FLoC: Federated Learning of Cohorts

• FLoC is a browser-based mechanism for interest-based advertising that groups users into k-anonymous cohorts using SimHash and centralized mapping.
• The system aimed to replace third-party cookies, but studies revealed significant risks in longitudinal tracking and potential re-identification.
• Critiques highlight that FLoC’s privacy protections can be undermined by auxiliary signals like fingerprinting, challenging its effectiveness.

Searching arXiv for recent and foundational papers on FLoC. FLoC, short for Federated Learning of Cohorts, was Google’s proposed browser-based mechanism for interest-based advertising within the Privacy Sandbox, introduced as a replacement for classic third-party cookies in Chrome. Its stated purpose was to preserve personalized advertising while reducing individualized cross-site tracking by assigning users to cohorts derived from browsing behavior rather than exposing a stable user-level identifier (Berke et al., 2022). In the version analyzed in the literature, the browser converted recent browsing history into a cohort identifier using SimHash and a subsequent grouping procedure intended to yield $k$-anonymous cohorts; websites and advertising technology could then access the cohort identifier through a browser API (Berke et al., 2022). Subsequent technical and legal analyses converged on a more critical picture: FLoC remained a cross-site behavioral signal, could support re-identification over time, interacted poorly with auxiliary tracking methods such as fingerprinting, and did not clearly escape consent requirements under European device-access rules (Berke et al., 2022, Turati et al., 2023, Köppel et al., 2024).

1. Origins and stated purpose

FLoC emerged in the context of Chrome’s announced plan to disable third-party cookies while preserving the economic role of interest-based advertising (Berke et al., 2022). In legal analysis, this shift was situated against the background of the Planet49 judgment of the European Court of Justice and the German Federal Court’s Cookie Consent II decision, which clarified that advertising-related third-party cookies generally require explicit, informed consent (Köppel et al., 2024). Within that setting, FLoC was framed as a technical architecture that might continue personalized advertising without relying on the same cookie model.

The design rationale was group-based rather than individual-based targeting. Instead of letting third parties assign and read a user-specific cookie across sites, Chrome would analyze browsing history locally and assign the browser to a cohort of users with similar browsing behavior (Köppel et al., 2024). This was presented as a privacy-improving substitute for third-party cookies, because advertisers would receive a cohort-level signal rather than raw browsing history or a direct user-level identifier (Köppel et al., 2024). The literature, however, emphasizes that the commercial objective remained substantially unchanged: infer interests from web behavior and use them to personalize ads (Köppel et al., 2024).

An important qualification appears in the post-mortem empirical literature: despite the term Federated Learning, the deployed FLoC design studied in the 2021 origin trial did not actually use federated learning in the sense usually implied by decentralized model training (Berke et al., 2022). SimHash computation could occur locally, but the grouping step required centralized processing to construct the mapping from hash prefixes to cohort IDs (Berke et al., 2022).

2. Technical architecture

At a high level, FLoC took a user’s recent browsing history and transformed it into a cohort ID (Berke et al., 2022). In the version analyzed in the empirical post-mortem, the input was the set of public domains, namely eTLD+1s, visited during the preceding 7-day period (Berke et al., 2022). The browser did not use full URLs or page content in that version; it used the set of domains visited in the time window (Berke et al., 2022).

The first stage was SimHash, a locality-sensitive hash. For a browsing history represented as a finite set of domains $D$, the paper formalizes the construction as follows (Turati et al., 2023): $y^{(D)} = \sum_{d \in D} \eta_d$ and

$z^{(D)} = \operatorname{sgn}(y^{(D)}).$

Here, each domain $d$ is associated with a pseudorandomly generated vector $\eta_d \in \mathbb{R}^{\ell}$, and the sign is applied componentwise, yielding a binary vector $z^{(D)} \in \{0,1\}^{\ell}$ (Turati et al., 2023). SimHash was chosen because similar inputs tend to produce similar outputs, a property Google had previously used for near-duplicate website detection and repurposed in FLoC for behavioral similarity grouping (Köppel et al., 2024).

