14 August 2024

How the third party cookie crumbles

In summary

• Google has abandoned plans to kill 3P cookies by end of 2024
• Regulation, industry (publisher) concerns and Google’s Privacy Sandbox short comings are contributing factors
• The announcement only postpones what is inevitable, so don’t get complacent
• The Australian privacy reform is the iceberg for measurement and tracking ahead

Cookie deprecation years in the making

It’s been four long years - that’s how long Google has been touting it planned to remove a simple yet controversial feature of modern web browsing, the humble third party (3P) cookie.

The initial announcement back in January 2020 indicated that Google was confident they would be able to remove these cookies within a reasonably short time span.

There was no reason not to believe them seeing as other browsers such as Apple’s Safari, Firefox, Brave, Opera and others had already blocked 3P cookies in some cases for a couple of years, it was just Google’s Chrome that was the hold-out. So it shouldn’t be too difficult for Google to follow the same path, right?

Apparently not. After multiple follow up announcements extended the initial deprecation deadline, and even after rolling out changes to 1% of all Chrome users as recently as 6 months ago. Suddenly what seemed a certainty has come to a screeching halt with the post: A new path for Privacy Sandbox on the web on 22 July 2024.

Below is a screenshot from Google’s Privacy Sandbox page, July 2024 showing the plan.

Google retains 3P cookies but provides options

Google’s announcement on 22 July about its plan to retain 3P cookies and provide an opt-in / opt-out option to Chrome users similar to what Apple has offered users as part of the App Tracking Transparency (ATT) initiative.

“Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time.”
Source: Google Privacy Sandbox News, 22 July

While it’s too early to speculate what the opt-in and opt-out rates will be for Chrome users, we know that when Apple presented its users with a choice, 72% of Australian’s opted out of invasive tracking.

Why did Google change its plan to deprecate 3P cookies?

Louder can only speculate at this stage as to the exact reasons, but it appears to be a multitude of headwinds that Google is preparing to head off.

• Increasing regulatory scrutiny in Europe through the UK’s Competition and Markets Authority (CMA)
• The CMA has been evaluating Google’s Privacy Sandbox initiative since 2022 and was due to deliver a report at the end of August.
• In light of Google’s recent announcement it remains unclear as to how this will alter the outcome of the report.
• The CMA is now soliciting feedback from various parties to get their views and perspectives by August 12th 2024.
• The CMA was involved because of industry concerns that Google’s Privacy Sandbox would be self-serving and anti-competitive. This is because Google’s Chrome browser still holds an approximately 60% market share globally.
• Changes to how Google Chrome operates including support of 3P cookies has industry wide ramifications especially for publishers and advertisers who rely on 3P cookies to help provide accurate ad-targeting to end users.

However by holding the CMA at the front door, Google may be inadvertently inviting another regulator in via the side door in the form of the UK’s Information Commissioner’s Office (ICO). The ICO may take over from the CMA with concerns that Google’s Privacy Sandbox alternative to 3P cookies may not go far enough to protect end user privacy.

The ICO have cited specific concerns around the Privacy Sandbox not providing individuals with sufficient clarity about how their data is used by the Topics API and further concerns are expressed around the potential for exploits in the protected audiences API (PAAPI), allowing anonymous users to be re-identified.

Advertising revenue also under threat

What may be good for consumers who wish to preserve their privacy may not be great for publishers and advertisers seeking to extract maximum revenue from their digital real estate.

Alongside the announcement to retain 3P cookies, Google did release some initial data on the Privacy Sandbox initiative collected to date.

Some of the high level findings indicated that:

• Advertising campaigns that relied solely on audience targeting saw a decline of 45% of advertiser spend for Google Ads and a 51% decline for DV360 *
• Publishers saw a 34% programmatic revenue hit on Google Ad Manager when third-party cookies were disabled without enabling Privacy Sandbox and only a 20% hit when the Sandbox was switched on^**

[*] Google claims these results are likely because remarketing today is more reliant on third-party cookies which enable a highly precise level of ads personalization, and the eligible inventory is limited because few supply side platforms (SSPs) are currently testing the Privacy Sandbox.

[**] In other words, Ad Manager was able to recover 80% of programmatic revenue when using the Privacy Sandbox

However another report released by Criteo indicated revenue loss averaging 60% for publishers, if 3P cookies were to be removed tomorrow from Google Chrome.

