Still used in places that require a specific type of data privacy (ex:personal ads recommendations or keyboard predictions from usage), but it has a lot of overhead, is slower then other non federated processes, and can’t keep up with a centralized, high compute process, model so you would really only use it when you have to for legal reasons imho.
It's starting to get more attention in the healthcare sector.