Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. And a long phase out is not something around which you can form a singular rallying cry.

FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private.

I think it's unnecessarily fatalist to say that all of this will continue to happen so what's the point of resisting it. Public awareness and negative opinion of the pervasiveness and creepiness of internet tracking continues to grow, and advocacy against tracking mechanisms helps create the type of groundswell which could actually shift public policy to forbid such tracking.

Google specifically is catching some heat for potential antitrust problems, so raising a ruckus about Google abusing its dominant browser position to cram FLoC into the internet is more likely to have positive effect than ever before.

> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out.

Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid!

Anyway, I'm pretty sure any large websites relying on 3rd party cookies for functionality will have already experienced users blocking issues. We have and have already been forced to change, we don't do ads, but our use case is a bit esoteric in that it needed 3rd party cookies for sessions.

> Not true, FireFox and Safari have had them off by default for over a year now.

Not quite. They will block some 3rd party tracking cookies that fall on their tracking blacklist. If you want to block all 3rd party cookies you have to explicitly disable them.

Safari does actually block all third party cookies by default, not just a subset. And has been doing so for about a year now.

If I understand correctly, they allow 3rd-party cookies but delete them at the end of the browsing session rather than respecting the expiry.

Care to reach out? This username at Microsoft.

We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.

Since you seem to work for Microsoft, the broken use case I know: without 3p cookies Microsoft Teams is broken (it shows a not very useful error page asking to refresh the page, when you do it shows the same error again). Many of us need it for remote work so I guess this one of the things Google had in mind when they delayed disabling 3p cookies by default.

Yes, Teams relies on silent auth from within an iframe (all those chat windows etc). This is impossible without 3p cookies, so we're working with Google to find a solution. Storage access API in Safari works, but sounds like it won't make it to Chrome.

Thanks, nice to know you are working on it.

Auth should be doable with just redirects though right? Isn't that how OAuth and OpenID connect work?

Same thought. I’m curious to know what other kinds of authentication protocols require third-party cookies to operate. Within OIDC, even more obscure/advanced features such as session management and global logout require only 1st party (the IdPs) cookies in order to function.

I guess the tradeoff being made here is just leaning into our reliance on the certificate authority system. Whereas before, with third party cookies, you might have had more flexibility with how you structure your domains.

The implicit grant, while deprecated, is still used across the ecosystem. Further, embedded apps (eg you have a portal that iframes Salesforce and Salesforce needs to be authenticated) can't redirect to the login page or open that iframe for cookies.

Front channel logout is also broken, part of the OIDC spec. It opens iframes to sites, but the sites don't get their cookies and can't write them.

OAuth sometimes is done using an iframe and a pop-up window instead of by navigating to the federated auth provider and back. That version often needs third party cookies.

Sure, I suppose all that (waves hand at third-party cookies situation) is what I meant by the long phase out of them. As far as I can recall those defaults were signaled a fair amount of time in advance.

I have sympathy for anybody with a legitimate use for third-party cookies whose life has been made more difficult by bad actors abusing features to maximise their own profits.

Same tragedy that finally caused origin-based cache partitioning at the expense of some performance.

this is the same execuse facebook's been using, although they're trying to push the narrative that limited tracking in Apple's iOs 14+ "hurts Small Business!"

https://twitter.com/jason_kint/status/1383391849902075911 (video in thread)

Another thing is that third-party cookies can actually offer real functionality that has nothing to do with advertising (for example platforms like Salesforce let you integrate your own offering into a Salesforce users' system, and third-party cookies can be a pretty straightforward way of accomplishing that).

I don't see really any non-tracking reason for FLoC

I have 3rd party cookies off. The only thing I have seen requiring 3rd party cookies in the last year is Microsoft when I had to use teams.

> FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private.

What exactly about FLoC is making the internet less private though? Every time I see the technology it seems that it's deliberately built to keep private data in your Chrome browser and leak significantly less than anything else Ad related right now.

Also, why is WordPress allowing so many ad and anlytics tracking plugins and not considering those as security issues?

If you have figured out a way to eliminate tracking, be my guest. Mozilla would like to know, Apple would like to know. Until then FLoC attracts attention because it's new, yes, this explains our reaction. It's still an irrational reaction.

Also what's this "predatory targeting of unsophisticated consumers" about? You don't need targeting for this. Heck you don't need anything for this. The way it's usually carried out is you hack some sites and redirect them to you landing page about "this one magic trick to riches, banks hate her".

Mozilla at least has done plenty of things to reduce the effectiveness and scope of tracking on the web.

Just because we can't create an ironclad solution doesn't mean that there isn't real value in reducing the usable surface area for profiling and tracking users across the web.

FLoC is an additional means of tracking users that is presently being pushed by a giant corporation who controls a significant web browser, of course anybody who is pro-user-privacy would rail against its rollout. It's ridiculous to call that an irrational reaction.

