11 February 2022

Has the cookie crumbled?

Chaitalee Sohoni
Senior Consultant

elevenM’s Chaitalee Sohoni dives into the what and why of third-party cookies, Google’s plan to phase them out and what this means for businesses and individuals alike.

By 2023, Google Chrome will phase out support for third-party cookies as part of its Privacy Sandbox Initiative with Stage 1 set to start by late 2022.

Google first announced its intention to eliminate third-party cookies from its Chrome browser in early 2020 and made it explicit that they ‘will not build alternate identifiers to track individuals as they browse across the web‘.

If you have been on a website in the last couple of years, you might have encountered an annoying pop-up inviting you to read the company’s ‘cookie policy’ and review your cookie preferences. Chances are you clicked ‘agree’ without reading it and moved on to the content of the page, mostly because privacy policies are tedious to read. The cookie policy on any website is essentially notifying you that a cookie is downloaded to your computer to ‘enhance’ your browsing experience each time you visit the website.

But what exactly are cookies and how do they affect you?

A cookie is a piece of data in the form of small text files that are unique to each user. When you visit a new website, cookies are created to identify you and personalise your experience based on your browsing history.

While cookies aren’t bad, what we choose to do with them is problematic because it raises concerns about data privacy.

Cookies were invented by Lou Montulli in 1994 and have since been the backbone of internet browsing experience. Cookies are created to remember and recall information that is useful while browsing, such as log in information or the previous page on a website. Without cookies, browsing the internet would be an extremely frustrating process — imagine adding an item to your cart when you shop online, and having it disappear each time you go back to add more items. Think Dory from Finding Nemo.

There are two kinds of cookies: First-party cookies and third-party cookies. First-party cookies are created and downloaded from the primary website you are visiting.

Third-party cookies, however, are generated and saved on your computer by multiple websites whose information is embedded on the primary website you browse. For example, when you visit a website, it’ll most likely contain advertisements or images from other websites or even a Facebook ‘like’ button. Even if you don’t click on them, cookies from their websites are created and stored on your system.

If you have ever had an advertisement follow you around on the internet, it is because of third-party cookies. Based on the websites you visit, cookies gather a great deal of information about you such as your age bracket, gender, location, interests, personal preferences etc. Advertising companies use cookies to track your activity on the internet by building a profile of your interests based on your browsing history to send you personalised advertisements. Cookies allow companies to make more money by helping them find the right audience for their products. Platforms such as Facebook and Google are heavily incentivised to ensure advertisements from brands reach the targeted users.

With its Sandbox Initiative, Google aims to withdraw support for third-party cookies. At first glance, this move appears to be a step in the right direction for data privacy, but Google is a tad late to this party. Mozilla’s Firefox, Apple’s Safari and Brave blocked third-party cookies years ago, making them more privacy robust browsers. There’s also DuckDuckGo, a more secure search engine that also offers a browser for mobile phones.

Google may not be the first to ban cookies but Chrome is the most popular browsing platform with a global web browsing market share of 64.4% as of January 2022, which is significant when compared to Safari or Firefox, which only account for 16.9% and 3.9%, respectively. And so, Google’s plan to phase out cookies is a big deal in the world of internet.

With Google hopping on the bandwagon, does this spell the end for third-party cookies? Maybe. Does it mean that your browsing history won’t be tracked anymore? The answer is not that simple.

Eliminating third-party cookies does remove the power advertising companies have in terms of tracking individuals, but it places that power directly into Google’s hands. With Chrome not relying on third-party cookies to collect data about users, Google will no longer support companies in selling targeted web advertisements to individuals. This move will give Google an upper hand in collecting first-party data from users including collecting data from mobile applications to which the cookie ban doesn’t apply.

Google’s move will have a drastic impact on businesses and advertisers as they will need to rely heavily on first-party data or find alternatives to reach their audiences. In a joint statement, the Association of National Advertising and the American Association of Advertising Agencies have pointed out that ‘Google’s decision to block third-party cookies in Chrome could have major competitive impacts for digital businesses, consumer services, and technological innovation.’

Proposed legislative changes in this area will also have a bearing on businesses. In the review of the Privacy Act currently underway, one of the proposed changes includes replacing ‘about’ with ‘related to’ in the definition of personal information in the Privacy Act 1988. The purpose of this change is to explicitly bring more technical identifiers such as IP addresses or unique, persistent identifiers used in cookies within the scope of the Act. Under this new definition, unique identifiers are very likely to be considered personal information and this change will therefore have a bearing on the use of cookies by websites that depend on unique identifiers to track individuals.

Google initially wanted to replace third-party cookies with Federated Learning of Cohorts (FLoCs). FLoCs was designed to track individuals based on their web browsing to group them into cohorts that were defined by similar interests. However, in January this year, Google announced that it was replacing FLoCs with Topics. Topics is also built on the idea of interest-based advertising where the browser determines top interests for users based on their browsing history stating ‘it provides you with a more recognizable way to see and control how your data is shared, compared to tracking mechanisms like third-party cookies.’

Google is still exploring options to fulfil its promise to phase out the use of third-party cookies by 2023, a delay from its initial plan to phase them out by 2022. We may have to wait a little longer to see how third-party cookies will be replaced by Google.

[UPDATE: An earlier version of this post stated Google intended to replace third-party cookies with Federated Learning of Cohorts (FLoCs), however it has now opted to replace them with Topics.]

Photo credit: Dex Ezekiel on Unsplash.