网络广告的隐私限制：对Google FLoC的事后实证分析
Privacy Limitations Of Interest-based Advertising On The Web: A Post-mortem Empirical Analysis Of Google's FLoC
摘要：
2020年，谷歌宣布将在Chrome浏览器中禁用第三方Cookie，以改善用户隐私。为了继续支持基于兴趣的广告，同时降低个性化用户跟踪的风险，谷歌提出了FLoC。FLoC算法将用户分配到“队列”，这些队列代表具有相似浏览行为的用户组，以便广告可以基于他们的队列提供给用户。2022年，在真实世界的试验中测试了FLoC后，谷歌取消了这一提议，几乎没有解释。在这项工作中，我们通过将FLoC的实现应用于从超过90，000个美国设备中收集的浏览数据集，对FloC的两个关键隐私风险进行了事后分析。首先，我们展示了与其隐私目标相反的是，FLoC如何通过为跨站点的用户提供唯一标识符来实现跨站点用户跟踪，类似于FLoC旨在改进的第三方Cookie。我们展示了随着时间的推移观察到的FLoC队列ID序列如何为跟踪器提供此标识符，即使禁用了第三方Cookie。我们估计数据集中可以通过FLoC ID唯一识别的用户数量在3周后超过50%，在4周后超过95%。我们还展示了当队列数据与浏览器指纹相结合时，这些风险如何增加，以及我们的结果如何低估了FLoC在现实世界部署中可能带来的真正风险。其次，我们研究了FLoC泄露敏感人口统计信息的风险。虽然我们发现人口统计组之间的浏览行为存在统计学显著差异，但我们并没有发现FLoC有暴露数据集中用户种族或收入信息的显著风险。我们的贡献提供了见解和示例分析，为未来的方法，寻求保护用户隐私，同时货币化的网络。
英文摘要：
In 2020, Google announced it would disable third-party cookies in the Chrome browser to improve user privacy. In order to continue to enable interest-based advertising while mitigating risks of individualized user tracking, Google proposed FLoC. The FLoC algorithm assigns users to "cohorts" that represent groups of users with similar browsing behaviors so that ads can be served to users based on their cohort. In 2022, after testing FLoC in a real world trial, Google canceled the proposal with little explanation. In this work, we provide a post-mortem analysis of two critical privacy risks for FloC by applying an implementation of FLoC to a browsing dataset collected from over 90,000 U.S. devices over a one year period. First, we show how, contrary to its privacy goals, FLoC would have enabled cross-site user tracking by providing a unique identifier for users available across sites, similar to the third-party cookies FLoC was meant to be an improvement over. We show how FLoC cohort ID sequences observed over time can provide this identifier to trackers, even with third-party cookies disabled. We estimate the number of users in our dataset that could be uniquely identified by FLoC IDs is more than 50% after 3 weeks and more than 95% after 4 weeks. We also show how these risks increase when cohort data are combined with browser fingerprinting, and how our results underestimate the true risks FLoC would have posed in a real-world deployment. Second, we examine the risk of FLoC leaking sensitive demographic information. Although we find statistically significant differences in browsing behaviors between demographic groups, we do not find that FLoC significantly risks exposing race or income information about users in our dataset. Our contributions provide insights and example analyses for future approaches that seek to protect user privacy while monetizing the web.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
