Google’s Grand Plan to Eradicate Cookies Is Crumbling
Millions of people are already part of a global experiment to eradicate cookies once and for all. Since last month, Google has been trialling new browser-based tech in Chrome that could upend the global advertising industry. Most people involved in the trial probably don’t even realize it—but as the project gathers pace, critical voices are raising the alarm.
Regulators in Germany, France, and Belgium are all scrutinizing Google’s proposals. At the same time, some of the world’s biggest websites have decided to skip Google’s trials entirely, with a number of companies developing ways for people to dodge the system.
The system, known as Federated Learning of Cohorts (FLoC), is part of Google’s bigger Privacy Sandbox plan that will bring about the end of third-party advertising cookies early in 2022. There are broadly three ways websites pick which ads to show you. You might see an ad for a pair of sneakers because you put them in a shopping basket last week; if you’re reading an article about cars, the ads may also be about cars; or the ads you see might be based on your interests. FLoC, like third-party cookies, deals with advertising based on what you like.
Currently, cookies let advertisers show you ads that are specific to you because they’re based on your individual browsing history. FLoC is designed to get rid of this individual targeting by widening the net. If you’re using FLoC, Chrome will gather your web history and compare it with the habits of others. You’ll then be lumped into a group, or cohort, with thousands of other people like you. Advertisers can then target entire groups of people rather than specific individuals.
It’s not just the scale of the change but also who’s behind it. Google, whose parent company Alphabet brought in record $55 billion revenue during the last three months, dominates the global advertising industry. Regulators are understandably skittish.
“The FLoC technology leads to several questions concerning the legal requirements of the GDPR,” says Johannes Caspar, the data protection commissioner for Hamburg, Germany. “Implementing users into the FLoCs could be seen as an act of processing personal data. And this requires freely given consent and clear and transparent information about these operations.” In short: Google needs to make sure people are actively choosing to use FLoC rather than having the system turned on by default in Chrome. Caspar adds that there are risks with how cohorts could “allow conclusions” to be made about people’s browsing behavior and how specific FLoC’s cohorts will be.
And it isn’t just German regulators who have concerns about FLoC. A spokesperson for the Commission nationale de l’informatique et des libertés, or CNIL, France’s data regulator, says it is being “particularly attentive” to tech that might replace cookies, as it may require access to information already stored on people’s devices. The CNIL is clear that such a system would require “specific, informed and unambiguous consent.” If Google fails to do so, it could prove costly. In December 2020, the French regulator fined Google $120 million for not obtaining people’s permission before using cookies.
Other regulators are more concerned about antitrust. In Belgium, officials are keen to understand how competitive future systems are, as well as how they comply with data protection laws. In the UK, the Competition and Markets Authority and data protection regulator, the Information Commissioner’s Office, have been investigating Google’s proposals since January. And the Irish Data Protection Commission, which has responsibility for a lot of major technology companies with European headquarters in Dublin, says it has been consulting with Google on the proposals.
Google is well aware of FLoC’s potential pitfalls. Case in point, the technology is yet to be trialled in the European Union. “EU privacy law sets high standards for user transparency and control, and that’s what we envision for FLoC,” says Marshall Vale, a Chrome product manager at Google. “We know that the input of data protection authorities is key to getting this right, which is why we have begun early stage conversations about the technology and our plans.” Google has previously said it plans to introduce tools that will let people opt out of being placed into FLoC cohorts.