PING Privacy Review: User controls

[kdeqc]

trafficstars

The user control seems to be "yes/no" to allowing the feature. My preference would be more granular control so they could opt out of certain sites being used - or what they consider sensitive data. I could also see users wanting to be able to select who can receive cohort information (or maybe categories. like it can't be used for ad targeting but can be used for analytics/site personalization -like with the cookie categorization for the ePrivacy Directive).

I know the argument against user controls is generally that users don't actually use them, which is certainly valid. But I'd still argue that building something that could support user-specific controls from the start helps if 1) users actually do ask for more control, or 2) legislation comes in to play.

[dmarti]

A related set of functionality is exposing cohort information to browser extensions. (#17) A user who wanted some control but did not want to micromanage cohort permissions might choose to install an extension to do it. Cohorts are new functionality that do not have good analogs in other kinds of markets, so independent implementations of different cohort policies could be useful for learning about an appropriate set of defaults.

[michaelkleber]

Chrome will certainly include some sorts of controls surrounding FLoC, beyond a simple on/off switch.

For the early Origin Trial stage, we're still experimenting with the clustering algorithm, figuring out what sorts of entirely on-device cohort creation is possible and useful. Once we have a better idea of how FLoC should actually work, we will be in a better place to communicate to people about it — it's probably not surprising that the right user controls are different for "cluster based on the domains you visit" versus "cluster based on the topics you've read about".

[AramZS]

I think @dmarti has a good point here that an extension as agent of the user's control in this regard might be a useful way to look at exposing these controls. I am thinking of an interface similar to ones like Privacy Badger or Ghostery, that will allow a user to throw a switch to opt out of FLoC systems observing specific stuff they are doing--as opposed to an all or nothing approach--be it browsing a site or some other measure that FLoC uses. This would necessitate some elasticity on FLoC's part (as it should delay using a browser activity to go to FLoC to look for a signal in that regard to be flipped on by the user), but that seems to me to be the best way to provide users with controls on what parts of their activity end up being considered for their cohort.