SimHash alone did not enforce anonymity. In the 2021 origin-trial design, Google paired it with PrefixLSH, which grouped hash values into buckets of at least size $k$, producing $k$-anonymous cohorts (Berke et al., 2022). In that trial, the empirical paper reports $k=2000$ (Berke et al., 2022). Formally, if $D$0 is a bitstring prefix, the cohort corresponding to that prefix can be written as (Turati et al., 2023)

$D$1

and a cohort is $D$2-decomposable if both children satisfy

$D$3

Cohort assignment was thus fundamentally prefix-based (Turati et al., 2023).

The architecture also had a centralized component. The post-mortem study stresses that PrefixLSH required access to the global population of hashes in order to construct the mapping from SimHash prefixes to cohort IDs, so Google relied on a centralized anonymity server to produce the prefix-to-cohort mapping; the browser then stored that mapping and derived its cohort locally (Berke et al., 2022). The resulting cohort ID was exposed to websites and ad technology through a browser API (Berke et al., 2022).

3. Privacy model and its intended guarantees

FLoC’s privacy argument rested on cohorting. The system was supposed to replace a stable user-level identifier with a group-level identifier shared by many users, thereby making re-identification more difficult (Berke et al., 2022, Köppel et al., 2024). In the origin trial summarized by the attack literature, Chrome used a 50-bit SimHash, but only 13 to 20 bits were needed to split users into around 33,000 cohorts, each with at least 2000 users (Turati et al., 2023).

This design encouraged an intuition of anonymity by “hiding in a crowd.” The literature identifies three associated expectations. One was a practical intuition of non-invertibility: that exposing a SimHash or a derived cohort ID would not reveal the browsing history. A second was $D$4-anonymity via cohorts. A third was that advertisers would learn only cohort membership rather than the underlying behavioral record (Turati et al., 2023).

The empirical and cryptanalytic studies argue that these intuitions were structurally fragile. Locality-sensitive hashing is useful precisely because it preserves input similarity, and that same property means the output retains information about the input (Turati et al., 2023). The attack literature therefore emphasizes that SimHash is not a cryptographic hash and that prefix-based cohorting reveals a fragment of the underlying hash (Turati et al., 2023). The post-mortem empirical study similarly shows that even if a single weekly cohort assignment is not identifying by itself, the longitudinal sequence of cohort IDs can become highly identifying (Berke et al., 2022).

4. Empirical privacy limitations

The most prominent empirical result is the analysis of cross-site tracking risk using a browsing dataset collected from over 90,000 U.S. devices over one year (Berke et al., 2022). After preprocessing and filtering to valid weekly domain sets with at least 7 unique domains, the authors obtained 2,073,405 machine-week records (Berke et al., 2022). To study longitudinal identifiability, they built up to 13 non-overlapping 4-week sequences per machine and retained only sequences meeting the threshold in all four weeks, producing $D$5 four-week samples (Berke et al., 2022).

The central finding was that cohort sequences functioned as cross-site identifiers. With $D$6 and $D$7, the authors found that more than 50% of samples were uniquely identifiable after 3 weeks of observed cohort IDs and more than 95% after 4 weeks (Berke et al., 2022). The mechanism is straightforward: even if each weekly cohort is large, the trajectory $D$8 through cohort space may be unique (Berke et al., 2022). This undermines the intended anonymity guarantee, which applied only to a single assignment snapshot.

The same study reports that these estimates are conservative. Their effective sample produced only about 97–100 cohorts per week under $D$9, whereas Google reported 33,872 cohorts in the origin trial at the same $y^{(D)} = \sum_{d \in D} \eta_d$0 (Berke et al., 2022). Because more cohorts imply more possible week-to-week combinations, the authors argue that real-world risk at Chrome scale would likely be worse (Berke et al., 2022).

