” tech “replacement” for third party cookies. It would appear that cookies are far too noticeable now there are banners asking for consent. However, FLoCs will still need consent, or at least they will need consent within the UK and EU thanks to ePrivacy regulation.

We’ve seen resurgences of tech trying to reinvent the privacy intruding wheel. These have included Adobe Flash local objects / persistent Flash cookies from the early 2000s, as well as HTML 5 canvas from around 2010. There are also Pixels, which have been around since the 90s but are more malignant now. In addition, you have browser fingerprinting. FLoCs are carrying out the same job as the tiny text files known as cookies and the tech that we know as fingerprinting.

Being given a FLoC ID means that your browsing history has been processed. Google has assigned you to a group of “a few thousand” similar people who are browsing the same or similar websites as you. Basically, you’re in a cohort that will be targeted with appropriate advertising.

What is Google up to?

Google is trying to find a new revenue stream.

FLoCs are not new to Google. They were used internally in Google’s Chrome browser long before now. They are still trialling it in other browsers, however, they are not trialling it in the UK …for now. If that time ever comes, as I’m not overly confident on how this will interact with any future e-Privacy regulation.

People are indicating they don’t want to be tracked [or at the very least, they’re taking no action and not opting in], so targeted advertising will see a drop in the data that’s readily available. Not giving consent leading to less targeted advertising revenue for Google and even less data that Google can sell with return on investment.

Is there something to be worried about?

FLoCs are more of the same and I do wonder if it’s something to worry about in the UK. I cannot see how it can be implemented as it still needs consent under our current legislation.

In the UK, we have The Privacy and Electronic Communications Regulations 2003 (PECR). This sits alongside the Data Protection Act and the UK GDPR,  giving people specific privacy rights in relation to electronic communications.

There are specific rules on:

• marketing calls, emails, texts and faxes; [yes faxes still get a mention!]
• cookies (and similar technologies);
• keeping communications services secure; and
• customer privacy as regards traffic and location data, itemised billing, line identification, and directory listings.

FLoCs are bracketed as “and similar technologies” which is defined as:

Confidentiality of communications

6.—(1) Subject to paragraph (4), a person shall not [F1store or] gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of that terminal equipment—

(a)is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and

[F2(b)has given his or her consent.]

(https://www.legislation.gov.uk/uksi/2003/2426/regulation/6)

Therefore, if it’s not strictly necessary for service delivery (of which FLoCs are not) they need to get consent. People are not giving consent currently so, it begs the question of how will this work?

FLoC-ing E-Privacy Legislation

I don’t think FLoCs is something to be worried about, but we will need to consider what Brexit means for the future of ePrivacy legislation. Will the government choose to repeal PECR?  What would its replacement look like? The true impact of cookies and similar tech is only just being recognised, because of the need to ask people to opt-in and not just assume consent. Moreover, we are seeing very little interest from our current ICO in regulating serious data breaches.  According to the ICO Annual Report, only around 2% of their complaints are related to cookies or similar tech. Oliver Dowden’s statement on his aspirations for the new IC also doesn’t give me much confidence.

I believe that people are worried about paying to access information because the internet is rapidly proving not to be “free”.  Although I’d argue that it never was – you’ve simply been handing over personal data in lieu of cold hard cash. I don’t think it has been truly realised that you are handing over your individual rights and freedoms to be tracked, targeted, and sold to. Many people are bewildered by the fact the ads they see are so spot-on.  Ultimately this can become a problem for people who wish to be private about their purchases, or their browser viewing, or who do not fit the “normal mould”. It’s not an exaggeration to say that people can have their lives endangered through poor practices by the likes of Google.

What happens with FLoCs next?

We simply have to sit and wait and see what happens to the current legislation in light of Brexit.

Regardless of what the government decides to do, it’s important to put your privacy first. If you haven’t already, ditch Google Chrome and any type of browser regardless of incognito preferences. Move to the likes of Brave or DuckDuckGo who are already saying that they are blocking FLoCs. I anticipate Startpage will follow suit, and Safari won’t be far behind given Apple’s recent announcement.  Regardless of what they say, EVERYTHING with Google starts at revenue. Privacy always comes last, especially where revenue is concerned.

It may come as a bit of a “meh” recommendation, but start reading privacy and cookie notices. Call companies out on their dodgy data practices. The more that the word gets around the better it is in the long run. Turn down consent. Put your privacy first and stop buying into Google practices.

I talked this through recently with Kate O’Flaherty, an independent journalist and was quoted in her article here.  In this article, she also addresses the US implications.

If you like this blog post, please see other posts here.

If you enjoyed my content, I don’t get paid for this work and so please consider buying me a virtual gin and tonic or two here.