Third-Party Cookie U-Turn By Google

Following a previous announcement four years ago that it would be blocking third-party cookies from its Chrome browser, Google appears to have ‘updated’ that firm commitment in favour of a new approach. 

What Has Google Said? An “Updated Approach” … 

Google’s most recent comment is that it now favours an “updated approach that elevates user choice. Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time”. 

In short, this appears to indicate not just some serious backtracking (much to the disappointment of the UK privacy watchdog) but that Google will continue to allow a third-party cookie-based system, will operate it in parallel with another system, and will just show users a pop-up asking them to decide to turn the third-party cookies on or off. 

Third-Party Cookies 

A cookie is a piece of code (used for tracking) that takes the form of a small text file that is stored on the browser of someone who visits a website. Whereas ‘first party’ cookies are more related to website analytics and don’t record where a user goes after leaving a website, a third-party cookie (created by a third-party, e.g. an advertiser) is used to track a web user in order to create a profile of them. The profile is then used to show that user ‘relevant’ targeted adverts when visiting completely different websites at different times. 

What’s The Issue With Third-Party Cookies? 

Google made the announcement that it was phasing out third-party cookies in Chrome (as Firefox and Safari had already done before it) for several key reasons, which were:  

– To comply with new data privacy laws, such as GDPR, CCPA, and CPRA, requiring tech companies to obtain user permission before tracking and sharing data. For example, UK websites must display cookie consent and privacy information due to GDPR. 

– Pressure from privacy campaigners, e.g. Groups like Big Brother Watch and universities challenging tech companies over user tracking and data privacy, urging for more ethical practices. 

– Investigations, such as that by the UK Competition and Markets Authority (CMA) over whether limiting cookies on Chrome benefited Google by increasing its dominance in the online ad industry. Some argued this move could force reliance on first-party cookies, benefiting Google financially. 

– Competition among browsers pressuring Google to adopt similar privacy measures, with Safari, Firefox, and Brave leading the way in restricting third-party cookies. 

Why Not Just Remove Them? 

As noted by Google at the time, its Ad Manager data shows that when advertising is made less relevant by simply removing cookies, funding for publishers falls by 52 per cent on average. 

Alternatives – Privacy Sandbox and IP Protection 

Google is now saying that it will take a new approach, i.e. an optional third-party cookie system operated in tandem with something else – Google appears to be focusing on its original idea of Privacy Sandbox as the other system. In addition to continuing “to make the Privacy Sandbox APIs available and invest in them to further improve privacy and utility”, Google says it also intends to “offer additional privacy controls” in the form of introducing “IP Protection into Chrome’s Incognito mode”. 

The Privacy Sandbox is an initiative designed to enhance user privacy while allowing targeted advertising by replacing third-party cookies with new technologies. It includes Federated Learning of Cohorts (FLoC), which groups users into cohorts based on browsing habits to hide individual identities, Trust Tokens to verify user authenticity without revealing identities, and an Aggregated Reporting API that provides data to advertisers without exposing individual user details. The goal is to protect user privacy while maintaining effective online advertising. 

Following its recent resting of the Privacy Sandbox idea, Google announced that “the Privacy Sandbox APIs and other privacy-centric solutions like first-party data can help publishers improve their monetisation and mitigate impact from signal loss”.  

Issues 

Google’s apparent turnaround appears to have pleased some advertisers but there is now a broader prevailing shift towards user privacy and data awareness (accompanied by appropriate legislation) that Google’s new solution will have to align with. For example, it’s important that any cookie consent choices are presented to users in a neutral, clear manner, thereby complying with GDPR requirements for informed and unambiguous consent. 

Also, there are antitrust regulations to consider. For example, the CMA intervened in 2021 over concerns that Google’s plans might push more advertisers to use Google’s systems and, in 2022, Google made commitments to address these concerns. Following Google’s latest announcement, therefore, the CMA is reported to be working closely with the ICO to evaluate Google’s new plan and its potential impact on consumers and the market. 

Google has indicated that it will be working with relevant watchdogs to make sure its new approach is compliant, saying: “as we finalise this approach, we’ll continue to consult with the CMA, ICO and other regulators globally. We look forward to continued collaboration with the ecosystem on the next phase of the journey to a more private web.” 

What Does This Mean For Your Business? 

For advertisers, Google’s updated approach may offer both challenges and opportunities. While the continuation of third-party cookies allows for more targeted advertising, the added user choice means advertisers must be prepared for a portion of users opting out. This shift necessitates a more flexible strategy that combines traditional cookie-based tracking with new tools like those offered by the Privacy Sandbox. Staying informed and adaptive will be crucial to maintaining effective ad campaigns and optimising ad spend. 

With Google’s new approach, it looks as though users will benefit from having at least some increased control over their privacy. The ability to choose whether to allow third-party cookies empowers users to protect their personal data. However, it also places the onus on them to understand the implications of their choices, which many users may be unlikely to do. It should be remembered that organisations (such as Google) must ensure their cookie consent processes are transparent and user-friendly, aligning with GDPR requirements for informed consent. Clear communication about data use will help build trust and improve user engagement. 

Privacy groups may view Google’s updated stance as a partial victory, as it reflects growing recognition of privacy concerns. However, they will likely continue to advocate for stronger protections and clearer regulations. Organisations should anticipate ongoing scrutiny and potential changes in privacy standards, preparing to adjust their practices accordingly. 

For Google, balancing the needs of advertisers, users, and regulators is a delicate task. The company’s new approach appears to seek to address privacy concerns while maintaining its dominance in the advertising market. Google’s competitors, such as Safari and Firefox, which have already implemented stricter privacy measures, will continue to shape the landscape. Staying competitive will require Google to innovate continuously and respond effectively to both market and regulatory pressures. 

Overall, Google’s shift towards user-choice in cookie management signals a broader industry trend towards enhanced privacy.