The floc is based on your browsing history. It is sort of a hash of the sites you visited and can be requested via a Js call by any (!) site you visit.
The floc is shared by a group of users not sure how that works but it is stated that those are a few 1000 large.
Combine that with other tracking stuff like fingerprinting and ip and you can easily identify a user (especially if you are google and your adds hang around everywhere in the net).