---
title: 'FLoC: Federated Learning of Cohorts'
url: https://www.emergentmind.com/topics/floc
type: topic
---

# FLoC: Federated Learning of Cohorts

Searching arXiv for recent and foundational papers on FLoC.
FLoC, short for **Federated Learning of Cohorts**, was Google’s proposed browser-based mechanism for interest-based advertising within the **Privacy Sandbox**, introduced as a replacement for classic **third-party cookies** in Chrome. Its stated purpose was to preserve personalized advertising while reducing individualized cross-site tracking by assigning users to **cohorts** derived from browsing behavior rather than exposing a stable user-level identifier [2201.13402]. In the version analyzed in the literature, the browser converted recent browsing history into a cohort identifier using **SimHash** and a subsequent grouping procedure intended to yield **\(k\)-anonymous cohorts**; websites and advertising technology could then access the cohort identifier through a browser API [2201.13402]. Subsequent technical and legal analyses converged on a more critical picture: FLoC remained a cross-site behavioral signal, could support re-identification over time, interacted poorly with auxiliary tracking methods such as fingerprinting, and did not clearly escape consent requirements under European device-access rules [2201.13402] [2302.13635] [2407.03846].

## 1. Origins and stated purpose

FLoC emerged in the context of Chrome’s announced plan to disable third-party cookies while preserving the economic role of interest-based advertising [2201.13402]. In legal analysis, this shift was situated against the background of the **Planet49** judgment of the European Court of Justice and the German Federal Court’s **Cookie Consent II** decision, which clarified that advertising-related third-party cookies generally require **explicit, informed consent** [2407.03846]. Within that setting, FLoC was framed as a technical architecture that might continue personalized advertising without relying on the same cookie model.

The design rationale was group-based rather than individual-based targeting. Instead of letting third parties assign and read a user-specific cookie across sites, Chrome would analyze browsing history locally and assign the browser to a cohort of users with similar browsing behavior [2407.03846]. This was presented as a **privacy-improving substitute for third-party cookies**, because advertisers would receive a cohort-level signal rather than raw browsing history or a direct user-level identifier [2407.03846]. The literature, however, emphasizes that the commercial objective remained substantially unchanged: infer interests from web behavior and use them to personalize ads [2407.03846].

An important qualification appears in the post-mortem empirical literature: despite the term **Federated Learning**, the deployed FLoC design studied in the 2021 origin trial did **not actually use federated learning** in the sense usually implied by decentralized model training [2201.13402]. SimHash computation could occur locally, but the grouping step required centralized processing to construct the mapping from hash prefixes to cohort IDs [2201.13402].

## 2. Technical architecture

At a high level, FLoC took a user’s recent browsing history and transformed it into a cohort ID [2201.13402]. In the version analyzed in the empirical post-mortem, the input was the set of public domains, namely **eTLD+1s**, visited during the preceding **7-day period** [2201.13402]. The browser did not use full URLs or page content in that version; it used the set of domains visited in the time window [2201.13402].

The first stage was **SimHash**, a locality-sensitive hash. For a browsing history represented as a finite set of domains \(D\), the paper formalizes the construction as follows [2302.13635]:
\[
y^{(D)} = \sum_{d \in D} \eta_d
\]
and
\[
z^{(D)} = \operatorname{sgn}(y^{(D)}).
\]
Here, each domain \(d\) is associated with a pseudorandomly generated vector \(\eta_d \in \mathbb{R}^{\ell}\), and the sign is applied componentwise, yielding a binary vector \(z^{(D)} \in \{0,1\}^{\ell}\) [2302.13635]. SimHash was chosen because similar inputs tend to produce similar outputs, a property Google had previously used for near-duplicate website detection and repurposed in FLoC for behavioral similarity grouping [2407.03846].

