Google has made millions of its users the targets of a test for a new ad program without informing them, warns a privacy activist group.
The Electronic Frontier Foundation said Google’s test trial of its Federated Learning of Cohorts without consent “is a concrete breach of user trust in service of a technology that should not exist.”
Under the program, Google Chrome browsers “will begin sorting their users into groups based on behavior, then sharing group labels with third-party trackers and advertisers around the web.”
“Although Google announced this was coming, the company has been sparse with details about the trial until now,” EFF said. “We’ve pored over blog posts, mailing lists, draft web standards, and Chromium’s source code to figure out exactly what’s going on.”
EFF said Google “designed FLoC to help advertisers target ads once third-party cookies go away. During the trial, trackers will be able to collect FLoC IDs in addition to third-party cookies.”
“That means all the trackers who currently monitor your behavior across a fraction of the web using cookies will now receive your FLoC cohort ID as well. The cohort ID is a direct reflection of your behavior across the web. This could supplement the behavioral profiles that many trackers already maintain.”
The trial includes Chrome users in Australia, Brazil, Canada, India, Indonesia, Japan, Mexico, New Zealand, the Philippines and the U.S.
Researchers want 5% of the user population involved, “so that ad tech companies can better train models using the new data.”
That would mean tens of millions of Chrome users are to be monitored.
“Those users will not be asked to opt in,” the report said. “In the current version of Chrome, users can only opt out of the trial by turning off all third-party cookies.”
The program is intended to calculate “a label” for each user “based on your browsing history.”
“For the trial, Google will default to using every website that serves ads—which is the majority of sites on the web. Sites can opt out of being included in FLoC calculations by sending an HTTP header, but some hosting providers don’t give their customers direct control of headers. Many site owners may not be aware of the trial at all,” EFF said.
“If you’re part of the trial, dozens of companies may be able to gather your FLoC ID from each site you visit,” EFF said.
And any advertiser or other third party can start collecting data by signing up.
“The [Google] page currently indicates that the trial may last until July 13. Google has also made it clear that the exact details of the technology—including how cohorts are calculated—will be subject to change, and we could see several iterations of the FLoC grouping algorithm between now and then.”
Google will be watching, for example, for visits to WebMD or PornHub.
But EFF warned there apparently is no defense for “bigger problems,” such as “discrimination” and “predatory targeting.”
The result will be “a test that will share new data about millions of unsuspecting users,” which, EFF said, “is another step in the wrong direction.”