Conversation

Rich Felker
@RichFelker
Everyone's talking about how to make your site request Chrome not do their FLoC tracking shit, but how about a bigger hammer: Apache, nginx, lightttpd, Caddy, etc.: make any request with FLoC headers in it reply with result code 400. Force Google to remove that shit entirely.
17
439
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@RichFelker
I could see Caddy conservatively setting some privacy / security headers by default but nothing beyond that. I don't think any web server is going to break the web for a subset of users by default. The only way Chrome doesn't deploy FLOC is Google deciding it's not a good idea.
1
3
Daniel Micay
@DanielMicay
Replying to
@RichFelker
It's currently only enabled for users with a bunch of privacy invasive settings. Disabling any of the relevant settings in Chrome or your Google account disables being a candidate for the trial. Currently wouldn't be telling users to disable FLoC but rather more invasive stuff.
2
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@RichFelker
Chrome: * Third party cookies enabled * Signed into Chrome with Google account * Chrome Sync enabled for history * No sync passphrase Google account: * Web & App Activity enabled + toggle to include Chrome history * Ad Personalization enabled + toggle to include app activity
2
Rich Felker
@RichFelker
Replying to
@DanielMicay
Aren't *all* of those on by default? Including Chrome sign-in and sync since they made it happen automatically when you login to Google website via Chrome unless you find hidden switches to opt out?
1
Daniel Micay
@DanielMicay
Replying to
@RichFelker
Sync is never automatically enabled. They made it so that by default, signing into Google will sign into the browser but it won't enable sync automatically. If you explicitly sign into the browser, it works differently and enables Sync, since that's the point of signing into it.
1