The paper also examined demographic leakage. Although browsing behavior differed significantly across race and household income groups, the authors did not find that FLoC significantly leaked race or income under the $y^{(D)} = \sum_{d \in D} \eta_d$1-closeness framework adapted from Google’s sensitive-cohort analysis (Berke et al., 2022). They define the most overrepresented category in cohort $y^{(D)} = \sum_{d \in D} \eta_d$2 as

$y^{(D)} = \sum_{d \in D} \eta_d$3

and treat a cohort as violating $y^{(D)} = \sum_{d \in D} \eta_d$4-closeness if

$y^{(D)} = \sum_{d \in D} \eta_d$5

At the operational threshold $y^{(D)} = \sum_{d \in D} \eta_d$6, they did not observe excess demographic leakage beyond chance in their dataset (Berke et al., 2022). This result is more limited than the tracking result: it pertains to that dataset, those attributes, and that metric.

A separate technical critique focused on attacks against the hash representation itself. That work argues that locality-sensitive hashing does not guarantee privacy, and presents attacks refuting the pre-image resistance, anonymity, and privacy guarantees claimed for FLoC (Turati et al., 2023). The authors formulate SimHash inversion as an integer program. Given a candidate set of domains $y^{(D)} = \sum_{d \in D} \eta_d$7 and a target SimHash $y^{(D)} = \sum_{d \in D} \eta_d$8, they search for binary variables $y^{(D)} = \sum_{d \in D} \eta_d$9 satisfying

$z^{(D)} = \operatorname{sgn}(y^{(D)}).$0

while maximizing

$z^{(D)} = \operatorname{sgn}(y^{(D)}).$1

In experiments on histories of length 32, the success rate was 64% for 15-bit SimHash in an average of 5.03 s, and 34% for 20-bit SimHash in 5.89 s (Turati et al., 2023). These bit lengths overlapped the 13–20 bit effective regime used to form origin-trial cohorts (Turati et al., 2023).

The same paper describes a Sybil deanonymization attack. By observing a target’s cohort prefix, constructing fake histories with matching SimHash prefixes, and injecting many Sybil users, an attacker can force further prefix splits and thereby learn additional bits of the target’s hash (Turati et al., 2023). The paper also presents a GAN-IP reconstruction attack using LeakGAN plus integer-program filtering. Its headline result is that the attack can reconstruct 10% or more of browsing history for 30% of users according to the abstract, while the main text reports that in around 28% of cases the IP-filtered subset reconstructs more than 10% of the target history (Turati et al., 2023). The same study notes that in about 50% of tests, the GAN component alone produced histories containing at least 10% of the targeted history (Turati et al., 2023).

5. Interaction with fingerprinting and auxiliary signals

The empirical post-mortem stresses that FLoC’s risks are amplified when cohort information is combined with other tracking signals (Berke et al., 2022). To illustrate this, the authors combine weekly cohort sequences with a deliberately weak fingerprint proxy, the user’s U.S. state, rather than using stronger high-entropy browser attributes (Berke et al., 2022). Even that weak auxiliary signal materially increases the fraction of uniquely identifiable samples (Berke et al., 2022).

The legal analysis likewise highlights fingerprinting as a reason cohorting does not ensure anonymity (Köppel et al., 2024). Fingerprinting uses device and browser characteristics such as hardware, software, fonts, settings, and add-ons to distinguish users without cookies (Köppel et al., 2024). In that setting, a cohort ID becomes an additional behavioral feature rather than a replacement that neutralizes tracking. The combination of a cohort sequence and fingerprint data weakens the privacy argument that users are protected by large cohort size (Berke et al., 2022, Köppel et al., 2024).

This suggests a broader design lesson. A group identifier that is externally visible and updated over time may become a tracking surface once composed with other available signals. The post-mortem paper states this lesson explicitly: group identifiers are not harmless merely because they are not user-specific at a single instant; longitudinal observability matters (Berke et al., 2022).

6. Legal and regulatory analysis

Legal scholarship analyzing Google’s Privacy Sandbox situates FLoC within European and German rules governing storage of and access to information on users’ terminal equipment (Köppel et al., 2024). The key doctrinal point is that the relevant rules are technology-neutral. Under the paper’s analysis of Article 5(3) of the ePrivacy Directive and § 25 TTDSG, what matters is not whether a technology uses conventional HTTP cookies, but whether it stores information on the user’s device or accesses information already stored there (Köppel et al., 2024).

