DuckDuckGo recently engaged in a back-and-forth battle with Google over user privacy, and the company landed another blow by allowing its Chrome extension to block the new “privacy-focused” ad targeting system. ” from Google.
Google rolled out its new “Privacy Sandbox” ad targeting approach in stages, focusing on changes to its Chrome browser first. The system attempts to make personalized advertising more private by placing users in client-side interest groups, but it has been criticized by a number of privacy advocates.
DuckDuckGo Chrome extension lets users break out of the privacy sandbox
A blog post by DuckDuckGo announced that two core components of Google’s privacy sandbox, FLEDGE and Google Topics, can now be blocked individually or together in its recently updated Chrome extension. Together, FLEDGE and Topics are intended to replace the standard tracking cookie used for ad targeting (which Google intends to discontinue in Chrome by the end of 2022). The system is supposed to improve privacy by placing users into “interest buckets” instead of creating individual profiles on them, with the processing of these buckets handled on the browser side so that third parties have very limited access to them.
DuckDuckGo’s concerns about the privacy sandbox echo those already raised by digital privacy groups and national regulators around the world. Regulators have tended to be more concerned about the antitrust end of the proposal, speculating that Google will force the digital advertising market to move towards this technology. Privacy advocates point out that Google will also always have access to information about potentially sensitive demographic categories, and that it’s not impossible for third-party advertisers to use this system to identify and track individuals. DuckDuckGo’s Chrome extension therefore already has an interested market despite Google’s new systems which are not yet finalized.
The criticism isn’t particularly timely for the DuckDuckGo Chrome extension given the recent revelation that its web browser, which is touted as blocking all third-party user tracking, has quietly enabled Microsoft-owned services (such as Bing and LinkedIn) track and profile users. DuckDuckGo did not disclose this to the public, and it only came to light when a security researcher tracked browser traffic and found it providing information to Microsoft’s ad targeting services. This forced the CEO of DuckDuckGo to disclose that his contractual research partnership with Microsoft requires them to allow this type of user tracking.
FLoC to FLEDGE: Change to Google’s Advertising Targeting Plans
When Google first announced the Privacy Sandbox concept about two years ago, the original plan was to use a system called “Federated Learning of Cohorts” (FLoC) to replace tracking cookies. The FLoC plan was scrapped in early 2022 due to criticism over its use of “cohorts” of users with similar interests to the mechanism used to deliver advertisements. Topics was designed to replace the cohort system with around 300 standard categories; the user will be assigned to the top three categories of interest based on their browsing activity over the previous three weeks, with the categories rotating at least once a month. Google has promised that Chrome users will be able to see the categories they’re currently assigned to and temporarily disable or entirely remove topic categories they don’t want to be associated with. Depending on the level of privacy control it installs on, this could ultimately make the DuckDuckGo Chrome extension redundant.
Chrome is the only web browser in which Google can force the implementation of this concept, but it seems to hope that other browsers will join the system due to its heavy digital advertising program. It’s the part that has raised the antennae of national antitrust regulators, who fear that Google’s dominance of the digital marketing space will essentially force everyone to use whatever ad targeting system it sits on.
The Google subjects have alarmed privacy advocates because it does not rule out the possibility that third parties may use browser fingerprinting techniques to track individuals, and may even inadvertently assist them in the process. Google proposed to counter that with something called the “Privacy Budget,” a system that would only assign websites a certain amount of access to user information before they were cut off. Some research indicates that the system may leak information, the tracking mechanism itself could be used by tricky websites as an identifier, and it could potentially interrupt the operation of websites that exceed the information limit.
The DuckDuckGo Chrome extension is available through the Google Play Store and does not appear to allow ad targeting by Microsoft products as the company’s “Privacy Browser” does. Google’s timeline for the Privacy Sandbox project has Topics and FLEDGE fully implemented in Chrome by the end of 2022, but the Privacy Budget is still listed as “early stages” and won’t be ready until 2024.