Google has begun formalities to phase out third-party cookies from Chrome, which will begin in the first quarter of 2024, signaling the beginning of the end for traditional online advertising in the browser. This initiative aims to replace third-party cookies, which are used to track Internet users across the Internet and offer them targeted advertising, with solutions that better respect privacy and security. This will be a small step as only 1% of Chrome browsers will initially remove their third-party cookies. That’s still a significant number given estimates of around 3 billion Chrome users. And in any case, this is an important step that marks a major change for the Internet economy.
Third-party cookies are files created by a website other than the one you are visiting that allow that website or advertising or social networks to collect information about the preferences, interests and behavior of Internet users. This information is then used to personalize the content or advertisements displayed on the websites you visit. Third-party cookies are generally perceived as a nuisance because they affect the privacy and transparency of Internet users.
Google proposes to replace third-party cookies with APIs (programming interfaces) that are part of the Privacy Sandbox. These APIs allow websites to request from Chrome a list of Internet users’ interests based on their browsing history and serve them relevant content or advertising. Instead of using third-party cookies to track people across the web, websites and advertising networks can simply ask the browser directly.
Google announced its schedule for deleting third-party cookies in May and confirmed that schedule last month. This month, the company reiterated that it plans to reduce third-party cookies by 1% by early 2024 and begin phasing out third-party cookies more broadly starting in the third quarter of this year.
Sent by Google
We intend to decline and remove default access to third-party cookies (i.e., cross-site cookies) as part of the Privacy Sandbox for Web timeline, beginning with an initial 1% testing period in the first quarter of 2024, followed by a phase-out period beginning after Consultation with the CMA planned for the third quarter of 2024. (The phase-out is subject to resolution of remaining competition concerns by the UK Competition and Markets Authority.)
The phase-out of third-party cookies (3PC) is a key initiative of the Privacy Sandbox initiative, which aims to responsibly reduce cross-site tracking across the web (and beyond) while enabling key use cases through to new technologies support. Our exit plan has been developed with the UK Competition and Markets Authority in line with the commitments we have made to the Privacy Sandbox for the Web.
A change to how the internet traditionally works
Since it became clear in 2019 that European data protection rules would require a rethinking of how online ads work, Google has developed a series of supposedly privacy-friendly advertising technology APIs known as Privacy Sandbox. The stated goal of this toolkit is to mitigate ongoing privacy issues such as cross-site tracking and browser fingerprinting while maintaining the ability to serve targeted advertising.
One of the elements of the Privacy Sandbox is the Topics API. When a user visits a website that uses the Topics API for advertising, the browser shares three of their interests with the website and its advertising partners, selecting one interest from the last three weeks. According to the Topics API GitHub page, there are currently around 350 topics available in its advertising taxonomy (although Google plans to add a few hundred to thousands over time). Google says the topics do not include sensitive categories such as gender or ethnicity. And if you use Chrome, the company plans to develop tools that will let you view and delete topics, as well as disable the feature.
As Johann Hofmann, senior software engineer at Google, noted, the phasing out of third-party cookies and the move to privacy sandbox technology (at least in Chrome) represents a significant change from the status quo.
As one of the most influential changes to the web platform in a long time, the elimination of third-party cookies and the introduction of alternative APIs has received a lot of useful feedback from web developers, going so far that “it is impossible to summarize it in a few sentences,” said Hofmann.
As described in the summary, Privacy Sandbox wants to ensure that a dynamic, freely accessible web can exist, even as we implement strong user protections and continue to work with web developers to understand their use cases and provide rights (preserving confidentiality) of APIs.
…which raised some concerns among regulators
The impact of replacing the technical underpinnings of Internet advertising while marketers continue to do business there has not been ignored by regulators who have tried to ensure that Google levels the playing field. As a result, Google has agreed to make concrete commitments to the UK Competition and Markets Authority (CMA) to allay fears that the Privacy Sandbox could become a zone of destruction for competitors.
One of the issues raised is that advertisers who have previously relied on third-party cookies will have much less data to make their decisions, while Google will still have visibility into online activity because many people use Chrome when interacting with their Google accounts are connected. While it seems unlikely that regulators want to ensure that all marketers are operating on the same level of information, competitors have a unique opportunity to cripple the big advertising business by sounding the alarm as Google battles regulators with its antitrust lawsuits and investigations around the world .
Lukasz Olejnik, an independent privacy researcher, said the cookie exit is a significant conceptual and architectural evolution with privacy considerations at its core.
This large-scale system migration presents a major challenge. “It introduces privacy-enhancing changes across the advertising technology and advertising ecosystem,” Olejnik said. However, this system is fragile. His analysis is complex. And the full impact of migration is not yet fully understood.
Olejnik said that while it could be argued that web browsers like Safari and Firefox already handle third-party cookies, Chrome has a much broader user base.
There is something about the fact that Chrome’s migration has been carefully scrutinized by competition authorities in Australia, the European Union and, in particular, the UK Competition and Markets Authority, which in this particular case has become a de facto global technology and competition regulator Prosaic sequence.
In fact, the EU investigation creates additional uncertainty, as do the standstill periods set out in the CMA process and decisions subject to CMA approval. This is another reason why migration is not just about software and standardization. It is also a question of regulation. It is indeed a well-regulated area, subject to competition and data protection laws.
Olejnik said phasing out third-party cookies is a necessary first step and that it wouldn’t be surprising if the effort takes longer than expected, extending into 2025. He also anticipates that some of the Privacy APIs Sandbox may need further improvements, and other forms of tracking may remain in place a little longer.
Vice President of Brave Software: Chrome has the worst privacy protection of any major browser
Peter Snyder, vice president of privacy engineering at Brave Software, maker of the Brave browser, said replacing cookies with Privacy Sandbox continues to be problematic for Brave.
“Replacing third-party cookies with Privacy Sandbox will not change the fact that Google Chrome has the worst privacy protection of any major browser, and we are very concerned about their future plans,” he said. With Google’s elimination of third-party cookies comes a series of other changes that, taken together, seriously undermine other browsers’ progress toward a user-centric, privacy-preserving web.
Recent changes to Google Chrome limit users’ ability to edit, make private and improve their web experience (Manifest v3), broadcast users’ interests across the websites they visit (Themes), remove web privacy restrictions (Similar websites) and offloading the exhaustive costs of advertising auctions for users (FLEDGE API/Protected Audience) and reducing user control and web transparency (Signed Exchange/WebBundles), Snyder explained. And this is just a small list of examples from a much longer list of harmful changes Chrome makes.
Snyder said Google claims that removing third-party cookies is a serious privacy measure, but argued that the truth is the opposite.
Other browsers have shown that a more private and user-friendly web is possible, he said. Google’s removal of third-party cookies should be more accurately understood as the smallest possible change the company can make without affecting Google’s real priority: its own advertising business.
Sources: Google (1, 2, 3), British CMA
What do you think of Google’s decision to remove third-party cookies in Chrome? Is this a good thing or a bad thing for user privacy and the web ecosystem?
What are the advantages and disadvantages of the alternatives offered by Google, such as the Privacy Sandbox? Do you think they are enough to replace third-party cookies?
How will publishers, advertisers and data brokers adapt to this big change? What challenges and opportunities will they encounter?
What role do regulators and legislators play in this process? How can they ensure that competition and confidentiality standards are met?
How will this change impact your online experience? Will you continue using Chrome or consider other browsers?