Irreal

It won’t come as a surprise to anyone with the slightest bit of skepticism or, indeed, two brain cells to rub together that Google’s replacement for cookies, FLoC, is a privacy nightmare. Google, of course, is touting the system as a privacy respecting alternative to third party cookies but privacy experts are warning that they have the potential to be a worse privacy problem than cookies.

It didn’t take long for proof of these assertions to emerge. According this Digiday article, adtech firms are already testing ways of linking of FLoC indentifiers to personal data they already hold. If you’re surprised, you shouldn’t be. This is what adtech does: they’ll exploit any opening in their insatiable quest for data about us. There’s no piece of information they consider too small to exploit. Their goal is to build a complete profile of every person using the Internet.

It won’t—believe me—end with using that information to target ads at you. The iron law of data acquisition guarantees that it will be abused. That will probably start with law enforcement demanding access but sooner or later people like divorce lawyers will also want to get at it. Everything about you will be available for anyone who can convince a court that they have a need for it.

If you’re interested in how FLoC can be exploited, here’s a useful privacy analysis of FLoC that describes how it can be exploited to link the FLoC code back to individuals. Be sure to give it a read before you accept Google’s assurances about FLoC respecting your privacy. In the meantime, Amazon is reportedly blocking FLoC on most of their sites. That’s for competitive advantage, of course, but is nevertheless good to see.

We haven’t talked about the Iron Law for a while so here’s an example of its action on steroids. This story is about Britain’s National Health Service and their contemplated betrayal of their patients’ privacy. I’m an American so I see this through American eyes but I can’t imagine that my British cousins see it much differently.

Here in the U.S., the doctor/patient relationship is sacrosanct and can’t be pierced—except under extraordinary, very narrow conditions—even by the courts. It is, in fact, a crime to divulge medical information (see the HIPPA act). The NHS, on the other hand, has a sordid history of trying to grab patient data and sell it to third parties including, incredibly, Google.

In their latest attempted grab, the NHS has directed the Kingdom’s GPs to provide all their patients’ data to the service so that it can be made available to third parties for research purposes. Although the service has downplayed the significance of the actions, many GPs are alarmed and have vowed to refuse to comply. Patients can opt out (until June 23) but the program has received little attention and most are unaware of it. The Labour Party has called for a delay until patients can be informed.

It’s classic iron law: if the data is collected, it will be abused. In this case it’s worse. The data had to be collected to provide good health care to the people providing it. It makes it even worse that others would like to grab and sell it.

The U.S. and Britain have very different healthcare systems and neither side can understand the other’s insistence on their system’s superiority but I’m pretty sure we can all agree that selling patient data—whatever the reason—is wrong. It’s not that the NHS is malevolent; they’re pursuing a noble goal but they’re pursuing it with other people’s property. If they want the data, the least they can do is ask.