Google is introducing what it calls Federated Learning of Cohorts, which is a way to gather user data without cookies, regardless of whether a website is loading any Google-related trackers. This is enabled starting in Chrome 89, and only in select countries on a trial basis.
Although other major browser vendors are likely against this technology and will presumably not be implementing it, given Chrome’s market share this will become a concerning issue, because it largely remove users’ ability to easily opt out of being tracked—particularly true in the case of less-savvy users.
See a very informative post by Plausible.
Since no one can reasonably expect users to just stop using Chrome, it will be up to responsible developers to block FLoC at the source.
Blocking FLoC is as easy as adding this header to the HTTP response:
Permissions-Policy: interest-cohort=()
None.
None.
None.
Introduce Permissions-Policy header to block Google’s Federated Learning of Cohorts.
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | 3209976-5.patch | 5.41 KB | mcdruid |
Comments
Comment #2
webchickLet's postpone this on the discussion at #3209628: Add Permissions-Policy header to block Google FLoC so we don't end up having it in two places.
Comment #3
chaseontheweb#3209628: Add Permissions-Policy header to block Google FLoC has been committed, back to active
Comment #4
mcdruid commentedInitial implementation very similar the one committed to D9.
No tests yet.
Comment #5
mcdruid commentedPretty much same tests that were added to D9.
Comment #6
mcdruid commentedDon't want to RTBC my own patch :)
This should make it into the release next week, subject to Framework Manager review.
Comment #7
mcdruid commentedThis'd need a CR as we're adding a new http response header by default.
Comment #8
fabianx commentedRTBC + 1, as long as it's committed in D9, this is good to go.
Comment #19
mcdruid commentedAdding credit from parent.
Comment #21
mcdruid commentedCR published.
Thanks everyone!
Comment #22
klonosThanks for starting this @mcdruid 🙏...I'm cross-porting it for Backdrop, and thought I'd mention that you need to change this line: https://git.drupalcode.org/project/drupal/-/blob/7.x/includes/common.inc...
From this:
drupal_add_http_header('Permissions-Policy', ', interest-cohort=()', TRUE);...to this instead (remove the ", " from the added string):
drupal_add_http_header('Permissions-Policy', 'interest-cohort=()', TRUE);...otherwise you could end up with something like this in your headers (notice the double comma):
whatever-pre-existing-policy,, interest-cohort=()You see, when using
$append = TRUEindrupal_add_http_header(), it already adds the comma. See: https://git.drupalcode.org/project/drupal/-/blob/7.x/includes/bootstrap....Comment #24
mcdruid commented@klonos++ nice catch, thank you!
I've tweaked the test so that it specifically looks for the two header values separated by the comma.