Birdwatching for Marketers: What Google’s FLoC & FLEDGE Mean for You

Emerging regulations & consumer-driven privacy demands are reshaping marketing technology. This post will clarify what we know about FLoC and FLEDGE, address marketer concerns, and give recommendations for the path…er, “flight plan?” ahead.

What’s new in Google Chrome?

The birds in the sandbox are about to take flight. 

That is, Google has announced that it will not support third-party cookies starting in 2022. To prepare for this major shift in digital advertising, Google has created the Privacy Sandbox as a testing environment for their new privacy technologies. In the Privacy Sandbox is an entire aviary of bird-named technologies that will affect marketers, including the Federated Learning of Cohorts (FLoC) API and First “Locally-Executed Decision over Groups” Experiment (FLEDGE), which expands upon a previous effort called (take a big breath), Two Uncorrelated Requests, Then Locally-Executed Decision On Victory (TURTLEDOVE).

Google has announced that they will be flying trials of FLoC and FLEDGE through this year, and, in 2022, they’ll “phase out” tracking across websites by eliminating support for third-party cookies (3PC). Google will replace that support with their technologies/birds. For FLoC and FLEDGE, the goal appears to be to preserve privacy and advertising ability by keeping both websites and ad sellers from knowing what other websites a person has visited and what ads a person has seen.

While this move by Google will undoubtedly address privacy concerns, it will also make users reliant on Google technology, which has some brands worried that their own advertising and tracking resources and strategies may not retain effectiveness. 

Further, Google’s actions already flutter through the tech space (see other firms like theTradeDesk and LiveRamp, who are joining the walled-garden game–Google announced they would not support such alternative plans). The adoption of these practices is, so far, limited to Chrome, with no cross-browser support. It may be that Edge adopts it as they share the Chromium Codebase, but we are skeptical of Mozilla and Apple buying in. It remains to be seen what will happen on iOS / iPad—where the browser back end is Webkit. Apple may force the use of the App Tracking Transparency (ATT) prompting, which would subject Google’s tech to additional consent requirements. We will be monitoring all these details. 

Learn what's new in Google Chrome for marketing with recent privacy changes including FLoC and FLEDGE Image source: https://blog.google/products/ads-commerce/a-more-privacy-first-web/[/caption]

What do we know about FLoC?

FLoC solves the problem of not tracking a user’s browsing history by advertising based on user cohorts A browser will collect “general information about the interests of a person who is going to see the ad” by recording the web pages they visit and then create clusters of groups (cohorts) with similar browsing habits through an entirely on-device encryption/hashing process. The browser updates a user’s cohort as users visit more sites. Privacy is enhanced because inputs (websites a user has visited) never leave the local browser; the only thing that is exposed to advertising platforms is the generated cohort ID. Marketing usefulness is supported because advertisers can observe the habits of large groups to whom they can show ads without collecting any personal data. 

How FLoC works for a consumer

When you go to a website and browse ten URLs, FLoC runs those URLs through a Google-provided, on-device algorithm to generate a proposed cohort ID. Your browser then sends that ID (and only that ID) off-device to a Google server to validate whether a sufficient number of users have been assigned that cohort. Sufficiency, in this case, means that the cohort is considered k-anonymous at k = “thousands and thousands.”

Suppose the required level of anonymity isn’t reached. In that case, the cohort may be discarded (and FLoC won’t assign your browser to any cohort), or the algorithm might take another pass at trying to roll you up into a more generalized cohort. If your proposed cohort passes the anonymity test, you become part of that cohort, along with “thousands and thousands” of other people who have visited similar sites—without your personal browsing history ever leaving your device.

Some unknowns about FLoC

For advertisers, once a user has been assigned a FLoC cohort, things become less clear. We do not know what information advertisers will receive, if any, about each cohort outside of its ID. Companies may be able to capture the cohort IDs of users that visit their sites and target those cohorts specifically. However, will additional information about specific cohorts be provided, such as their high-level interests, so that advertisers can target them through those interests? Does Google know what those interests are at cohort creation time, or will the interests be generated by delivering a random mix of ads to each new cohort every seven days when they all reset and seeing what they engage with?

Another important question: Is FLoC legal in Europe? For now, FLoC trials in the EEA are being delayed over concerns, specifically, “over which entity will serve as the data controller and which will serve as the data processor in the creation of cohorts.” Google claims, however, that they’re committed to the Privacy Sandbox in Europe and that they will begin testing there (along with testing in the US and elsewhere) “as soon as possible.”

image6

High points regarding how FLoC works

  • FLoC all takes place on your browser and assigns you to a cohort automatically based on what sites you visit, but it doesn’t send the list of sites you visit off your device—it does the cohort assignment by itself. 
  • Cohorts will be built using sim-hashing algorithms (or, in the future, federated learning models). Google will create and deliver these to your device to run locally, so neither the advertiser nor any individual website will have visibility into specific sites or pages a user (or an entire cohort) visited.
  • The cohort doesn’t necessarily have an “owner.” 
  • Sites that want to display ads to you will be able to ask your browser for your cohort ID and then request an ad from an ad server while passing along that ID to it. The method in which that ad will be displayed, reported on, etc., isn’t entirely clear but may use some of the FLEDGE approach below.
  • Cohorts will be reset regularly, with the initial reset period being seven days.
  • Certain categories of sites won’t add you to a FLoC cohort (religious, explicit, etc.)
  • UK and EFF are concerned that the technologies could be manipulated if the tokens were ever decrypted/reverse-engineered.

