Federated Learning of Cohorts (FLoC)

The core privacy innovation of FLoC was moving the clustering algorithm to the browser. Instead of a central server collecting raw browsing history, the SimHash algorithm ran locally. The browser computed a compact, lossy representation of the user's history and assigned a Cohort ID based on this hash. This ensured that granular URL-level data never left the device, adhering to the principle of data minimization.

FLoC relied on Locality-Sensitive Hashing (LSH) , specifically SimHash, to group similar browsing behaviors. Key properties include:

• Dimensionality Reduction: High-dimensional browsing vectors were compressed into a low-bit fingerprint.
• Cosine Similarity: The Hamming distance between two SimHash values approximated the cosine similarity of their original history vectors.
• Fuzzy Matching: This allowed users with similar, but not identical, interests to land in the same cohort, creating the necessary anonymity set.

A central server maintained a list of valid, public cohorts, but the browser made the final assignment decision. To prevent fingerprinting, the API enforced a k-anonymity constraint. A cohort was only exposed to advertisers if it contained a minimum threshold of distinct users (e.g., thousands). If a user's calculated cohort was too small, the browser would either suppress the ID or assign a more general, larger cohort, preventing the creation of micro-groups that could identify individuals.

To prevent long-term tracking via a static ID, FLoC implemented strict temporal dynamics:

• Weekly Recalculation: The browser recalculated the cohort assignment every 7 days based on the recent history window.
• History Windowing: Only a sliding window of recent browsing data was used, preventing a user's entire lifetime history from defining their cohort.
• Anti-Fingerprinting: The rotation logic ensured that a user's ID changed frequently enough to prevent it from becoming a persistent, stable identifier.

The browser applied a local sensitive category blocklist before calculating the SimHash. Domains associated with sensitive topics—such as medical conditions, religious beliefs, or sexual orientation—were automatically excluded from the clustering input. This was a critical architectural safeguard to ensure that cohort assignment did not inadvertently reveal protected characteristics, aligning with differential privacy goals and anti-discrimination regulations.

FLoC was deprecated due to concerns over fingerprinting entropy and the potential for cohorts to be combined with other signals (like IP address) to re-identify individuals. It was replaced by the Topics API, which uses a fundamentally different architecture:

• Taxonomy-Based: Instead of unsupervised clustering, Topics maps history to a fixed, human-curated taxonomy of ~350 interest categories.
• Random Noise Injection: Topics introduces 5% random noise to provide plausible deniability.
• On-Device Inference: A lightweight classifier runs locally, eliminating the need for a central cohort list.