Google's FLoC, which helps advertisers perform behavioral targeting, avoids privacy risks of 3rd-party cookies, but creates new privacy issues in the process
The third-party cookie is dying, and Google is trying to create its replacement. — No one should mourn the death of the cookie as we know it.
Context & Ripple Effects
A month after Google unveiled Federated Learning of Cohorts as its privacy-conscious substitute for third-party cookies — claiming roughly 95% effectiveness versus cookie-based ads — the Electronic Frontier Foundation is arguing that the fix trades one set of privacy harms for another. The critique lands mid-origin-trial: Google had just started rolling FLoC out as a developer trial inside Chrome's Privacy Sandbox.
The timing matters because Google had publicly pledged not to build alternate identifiers once third-party cookies were phased out, making FLoC the load-bearing piece of its entire deprecation plan. An effective privacy critique of FLoC therefore attacks not one feature but the centerpiece of how behavioral advertising survives without cookies.
First-order effects
- Advertisers and publishers participating in the FLoC origin trial are now running cohort-based targeting under an active privacy controversy, forcing Google to defend the design it pitched as the safe path off cookies.
- Google's no-alternate-identifiers pledge comes under immediate test: if FLoC itself creates new tracking risks, the promise that anchored the Privacy Sandbox pitch loses credibility.
Second-order effects
- Privacy criticism pressures Google to keep redesigning the mechanism rather than shipping it as-is — pressure that eventually showed up when the company shut FLoC down and replaced it with Topics, reorganizing browsing into 300-plus categories.
- Marketers and adtech firms left planning around FLoC face repeated target-moving; by the time Google began restricting cookies for just 1% of Chrome users, they said the company still hadn't prepared the market.
Third-order effects
- If the pattern holds, browser vendors — not advertisers or independent adtech — become the arbiters of what behavioral targeting is allowed to look like, since any cookie replacement runs through Chrome's own API decisions.
- The cycle of propose-criticize-replace points toward regulation and platform policy converging on the same conclusion: user-level tracking gives way to coarser, browser-mediated interest categories, with each iteration trading granularity for new, contested privacy exposures.
The trend: Third-party cookies are being replaced not by a single successor but by successive browser-controlled targeting APIs, with privacy advocates' critiques forcing redesigns at every step.