Now, before you start reading this, I’ll just tell you up front: This is all old news and likely no longer relevant to you. Or at least not for long anymore. However, I still think it is worth mentioning as a similar technology might show up in the future, and if it does, it will likely not be less dangerous than [FLoC] or its successor, the [Topics API], which I learned about from [this blog post at saptalks.blog]. So what is this stuff? Well, since third-party cookies have basically been thrown out the window when it comes to tracking users on the web, Google came up with a new technology woven directly into their Chrome browser to replace those cookies. The idea is that websites run sandboxed within your Chrome browser, but the browser itself would do the tracking and data collection on the client side, then communicate the collected data to companies to do targeted advertising based on your personal browsing profile. Somehow the browser is supposed to exclude “sensitive” information, but I doubt that this would’ve worked all that well.
This is bad for obvious reasons, potentially even more so than third-party cookies ever were. Now that the functionality is woven into the web browser itself, there’s no easy escape left (other than using Mozilla Firefox or Apple Safari instead). But let us face it: Google Chrome has a market share of around 70% by now! Safari comes in as a distant second with around 15% market share, which makes it pretty clear how insignificant the rest is – sadly including Firefox.
In any case, FLoC has been phased out and its successor, the Topics API is [scheduled to be removed] from future versions of Google Chrome as well. I guess the backlash was pretty intense.
But the technology is still there for now, so I’ve modified my web servers’ configuration to transmit a HTTP header that switches FLoC off in your Chrome browser (should you be using it), at least for most web services on this server, including this blog.
The blog post I linked above shows you how to do this for an nginx web server, but this is possible with the good old Apache server as well. Make sure you have the module mod_headers.so loaded, and add this to your httpd.conf:
<IfModule mod_headers.c> Header always set Permissions-Policy "interest-cohort=(), browsing-topics=()" </IfModule>
Restart your Apache server and you’re done. The header submission can be tested with a wide variety of tools, one being [curl], in my case by running $ curl -I http://www.xin.at:
HTTP/1.1 200 OK Date: Mon, 15 Dec 2025 06:14:00 GMT Server: Apache Permissions-Policy: interest-cohort=(), browsing-topics=() Last-Modified: Sat, 27 Aug 2022 10:53:28 GMT ETag: "22000000001684-1464-5e736d73d881c" Accept-Ranges: bytes Content-Length: 5220 Content-Type: text/html; charset=UTF-8
With this, your Chrome browser would not leak data about your interactions with or comments on wp.xin.at to any advertising company. I guess I’ll have to stay vigilant about stuff like this in the future as well! Also, if you have to use or want to keep using Google Chrome, it might be a good idea to keep it up to date, not just for security reasons, but also because that way you’ll get rid of the Topics API as soon as possible.
At the time of writing the current major version of Chrome is 143. Deprecation of the Topics API should start with version 144 with removal being scheduled for version 150.
Google Federated Learning of Cohorts and the Topics API © 2025 by The GAT at XIN.at is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
