This took me some time to understand as well, and I think I do understand now (but please correct me where I am wrong). The confusion is about “the calculations”.
There are two kinds of calculations here, and there are three ways for a site to “participate” in FLoC.
-
The “global” algorithm that determines the (global) cohorts. Opt-out impossible. Indeed All sites with publicly routable IP addresses that the user visits when not in incognito mode will be included in the POC cohort calculation.
-
The algorithm that determines the cohort for a specific user, based on their browsing habits. Opt-out based on header. A site should be able to declare that it does not want to be included in the user’s list of sites for cohort calculation. This can be accomplished via a new
interest-cohortpermissions policy. (taken from the same document as your quote)
- A site requesting the user specific cohort in order to get a targeted advertisement (or to misuse that information) using Javascript. The value is made available to websites via a new JavaScript API:
cohort = await document.interestCohort();.
That API does not work on pages that opted out using the header in #2 and this is where a lot of confusion came from. Any frame that is not allowedinterest-cohortpermission will have a default value returned when they calldocument.interestCohort().
I cannot find a good source for this.