On 14 January 2020, Google published a blog post announcing a shock move that was hailed as a victory in the battle for greater user privacy. Entitled ‘Building a more private web: A path towards making third-party cookies obsolete,’ Google outlined its plan to phase out support for the divisive tracking technology in Chrome—a move that will be made once it has worked out how to address the “needs of users, publishers, and advertisers” and has developed tools to “mitigate workarounds.”
Fast-forward to 22 July 2024, following years of delays to its proposed two-year deprecation timeline, Google released another blog post that caught the world’s attention: ‘A new path for Privacy Sandbox on the web’. It announced that Google is abandoning its long-standing plan to block third-party cookies in Chrome.
Let’s explore Google’s revised plans, third-party cookies, their benefits and pitfalls for client-side security and compliance, and reactions to the announcement.
Third-party cookies: Google’s new path
Having announced its U-turn, the tech behemoth said it’s pursuing an updated approach that will “introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time.”
While Google already lets users disable third-party cookies in the browser, it recognizes it could do more to make the option more transparent, and it used the blog to say it’s “discussing this new path with regulators and will engage with the industry as we roll this out”.
With the bombshell dropped, Google seemed to learn from the delays to its initial plans by staying coy about what comes next, particularly a timeline for implementing the new controls.
What are third-party cookies?
Third-party cookies are small pieces of data, stored in the browser, that are inserted on a user’s device by a website other than the one they are currently visiting. Advertisers and data analytics companies usually use them to track users across multiple websites and gather information about browsing habits, preferences, and behaviors.
Unlike first-party cookies, which the website the user is visiting sets for functionality like staying logged in, third-party cookies are set by a domain separate from the one in the browser’s address bar. For example, if you visit a site that contains an advertisement or embedded social media content, that ad or social media service may set a cookie to track you across different sites.
Benefits and pitfalls of third-party cookies
While third-party cookies have revolutionized digital advertising this century, they are increasingly being scrutinized for data privacy and security concerns.
Benefits
Personalized advertising
They let advertisers track users across multiple websites, enabling them to create highly targeted ads based on behavior, preferences, and interests. They also let advertisers retarget users who have previously visited their websites by tracking browser history, increasing conversion rates by reminding users of products they’ve already browsed.
Cross-site analytics
They provide third parties, like marketers and website owners, with insights into user activity across different websites by gathering data about how they interact with them. This is known as cross-site analytics and includes techniques like behavior profiling based on interests, demographics, or browsing habits.
Businesses can use the resulting data to understand the broader customer journey and refine their marketing strategies.
Improved user experience
Their ability to drive retargeting and personalization helps users see more relevant ads and recommendations, improving the browsing experience by aligning it with their interests.
Storing data on third-party platforms gives users a better and more consistent experience across multiple devices. For example, if you browse a website on your phone and later switch to your laptop, cookies let the website remember your preferences for a seamless experience.
Improved marketing
They help advertisers and marketers segment users into groups based on browsing history, enabling more efficient, tailored campaigns that can be synchronized across platforms and devices. This ensures ads seen on social media, search engines, and other channels are part of a coherent, integrated campaign strategy, elevating their impact.
Pitfalls
Privacy concerns
By enabling extensive tracking across multiple websites, they can build detailed user profiles, including behavior, preferences, and interests, without users’ knowledge or explicit consent. The prevalence of this tracking technology prompted Safari and Firefox to block third-party cookies in 2020 and led the EU to implement robust data privacy regulations like the GDPR (General Data Protection Regulation).
Data security risks
The vast amounts of user data these cookies collect can be vulnerable to hacks, leaks, or third-party misuse, putting sensitive information at risk. Hackers can exploit vulnerabilities to track users, verify stolen data, or impersonate them by hijacking session data, resulting in data breaches. This compromises a vast amount of sensitive information, much of it collected and stored through third-party cookies without the user’s knowledge or permission.
Regulatory challenges
The regulatory screw has been tightened amid the introduction of rigorous data privacy regulations like the GDPR and the California Consumer Privacy Act (CCPA) that impose strict restrictions on how user data can be collected and used. Companies that fail to comply with these laws can face hefty fines and reputational damage. Third-party cookies can complicate regulatory compliance, as users must be informed and consent to tracking.
Lack of transparency
Users usually don’t know who is tracking them, why, or how their data is used. When they learn how much data third-party cookies collect, it can erode trust in websites and online platforms, potentially damaging brand reputation.
Google’s U-turn
The reaction to Google’s sudden announcement was both swift and mixed. Some think getting rid of third-party cookies was a strategic mistake for Google. Others were more measured, believing that letting users “make an informed choice” is a good idea, provided they have all the information they need to decide whether to share data. Meanwhile, many were concerned, claiming that Google, which makes over 77% of its revenue from tracker-driven, behaviourally targeted ads, put profits before privacy.
For instance, the Information Commissioner’s Office (ICO), the UK’s data privacy watchdog, said it was “disappointed” by the decision. Stephen Bonner of the ICO said: “It has been our view that blocking third-party cookies would be a positive step for consumers”. This backlash underscores that Google’s decision is a blow to improving online data privacy and security amid the ubiquity and all-encompassing nature of third-party cookie tracking.
While other search engines didn’t renege on their promise to phase out third-party cookies, Google’s dominance of the worldwide search engine market, with a 92% share, means its privacy and security implications will remain for businesses and their online customers.