Apple is doing just fine on greatly reducing tracking, and we don’t think FLoC or anything much like it is necessary. Safari already blocks 3P cookies by default and has done so for a year.

So you're the one who keeps doing that, or is it a group thing?

Just curious. It undoubtedly works, but I've always wondered why it's so pervasive.

Congratulations, you win a free iPhone.

The issue really is: Google isn't phasing our 3rd party cookies out of charity. They are clearly looking for a way to keep doing all the things third-party cookies enable after they go away.

Here we find people saying (through legislative and regulatory action) that they want to end the use of 3rd party cookies because the bad behaviors they enable, and they are rightly outraged at the efforts to comply with the letter of the law while running roughshod over the intent of the laws.

Why is firefox phasing out 3rd party cookies? Is it out of charity?

Firefox is not a product of the 800lb gorilla of targeted ad revenue. The Mozilla foundation could live without the ad revenue tied 3rd party cookies. They feel pressure from their users (people like us) who want to not be tracked everywhere, and ending the use of 3rd party cookies is one technical step.

At some point in the past year it seems the privacy concerns reached a critical mass. The Mozilla foundation is responding in ways to keep its browser share relevant.

Yes. Mozilla is a non-profit, pretty much everything they do is out of charity.

Sort of true. To know what a non-profit's motivations are, look at the biggest donors and donations. Some of the Mozilla Foundation's money comes from the Mozilla Corporation, which does get a lot of money from the big tech companies.

As far as I'm concerned, it is just great that something made it for people to be "all up in arms about it". And "why" is not very important and neither is it surprising, really. I mean, how could have people been all up in arms about well-established technology all web is built upon, when 10 years ago google was, allegedly, "the good corporation", all people were like "I have nothing to hide", avoiding FB because of privacy concerns was just "being paranoid" and people telling stories confirmed by Snowden shortly after were "schizophrenic"? It is literally like 3-5 years (right before Cambridge Analytica scandal, I guess) since being "concerned" about your web-presence became somewhat mainstream.

And FLoC is... well, it's new.

Third-party cookies can be blocked by technological means. Heck, cookies can be blocked. There's even a toggle in Chrome to disable them, no extension needed. And yet, here we are, attempting to preserve the bucketing of humanity despite what anybody using the browser actually wants.

People don't want more things like 3rd party cookies.

The idea is that this is the bare minimum the industry needs in order to stop needing 3rd party cookies (and other tracking strategies).

It's not pretty but on the other end... ads do serve a function. And not all ads are bad. The focus should be on getting rid of the scammy ones, and not tracking won't help much with that.

Fuck the industry. The entire point is to get you to spend more money on stuff. I will do nothing to assist with the brainwashing of humanity, and will continually fight against it.

I think a sufficiently large number of people is saying they effectively do not care about the surveillance-based ad industry and want it dismantled.

Tracking is used pervasively by the ad ecosystem today, but that doesn’t mean tracking is needed for ads to exist. Contextual ads are a thing. FLoC isn’t even replacing the most important use of tracking, which is measurement, not targeting.

Ads serve capital, they do not serve me.

I think many people would disagree with the conclusion to your second paragraph. If you don’t take it as given that something must come and replace cookies then FLoC appears to be an attempt to rebuild that which was just cast into the bin of history.

One difference between third party cookies and FLoC is that with FLoC it is being explained to the public how browsing history is being used. The third parties who send Set-Cookie headers do not write up documentation attempting to explain to the public what they are doing and why it is not a threat to privacy.

As other comments point out, it would be more difficult for people to "be all up in arms" about third party cookies because third party cookies is not an issue that is easily attributable to one entity nor one set of documentation.

“attempting to explain to the public what they are doing”

The idea that you can explain FLoC, third party cookies or any other digital advertising technology to the public is crazy talk.

Ad tech is extremely complex and constantly evolving - “the public” includes children, the intellectually disabled, the mentally ill, the elderly and the illiterate.

No amount of documentation is going to help these people reach a point where they could actually be considered as giving “informed consent” to their “use” of an ad-tech stack that often involves dozens of different legal entities and software components.

#####

“why it is not a threat to privacy”

The entire purpose of FLoC is to maximise profit for Google by minimising my privacy.

Agreed 100%.

Only me, but I actually find the docs insulting for the reasons you stated.

I think the cause and effect is a bit mixed up in your reasoning. What's actually happening is threefold:

1. People are starting to get fed up with tracking of all kinds (including third-party cookies). This is happening gradually, but is increasing. A consequence of this can also be seen from the legal side in the form of GDPR.

2. Google sees the tides on tracking are turning and tries to preempt by proposing a superficially less problematic alternative (FLoC) that will be least detrimental to their tracking business.

3. People dislike FLoC because it is not sufficiently lessened in this new normal and is therefore also unacceptable.