“The Privacy Sandbox does not meet these commitments. If third-party cookies were deprecated today with the current Privacy Sandbox, our testing demonstrates publishers will lose an average of 60% of their revenue from Chrome.”

So whilst some of these differences no doubt can be explained by different testing methodologies, there is still the potential for significant revenue impact to publishers more broadly regardless of who’s numbers you trust more.

However the Criteo report also called out that Google’s Privacy Sandbox may further entrench Google’s market dominance in online advertising via this paragraph:

“Second, the current version of the Privacy Sandbox also creates an advantage for Google’s advertising business. Our testing showed that Google Ad Manager (GAM) captured the majority of spend in the treatment population, an increase in market share of 360%: from 23% to 83%. This demonstrates a significant increase in publisher reliance on Google for ad revenue.”

If this statement holds true, it would further increase the likelihood of regulatory crackdown on Google and potentially bring in additional anti-trust cases against the tech giant, since it would reinforce early criticisms of the Privacy Sandbox which were that it would further advance Google over it’s competitors - something that Brave called out in December of 2023.

What does this mean for the industry moving forward?

At this point Louder still believes it will be necessary to drop dependence on third party cookies in the near future, with increased rigour being applied to user privacy from a Government regulatory standpoint globally, 3P cookies are unfortunately pervasive when it comes to surveillance capitalism, given the ease through which they allow data brokers and outside third parties to collect large volumes of data on users in a non-transparency way.

A large part of our consulting work in the last couple of years has been dedicated to helping advise our clients on how to adapt to a world where the 3P cookie can no longer be relied upon. Thankfully as a result of this work and expectation that 3P cookies would be going away, we’ve already helped clients explore alternative technologies, solutions and ways of thinking to lower their dependence on 3P cookies to date.

This doesn’t mean Google’s Privacy Sandbox is dead, far from it. Google still plans to continue to invest in exploring this technology and building out it’s capabilities, we just think they perhaps underestimated what a task it was and what kind of scrutiny they would be placed under when they first announced the change. It’s quite possible that the issues with revenue declines for publishers and the lost ad spent will be addressed over the next couple of years with more iterations of the Privacy Sandbox feature set.

The bigger elephant in the room

Let’s take a step back and look at the broader industry changes. The bigger elephant in the room is actually the Australian Government’s privacy reform and review. An early preview into some of these privacy reforms includes carve outs for a ‘fair and reasonable’ test.

This open ended piece of legislation may bring into question data collection methods which are not transparent, especially when users are not explicitly made aware that certain data is being collected and for what purpose. 3P cookies often facilitate data collection in the background in a non transparent way.

It’s also worth keeping in mind that although Google Chrome may represent some 60% of market share, other browser vendors such as Apple and Safari still make up a sizeable portion of internet users and those browsers already block 3P cookies.

So whilst Google may not be removing support for 3P cookies tomorrow or even by the end of 2024, a new opt-out feature in Chrome, along with a lack of support for 3P cookies in non Chrome browsers and the upcoming Australian Government privacy legislation review and resulting legislation will no doubt make the humble 3P cookie less and less reliable than it already is moving forward.

Louder’s recommendation

1. Continue to invest in 3P cookie alternative technology for your advertising and audience list building needs.
2. Explore what consent mode technology will mean for your business - consent mode is where users explicitly opt-in to tracking and data collection. Since upcoming Australian legislation is likely to require user consent and explicit opt-in for data collection to begin.
3. Review your existing business practices around data collection and storage:
   • What data are you collecting?
   • Where is that customer data being stored?
   • How long is it being retained for?
   • What measures are you taking to protect that data? (Which may include organisational policies around access to this data i.e limited employee access)
4. Invest in infrastructure such as server-side tagging (eg: sGTM), as it allows you to:
   • Exert more control over how data is sent and shared between your business and with third parties
   • Provide stricter content security policies (CSPs) on site to prevent cross site scripting (XSS)
   • Enables more durable measurement which is resistant to Apple ITP technology
   • Explore methods of building audience lists based on 1P data and insights eg: GA4 and BigQuery
5. For publishers, continue to stay abreast of the Privacy Sandbox developments

Need help navigating privacy and measurement changes?

Get in touch with Louder or sign up to our newsletter to receive the latest industry updates in your inbox.