The paper’s detailed doctrinal analysis is centered on Topics, the successor system, but its reasoning is presented as directly relevant to FLoC-like architectures (Köppel et al., 2024). For Topics, the authors conclude that Chrome stores advertising-relevant information on the device and that adtech entities invoking the API access that information; because the exceptions in § 25(2) TTDSG do not apply, consent is required (Köppel et al., 2024). The same logic is then said to strongly imply that FLoC-like systems are not lawful merely because they are “cookieless” (Köppel et al., 2024).

The paper also notes that Google tested FLoC outside the scope of the GDPR and the ePrivacy Directive, which itself indicates the legal sensitivity of the model (Köppel et al., 2024). In this analysis, abandoning cookies does not by itself avoid the consent framework established by Planet49, Cookie Consent II, and the TTDSG implementation of Article 5(3) (Köppel et al., 2024).

A further issue is transparency. Under FLoC, users did not have the same ability to inspect or opt out of assigned categories that Topics later introduced (Köppel et al., 2024). This was identified not as a minor usability issue but as part of the architecture’s broader privacy and accountability deficit.

7. Criticism, abandonment, and succession by Topics

The literature characterizes FLoC as heavily criticized on both technical and legal grounds (Köppel et al., 2024). Technically, the criticism centered on the fact that cohorting did not reliably prevent re-identification, especially over time and especially when combined with fingerprinting (Berke et al., 2022, Köppel et al., 2024). Cryptanalytically, the criticism emphasized that SimHash and prefix-based cohorting leaked structured information and were vulnerable to inversion and Sybil manipulation (Turati et al., 2023). Legally, the criticism focused on the point that “cookieless” behavioral advertising mechanisms can still trigger consent requirements because they still store and expose advertising-relevant information derived from device activity (Köppel et al., 2024).

Google eventually abandoned FLoC after the origin trial (Berke et al., 2022). The empirical post-mortem does not claim access to Google’s internal reasoning, but it presents a plausible technical explanation: FLoC recreated a cross-site behavioral identifier, while publicly available evidence did not show a convincing privacy-utility tradeoff in its favor (Berke et al., 2022).

The successor described in the legal literature is Google Topics, also within the Privacy Sandbox (Köppel et al., 2024). Topics replaces the cohort ID with a browser-maintained list of predefined topics, with Chrome determining the user’s top five topics each week, storing topics for three weeks, and exposing selected topics through the Topics API (Köppel et al., 2024). The relevant JavaScript call is $z^{(D)} = \operatorname{sgn}(y^{(D)}).$2 The paper portrays Topics as more bounded and transparent than FLoC because topics are predefined, retained only for three weeks, exposed with a 5% chance of an added random topic, and inspectable and deletable by users (Köppel et al., 2024). Yet the same paper concludes that Topics still does not escape consent requirements and is not a legal bypass around European consent law (Köppel et al., 2024).

8. Misconceptions and broader significance

A common misconception is that FLoC implemented federated learning in the strong, standard sense. The empirical post-mortem explicitly states that the deployed FLoC design did not actually use federated learning, because the anonymity mapping required centralized population-level processing (Berke et al., 2022). A second misconception is that replacing user-level cookies with large cohorts solves cross-site tracking. The longitudinal identifiability results show that observable cohort sequences can themselves become identifiers (Berke et al., 2022). A third misconception is that a locality-sensitive hash protects privacy merely because it is a hash. The attack paper rejects that inference and argues that if a hash is useful for similarity, it necessarily carries a fingerprint of the input (Turati et al., 2023).

FLoC is therefore significant less as a deployed standard than as a failed but influential design point in post-cookie advertising. It clarified that browser-mediated behavioral advertising signals remain vulnerable to composition attacks, longitudinal tracking, and regulatory scrutiny (Berke et al., 2022, Turati et al., 2023, Köppel et al., 2024). It also sharpened a broader methodological lesson for privacy-preserving advertising research: privacy evaluations must consider temporal accumulation, active adversaries, and auxiliary signals rather than only one-shot anonymity metrics (Berke et al., 2022). In that sense, FLoC’s historical role is that of a post-cookie architecture whose failure exposed the structural difficulty of preserving behavioral ad utility while eliminating tracking.