While both FLoC and FLEDGE enable marketing to cohorts/groups instead of individuals, they do this in substantially different ways. FLoC cohorts represent general interests, are not owned by any particular company, and are automatically generated and assigned based solely upon all the URLs a user visits; FLEDGE interest groups are created, owned, and assigned by you, the marketer, based on specific actions users take on your website.

What do we know about FLEDGE?

“First Locally-Executed Decision over Groups Experiment” (FLEDGE) enables remarketing—without the use of third-party cookies—based on previous site actions. It’s a complicated combination of six or seven different proposals wherein the browser is still collecting user information in interest groups with the aim of not sending that interest group information off-device.

How FLEDGE works for a customer

When you visit a site, FLEDGE allows the owner of that site to assign you (your browser) to an interest group based upon your actions on that site. This interest group may be a proprietary one that the individual site/brand created and manages, or it may be a more general interest group created and managed by a demand-side platform (DSP) or another industry player. For instance, if you view a product detail page for an athletic shoe on {brand}’s website, you might be added to an “athletic_shoe_interest” group provided by Facebook/Google or a “{brand}_athletic_shoe_interest created and managed by {brand}.” When a site assigns you to an interest group, it also includes a list of creative assets used to generate ads relating to that group and URLs your browser can visit to get updated assets in the future.

If you later visit a website that sells ad space (a publisher) through a seller platform (Google Ad Manager, etc), that seller platform can initiate an on-device bidding process to determine which ad to show based on your assigned interest groups. The details of this are highly technical, so we omit a full discussion of them, but you can read more on the FLEDGE and TURTLEDOVE proposals themselves. 

Once a winner is determined, that ad will be displayed to you in a new Fenced Frame HTML Component that fully programmatically isolates the ad shown from the containing publisher page. This means that the publisher cannot retrieve any information about your interest groups or what ad you saw. Your previous browsing history remains protected. Similarly, the ad seller and buyer receive no information about you other than the single interest group used to generate the ad as the fenced frame cannot retrieve any first-party identifying information (email, user ID, even current URL) from the site itself¹

The publisher may know who you are through authentication/geolocation but won’t know your interests, and the advertisers know of the interest that drove the ad but not who you are. Privacy! Of a sort! 

Some unknowns about FLEDGE

Though Javascript is a very performant language on the browser, the on-device bid auction requires multiple API calls and could feature relatively complex logic to determine the winning bid, perhaps even consisting of a full machine-learning model. As such, there are concerns about the potential performance impacts of TURTLEDOVE. For this reason, FLEDGE incorporates the concept of a “trusted” key/value (KV) server being used to alleviate some of the bid processing load in a way that maintains the privacy benefits so that your browser runs smoothly and pages load quickly. Details on what “trusted” entails will be forthcoming.

Screen Shot 2021 04 15 at 1.54.10 PM Image source: https://github.com/google/ads-privacy/tree/master/proposals/dovekey

There is so much that Google is still trying to define in this proposal, that we have broad strokes about what it is supposed to do, but we don’t yet have a good technical idea of how it all works. FLEDGE experimentation is expected to begin this year, 2021. 

Another note about how FLEDGE fits into the current privacy landscape: California’s pending CCPA law update (going into effect in 2023) makes special mention of Cross-Context Behavioral Targeting (Retargeting) requiring specific consent. We’ll need to see how these proposals interact with that. Also, it remains to be seen if FLEDGE is legal in Europe.

High points about how FLEDGE works

  • FLEDGE is the first implementation of the TURTLEDOVE proposal for marketing, but FLEDGE expands on it by incorporating additional proposals. FLEDGE reads more like a fork of TURTLEDOVE rather than just an implementation of it.
  • Browser joins interest groups owned by sellers, publishers, or third parties
  • Auctions for ad space are performed completely on-device or with the assistance of “trusted servers”
  • Ads are displayed in the new HTML Fenced Frame component such that neither the site nor the ad frame can benefit from the data contained in the other

Data is collected via the proposed Conversion Measurement API

Why are marketers concerned?

For marketers used to relying on cookies and the siren-song concept of utilizing a complete view of a customer’s interactions to make “data-driven” marketing decisions, FLoC may be especially unsettling.