SimHash alone did not enforce anonymity. In the 2021 origin-trial design, Google paired it with **PrefixLSH**, which grouped hash values into buckets of at least size \(k\), producing **\(k\)-anonymous cohorts** [2201.13402]. In that trial, the empirical paper reports **\(k=2000\)** [2201.13402]. Formally, if \(\sigma\) is a bitstring prefix, the cohort corresponding to that prefix can be written as [2302.13635]
\[
C_\sigma = \{ D \in \mathcal{D} : \sigma \prec z^{(D)} \},
\]
and a cohort is **\(k\)-decomposable** if both children satisfy
\[
|C_{\sigma 0}| \ge k \quad \text{and} \quad |C_{\sigma 1}| \ge k.
\]
Cohort assignment was thus fundamentally prefix-based [2302.13635].

The architecture also had a centralized component. The post-mortem study stresses that PrefixLSH required access to the global population of hashes in order to construct the mapping from SimHash prefixes to cohort IDs, so Google relied on a centralized **anonymity server** to produce the prefix-to-cohort mapping; the browser then stored that mapping and derived its cohort locally [2201.13402]. The resulting cohort ID was exposed to websites and ad technology through a browser API [2201.13402].

## 3. Privacy model and its intended guarantees

FLoC’s privacy argument rested on cohorting. The system was supposed to replace a stable user-level identifier with a group-level identifier shared by many users, thereby making re-identification more difficult [2201.13402] [2407.03846]. In the origin trial summarized by the attack literature, Chrome used a **50-bit SimHash**, but only **13 to 20 bits** were needed to split users into around **33,000 cohorts**, each with at least **2000** users [2302.13635].

This design encouraged an intuition of anonymity by “hiding in a crowd.” The literature identifies three associated expectations. One was a practical intuition of **non-invertibility**: that exposing a SimHash or a derived cohort ID would not reveal the browsing history. A second was **\(k\)-anonymity via cohorts**. A third was that advertisers would learn only cohort membership rather than the underlying behavioral record [2302.13635].

The empirical and cryptanalytic studies argue that these intuitions were structurally fragile. Locality-sensitive hashing is useful precisely because it preserves input similarity, and that same property means the output retains information about the input [2302.13635]. The attack literature therefore emphasizes that SimHash is not a cryptographic hash and that prefix-based cohorting reveals a fragment of the underlying hash [2302.13635]. The post-mortem empirical study similarly shows that even if a single weekly cohort assignment is not identifying by itself, the longitudinal sequence of cohort IDs can become highly identifying [2201.13402].

## 4. Empirical privacy limitations

The most prominent empirical result is the analysis of cross-site tracking risk using a browsing dataset collected from over **90,000 U.S. devices** over one year [2201.13402]. After preprocessing and filtering to valid weekly domain sets with at least **7 unique domains**, the authors obtained **2,073,405 machine-week records** [2201.13402]. To study longitudinal identifiability, they built up to **13 non-overlapping 4-week sequences** per machine and retained only sequences meeting the threshold in all four weeks, producing \(N = 305{,}312\) four-week samples [2201.13402].

The central finding was that cohort sequences functioned as cross-site identifiers. With **\(k=2000\)** and \(N=305{,}312\), the authors found that **more than 50%** of samples were uniquely identifiable after **3 weeks** of observed cohort IDs and **more than 95%** after **4 weeks** [2201.13402]. The mechanism is straightforward: even if each weekly cohort is large, the trajectory \(\{c_1,c_2,c_3,c_4\}\) through cohort space may be unique [2201.13402]. This undermines the intended anonymity guarantee, which applied only to a single assignment snapshot.

The same study reports that these estimates are conservative. Their effective sample produced only about **97–100 cohorts per week** under \(k=2000\), whereas Google reported **33,872 cohorts** in the origin trial at the same \(k\) [2201.13402]. Because more cohorts imply more possible week-to-week combinations, the authors argue that real-world risk at Chrome scale would likely be worse [2201.13402].

