# Proposal: Add default header to disable FLoC **URL:** \ **Category:** rubyonrails-core\ **Created:** [May 21, 2021, 12:50pm UTC](https://discuss.rubyonrails.org/t/proposal-add-default-header-to-disable-floc/78025 "2021-05-21T12:50:28Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![rjk902fsdfuja09123fj](https://avatars.discourse-cdn.com/v4/letter/r/50afbb/32.png) [@rjk902fsdfuja09123fj](https://discuss.rubyonrails.org/u/rjk902fsdfuja09123fj)\ **Post date:** [May 21, 2021, 12:50pm UTC](https://discuss.rubyonrails.org/t/proposal-add-default-header-to-disable-floc/78025/1 "2021-05-21T12:50:28Z")
# In short I propose two things: - By default, we add the Permissions-Policy header to every app. This is similar to other security related headers Rails already has. - The default Permissions-Policy setting for FLoC is set to disabled. This means that your site’s visitors are not included in FLoC. Other settings are set to no default. # What is FLoC FLoC is a new technology that targets ads based on aggregated interests instead of identity full explanation. It promises to protect your identity, by telling advertisers your interests instead of your identity. It’s not ‘the best’ way to protect your privacy, but it’s better than third party tracking cookies. There is also critique on FLoC. I.e. the EFF has critized FLoC in this article. Some browsers said they won’t support the FLoC feature in their browser, i.e. Mozilla and [Brave](https://brave.com/why-brave-disables-floc/). Other frameworks said they will disable FLoC by default. I.e. Drupal ([https://www.drupal.org/project/drupal/issues/3209628](https://www.drupal.org/project/drupal/issues/3209628)) already implemented this. A core contributer from [WordPress](https://make.wordpress.org/core/2021/04/18/proposal-treat-floc-as-a-security-concern/) even wrote an essay on why it should be treated as a ‘security concern’ and not as a ‘feature’. WordPress will disable FLoC by default in version 5.8. # What is the Permissions-Policy header? The Permissions-Policy header is a W3C standard for enabling or disabling access to certain browser features you might need on a webpage. It is the renamed version of Feature-Policy. In it’s functionality, it is similar to Content Security Policies, but exclusively deal with browser features. It provides protection in the same way CSP does: by setting a policy, no injected content can use features that you don’t want them to use. Features that can be enabled/disabled are, amongst others, microphone, camera and geolocation. PR 41994 adds the Permissions-Policy header to Rails. There is currently no default setting set for FLoC. Permission-Policy headers are starting to be supported by more and more browsers ([caniuse](https://caniuse.com/permissions-policy)). ---
**Author:** ![rjk902fsdfuja09123fj](https://avatars.discourse-cdn.com/v4/letter/r/50afbb/32.png) [@rjk902fsdfuja09123fj](https://discuss.rubyonrails.org/u/rjk902fsdfuja09123fj)\ **Post date:** [May 21, 2021, 12:50pm UTC](https://discuss.rubyonrails.org/t/proposal-add-default-header-to-disable-floc/78025/2 "2021-05-21T12:50:59Z")
Other relevant links: - FLoC according to Google: [Building a privacy-first future for web advertising](https://blog.google/products/ads-commerce/2021-01-privacy-sandbox/) - EFF critizes FLoC: [Google’s FLoC Is a Terrible Idea | Electronic Frontier Foundation](https://www.eff.org/nl/deeplinks/2021/03/googles-floc-terrible-idea) - Mozilla won’t support FLoC: [Browser makers, including Mozilla's Firefox, are already ditching FLoC](https://digiday.com/media/browser-makers-now-including-mozillas-firefox-are-already-ditching-googles-proposed-cookieless-ad-targeting-method-floc/)) - Full list of Permission-Policy features: [https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md#policy-controlled-features](https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md#policy-controlled-features)) ---
**Author:** ![Dave\_Kimura](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/dave_kimura/32/3400_2.png) [@Dave\_Kimura](https://discuss.rubyonrails.org/u/Dave_Kimura)\ **Post date:** [May 22, 2021, 1:35pm UTC](https://discuss.rubyonrails.org/t/proposal-add-default-header-to-disable-floc/78025/3 "2021-05-22T13:35:00Z")
I was reading about this the other day. Personally, I don’t know how I feel about it because I do like the anonymity of it, but also don’t know how I much I actually trust Google to begin with. I think having, in the environment configs or an initializer, the options there as a default will be a good thing and allow the individual apps to determine what is the proper route for them. Regardless, the default should be highly visible for the app and not hidden the `config.load_defaults` [Google's Changing Online Ads In A Big Way (FLOC) - YouTube](https://www.youtube.com/watch?v=TqZ_mq86xEQ) was a pretty informative video on FLoC. ---
**Author:** ![wwahammy](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/wwahammy/32/1493_2.png) [@wwahammy](https://discuss.rubyonrails.org/u/wwahammy)\ **Post date:** [June 2, 2021, 4:06pm UTC](https://discuss.rubyonrails.org/t/proposal-add-default-header-to-disable-floc/78025/4 "2021-06-02T16:06:15Z")
I 100% agree with adding this as a default. It’s simple enough to override if a web site really wants to use FLOC. ---
**Author:** ![zzak](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/zzak/32/9116_2.png) [@zzak](https://discuss.rubyonrails.org/u/zzak)\ **Post date:** [June 3, 2021, 2:49am UTC](https://discuss.rubyonrails.org/t/proposal-add-default-header-to-disable-floc/78025/5 "2021-06-03T02:49:34Z")
If you haven’t already could you take a look at this PR? 🙇‍♂️ [https://github.com/rails/rails/pull/41994](https://github.com/rails/rails/pull/41994)