To understand why, it’s important to note how we came to the point where digital advertising received so much of our media resources: We’re in this boat (or aviary) because paid media has historically done the best job (in a marketing strategy mix) of rapidly proving its value with data. Most stakeholders can wrap their heads around ROI pretty easily. The fear is that if advertisers aren’t able to track individuals’ behavior on the internet, they won’t be able to effectively drive people to their sites or justify spend using ROI. Those are totally valid concerns, even just with the demise of third-party cookies, let alone with the advent of a new system for targeting consumers and showing ads. We address these fears below.

While advertising experts are worried, downstream, these new approaches scare analysts, too. One client explicitly asked us, “If we’re not able to use our analytics implementation to build remarketing audiences, then does that devalue our analytics implementation, and therefore do we not need to spend as much on it or even our websites?” This is an excellent question whose answer depends on the reason a brand adopted an analytics platform: If the platform was built for remarketing, the road ahead may require some thought and work; however, if the platform was built for insights about onsite behavior (which doesn’t use third-party cookies), that won’t be affected. 

Is there any hope?

There is. Remember that FLoC will impact general information about the interest of the person and FLEDGE will impact remarketing interests. So while FLoC may pique the interest of big companies with sophisticated paid media strategies, it likely won’t affect the majority of players in the digital advertising space. This is because paid media match rates (the rate of targeted individuals who are likely to see an ad) aren’t great now (30%-60%), and they won’t be great after FLoC is implemented. For the typical advertiser, things probably aren’t going to change that much.  

Further, for some marketers, FLEDGE is a fairly hopeful solution. Remember when we were asking six months ago if remarketing is dead? FLEDGE keeps remarketing alive, just changed. 

Search Discovery’s Closing Thoughts

A lot of change will be coming in the next 18 months. Many of the concepts discussed in this article are not well formed yet, and will certainly evolve. A great way to stay in the loop is to join the W3C conversation every second Wednesday of the month. 

Advertisers may not notice much of a difference. Ultimately, Google has a strong incentive to cause as little disruption as possible to the current system. According to Google’s own research, FLoC is proving to be 95% as effective as cookie-based methods at generating in-market and affinity segments. Also, it’s important to remember that Google’s match rate for targeting ads to specific users isn’t perfect today, so we are moving from an imperfect system to a slightly more imperfect system.

Pencil in time to devote to this in the latter half of 2021. The new technology requires, in some cases, extensive refactoring of ad placement locations by the clients. This is to allow the use of Fenced Frames and related technologies. Since this is yet not fully defined, at best we can have clients pencil in this work in the latter half of 2021 or early 2022. We stand ready to guide you in these efforts as details emerge, and we currently offer free audits to assess the impacts to your website from recent browser changes.

Study up on experimentation and field testing. The methods that digital marketers use today to calculate ROI rely heavily on cookies, and have already been impacted by restrictions imposed by Safari, FireFox and other browsers. However, we can borrow experimentation techniques from social scientists to fill this gap and even improve on it.  

Search Discovery has designed a solution for running Randomized Controlled Trials (RCTs) to help businesses build transparency, beat impersonalization, and mathematically identify and prove sweet-spots for media investments in a cookie-less world.

A Randomized Controlled Trial (RCT) is a type of scientific experiment that aims to reduce certain sources of bias when testing the effectiveness of new treatments. This is accomplished by randomly allocating subjects to two or more groups, treating them differently while controlling for potential noise, and then comparing them with respect to a measured response. RCTs can also be used to optimize your paid media spend that utilizes the same scientific rigor without relying on either out-of-the-box attribution solutions or cookies. Even as individual-level tracking disappears, our RCT designs allow you to prove out your ROI across media tactics (including non-digital media), channel, spend, or messaging.

Be the lead bird. FLEDGE is coming, but it’s not here yet. What is here is our solution, Astrologer, that operates in a very similar way, but is deployed client-side using entirely first-party data. Astrologer does not depend on Google. It leverages machine learning to create user segments in real-time as a user navigates a website, and makes those segments available to marketers for personalizing site content, generating remarketing lists, or conducting analysis. To learn more about Astrologer, please reach out on the form below.

Contact us to learn more, to receive an RCT case study, or to add your thoughts to the conversation about what's new in Google Chrome.

¹One technical note that is important here is the “Two Uncorrelated Requests” part of TURTLEDOVE. While we just said the ad seller can’t see the URL of the page, it is technically sent to them…but the standard requires browser vendors to send it in a separate request at a different time than the interest groups, such that they cannot be tied to that particular publisher URL/site through correlation.

Related Posts

Join the Conversation

Check out Kelly Wortham’s Optimization based YouTube channel: Test & Learn Community.

Search Discovery
Education Community

Join Search Discovery’s new education community and keep up with the latest tools, technologies, and trends in analytics.

Follow Us

Share

Share on facebook
Share on twitter
Share on linkedin
Scroll to Top