The paper also examined demographic leakage. Although browsing behavior differed significantly across race and household income groups, the authors did **not** find that FLoC significantly leaked race or income under the **\(t\)-closeness** framework adapted from Google’s sensitive-cohort analysis [2201.13402]. They define the most overrepresented category in cohort \(C\) as
\[
X^{*}_C = \arg\max_{X} \left( CohortFreq(X, C) - PopulationFreq(X) \right)
\]
and treat a cohort as violating \(t\)-closeness if
\[
CohortFreq(X^{*}_C, C) - PopulationFreq(X) > t.
\]
At the operational threshold **\(t=0.1\)**, they did not observe excess demographic leakage beyond chance in their dataset [2201.13402]. This result is more limited than the tracking result: it pertains to that dataset, those attributes, and that metric.

A separate technical critique focused on attacks against the hash representation itself. That work argues that **locality-sensitive hashing does not guarantee privacy**, and presents attacks refuting the **pre-image resistance, anonymity, and privacy guarantees** claimed for FLoC [2302.13635]. The authors formulate SimHash inversion as an integer program. Given a candidate set of domains \(D = \{d_1,\ldots,d_n\}\) and a target SimHash \(z\), they search for binary variables \(x_i \in \{0,1\}\) satisfying
\[
(2z_j-1)\sum_{i\le n}\eta_{d_i,j}x_i \ge 0,\quad \text{for } j\le \ell,
\]
while maximizing
\[
\max_x \sum_{i\le n} x_i.
\]
In experiments on histories of length **32**, the success rate was **64%** for **15-bit** SimHash in an average of **5.03 s**, and **34%** for **20-bit** SimHash in **5.89 s** [2302.13635]. These bit lengths overlapped the **13–20 bit** effective regime used to form origin-trial cohorts [2302.13635].

The same paper describes a **Sybil deanonymization attack**. By observing a target’s cohort prefix, constructing fake histories with matching SimHash prefixes, and injecting many Sybil users, an attacker can force further prefix splits and thereby learn additional bits of the target’s hash [2302.13635]. The paper also presents a **GAN-IP** reconstruction attack using **LeakGAN** plus integer-program filtering. Its headline result is that the attack can reconstruct **10% or more** of browsing history for **30%** of users according to the abstract, while the main text reports that in around **28%** of cases the IP-filtered subset reconstructs more than **10%** of the target history [2302.13635]. The same study notes that in about **50%** of tests, the GAN component alone produced histories containing at least **10%** of the targeted history [2302.13635].

## 5. Interaction with fingerprinting and auxiliary signals

The empirical post-mortem stresses that FLoC’s risks are amplified when cohort information is combined with other tracking signals [2201.13402]. To illustrate this, the authors combine weekly cohort sequences with a deliberately weak fingerprint proxy, the user’s **U.S. state**, rather than using stronger high-entropy browser attributes [2201.13402]. Even that weak auxiliary signal materially increases the fraction of uniquely identifiable samples [2201.13402].

The legal analysis likewise highlights **fingerprinting** as a reason cohorting does not ensure anonymity [2407.03846]. Fingerprinting uses device and browser characteristics such as hardware, software, fonts, settings, and add-ons to distinguish users without cookies [2407.03846]. In that setting, a cohort ID becomes an additional behavioral feature rather than a replacement that neutralizes tracking. The combination of a cohort sequence and fingerprint data weakens the privacy argument that users are protected by large cohort size [2201.13402] [2407.03846].

This suggests a broader design lesson. A group identifier that is externally visible and updated over time may become a tracking surface once composed with other available signals. The post-mortem paper states this lesson explicitly: group identifiers are not harmless merely because they are not user-specific at a single instant; **longitudinal observability matters** [2201.13402].

## 6. Legal and regulatory analysis

Legal scholarship analyzing Google’s Privacy Sandbox situates FLoC within European and German rules governing storage of and access to information on users’ terminal equipment [2407.03846]. The key doctrinal point is that the relevant rules are **technology-neutral**. Under the paper’s analysis of **Article 5(3) of the ePrivacy Directive** and **§ 25 TTDSG**, what matters is not whether a technology uses conventional HTTP cookies, but whether it stores information on the user’s device or accesses information already stored there [2407.03846].

