nofloc

Warning

Deprecated and no longer maintained.

Google discontinued the FLoC proposal. This package is retained on npm only to avoid breaking existing projects and reproducible builds.

Do not use this package in new projects.

nofloc is a historical Express and Koa middleware that adds the following HTTP response header:

Permissions-Policy: interest-cohort=()

The package was originally created to opt websites out of Google's former Federated Learning of Cohorts (FLoC) proposal.

Project status

• Deprecated: July 25, 2026
• Maintenance: ended
• New features: not planned
• Security updates: not planned
• Recommended for new projects: no

This package does not provide general protection against advertising tracking, browser fingerprinting, or other privacy risks.

There is no direct replacement package recommended by this project. Applications that need a Permissions-Policy header should configure the policies required by their current browser-support and security requirements directly, or use an actively maintained security-header middleware.

Historical installation

npm install nofloc

Historical usage with Express

const { noflocExpress } = require("nofloc");

// Historical usage only.
app.use(noflocExpress());

Historical usage with Koa

const { noflocKoa } = require("nofloc");

// Historical usage only.
app.use(noflocKoa());

License

MIT