Add HTTP header to opt out of "interest cohort" training

At least one commonly used web browser is planning to deploy a system in which users are classified into “interest cohorts” based on web history. (Federated Learning of Cohorts, or FLoC). This is widely considered a risk to user privacy. Background information is available from

• EFF

• Gizmodo

If MDN visits are used to classify users into a “web developer” cohort, then unpredictable and possibly adverse effects will ensue. Some MDN users might be classified as web developers, and therefore good possible tenants, by landlords. Others might be classified by their current employers as people seeking new jobs as web developers, and suffer consequences at work. Still other users might be classified as web people and placed at risk for “spear phishing” attacks against web sites.

Because the training of cohorts has not been independently evaluated for privacy or security, and because cohort training is currently opt-out rather than opt-in, please add the opt-out HTTP header to MDN.

Permissions-Policy: interest-cohort=()

More info on opting out: https://github.com/WICG/floc#opting-out-of-computation

[dmarti]

@schalkneethling The first origin trial in Google Chrome has come to an end. There may be a second trial coming soon, but so far we don’t know much about how FLoC will be changed. It is likely that FLoC training will only happen on pages on which the FLoC API is called, which might make the opt-out header unnecessary, but I still don’t know how a script injected into a page by a browser extension might affect this. ( https://github.com/WICG/floc/issues/33#issuecomment-802248998 )

More info: https://digiday.com/marketing/google-switch-floc-cookie-replacement-fingerprinting-potential/

[caugner]

FLoC seems to have been replaced by the Topics API, but I don’t think it makes sense to keep tracking this here in an open yari issue.

Once this becomes significantly more prominent and therefore relevant again, we should discuss this.