The paper’s detailed doctrinal analysis is centered on **Topics**, the successor system, but its reasoning is presented as directly relevant to FLoC-like architectures [2407.03846]. For Topics, the authors conclude that Chrome stores advertising-relevant information on the device and that adtech entities invoking the API access that information; because the exceptions in § 25(2) TTDSG do not apply, **consent is required** [2407.03846]. The same logic is then said to strongly imply that **FLoC-like systems are not lawful merely because they are “cookieless”** [2407.03846].

The paper also notes that Google tested FLoC **outside the scope of the GDPR and the ePrivacy Directive**, which itself indicates the legal sensitivity of the model [2407.03846]. In this analysis, abandoning cookies does not by itself avoid the consent framework established by **Planet49**, **Cookie Consent II**, and the TTDSG implementation of Article 5(3) [2407.03846].

A further issue is transparency. Under FLoC, users did **not** have the same ability to inspect or opt out of assigned categories that Topics later introduced [2407.03846]. This was identified not as a minor usability issue but as part of the architecture’s broader privacy and accountability deficit.

## 7. Criticism, abandonment, and succession by Topics

The literature characterizes FLoC as heavily criticized on both technical and legal grounds [2407.03846]. Technically, the criticism centered on the fact that cohorting did not reliably prevent re-identification, especially over time and especially when combined with fingerprinting [2201.13402] [2407.03846]. Cryptanalytically, the criticism emphasized that SimHash and prefix-based cohorting leaked structured information and were vulnerable to inversion and Sybil manipulation [2302.13635]. Legally, the criticism focused on the point that “cookieless” behavioral advertising mechanisms can still trigger consent requirements because they still store and expose advertising-relevant information derived from device activity [2407.03846].

Google eventually abandoned FLoC after the origin trial [2201.13402]. The empirical post-mortem does not claim access to Google’s internal reasoning, but it presents a plausible technical explanation: FLoC recreated a cross-site behavioral identifier, while publicly available evidence did not show a convincing privacy-utility tradeoff in its favor [2201.13402].

The successor described in the legal literature is **Google Topics**, also within the Privacy Sandbox [2407.03846]. Topics replaces the cohort ID with a browser-maintained list of **predefined topics**, with Chrome determining the user’s top five topics each week, storing topics for **three weeks**, and exposing selected topics through the Topics API [2407.03846]. The relevant JavaScript call is
```javascript
const Topics = await document.browsingTopics().
```
The paper portrays Topics as more bounded and transparent than FLoC because topics are predefined, retained only for three weeks, exposed with a **5% chance** of an added random topic, and inspectable and deletable by users [2407.03846]. Yet the same paper concludes that Topics still does **not** escape consent requirements and is not a legal bypass around European consent law [2407.03846].

## 8. Misconceptions and broader significance

A common misconception is that FLoC implemented federated learning in the strong, standard sense. The empirical post-mortem explicitly states that the deployed FLoC design did **not actually use federated learning**, because the anonymity mapping required centralized population-level processing [2201.13402]. A second misconception is that replacing user-level cookies with large cohorts solves cross-site tracking. The longitudinal identifiability results show that observable cohort sequences can themselves become identifiers [2201.13402]. A third misconception is that a locality-sensitive hash protects privacy merely because it is a hash. The attack paper rejects that inference and argues that if a hash is useful for similarity, it necessarily carries a fingerprint of the input [2302.13635].

FLoC is therefore significant less as a deployed standard than as a failed but influential design point in post-cookie advertising. It clarified that browser-mediated behavioral advertising signals remain vulnerable to composition attacks, longitudinal tracking, and regulatory scrutiny [2201.13402] [2302.13635] [2407.03846]. It also sharpened a broader methodological lesson for privacy-preserving advertising research: privacy evaluations must consider temporal accumulation, active adversaries, and auxiliary signals rather than only one-shot anonymity metrics [2201.13402]. In that sense, FLoC’s historical role is that of a post-cookie architecture whose failure exposed the structural difficulty of preserving behavioral ad utility while eliminating tracking.

Source: https://www.emergentmind.com/topics/floc