Google Chrome to Sunset Third-Party Cookies: The Future of User Privacy and Advertising

As a cyber security professional who has worked for over a decade to help organizations protect user data, I believe Google‘s decision to phase out third-party cookies in Chrome by 2024 is a watershed moment for online privacy. While long overdue, this move will ultimately lead to a more secure browsing experience as invasive cross-site tracking becomes less prevalent. However, the transition period will require adaptation from all stakeholders – users, websites, advertisers, and technology providers.

In this article, I‘ll break down what this change means, why it matters, and what you can do to protect your privacy today and in the future. I‘ll also examine the potential impact on the digital advertising ecosystem and explore some of the alternative solutions being proposed.

Third-Party Cookies Explained

First, let‘s define our terms. A cookie is a small text file that a website can ask your browser to save and then retrieve later. Cookies enable helpful features like keeping you logged into a site and saving your preferences. These first-party cookies, served by the domain you are visiting, are generally not a privacy concern.

The problem arises with third-party cookies. These are cookies served by external domains that have content embedded on the website you are visiting. Some common examples are:

• Ads served by ad networks
• Social media share buttons and embedded posts
• Analytics and tracking scripts

When your browser makes a request to one of these third-party domains, they can place a cookie that uniquely identifies you. This cookie will then be sent back with every subsequent request you make to that third-party domain, even as you browse other websites. Over time, this enables cross-site tracking and allows companies to compile extensive profiles about your online behavior.

A 2020 study by researchers at Microsoft found that 94.7% of popular websites included at least one third-party cookie, and the median site had 24 different third-party cookies. The vast majority of these cookies are used for advertising or analytics rather than core site functionality.

The Privacy Risks of Third-Party Tracking

The profiles that companies can build through third-party tracking are incredibly detailed and intrusive, often including:

• Every website you visit and how long you spend there
• Your search history and the links you click on
• Products you view and purchase across different sites
• Your rough location inferred from your IP address
• Demographic and interest data derived from your browsing habits

This personal data is often compiled and sold in real-time bidding auctions, where hundreds of companies bid for the opportunity to show you a targeted ad.[2] A 2019 report by Cracked Labs referred to this as "the largest data breach ever recorded" with "hundreds of millions of people‘s personal data" being broadcast.

Even if you trust the companies collecting this data, there are serious risks that it could be stolen, leaked, or misused. There have been numerous examples of third-party cookies and tracking scripts being hijacked to distribute malware. For instance, the SolarWinds hack that compromised multiple U.S. government agencies was enabled by malicious code injection in a software update from a third-party vendor.

The Regulatory Landscape

The risks of pervasive tracking and profiling have caught the attention of lawmakers and regulators worldwide. Here are a few of the most impactful developments:

• The EU‘s General Data Protection Regulation (GDPR), which took effect in 2018, classifies cookies used for behavioral advertising as personal data requiring informed user consent. Websites serving EU users must clearly disclose cookie usage and provide an opt-in choice.

• The California Consumer Privacy Act (CCPA), which took effect in 2020, gives consumers the right to opt out of having their personal information sold to third parties. While the definition of "sale" is debated, this likely covers third-party cookies used for ad targeting.

• The European Court of Justice ruled in 2019 that websites are jointly responsible for third-party tracking cookies and plugins, even if the data is processed by the third party. Websites must obtain informed consent before enabling tools like social share buttons and embedded videos that perform tracking.

• In January 2022, the French data protection authority (CNIL) fined Google €150 million and Facebook €60 million for not allowing users to easily reject cookie tracking. The regulator asserted that making it more difficult to opt out than to opt in violated GDPR‘s consent requirements.

It‘s clear that the legal and regulatory risks of invasive tracking are increasing worldwide. While enforcement has been uneven so far, we can expect more crackdowns on non-compliant practices in the coming years.

Google‘s Privacy Sandbox

Recognizing the privacy harms and regulatory risks of third-party cookies, Google announced in January 2020 that Chrome would phase them out within two years. That timeline has been extended to mid-2024, but the end goal remains the same.

Simply blocking third-party cookies without any replacement would significantly disrupt the digital advertising ecosystem that funds much of the open web. That‘s why Google is developing a set of open standards called the Privacy Sandbox to enable some common advertising use cases without cross-site tracking.

Some of the key proposals include:

• Topics API: Instead of tracking your individual browsing history, Chrome would classify the sites you visit into broad interest categories (e.g. "Sports" or "Travel"). Advertisers could then target ads based on your inferred interests without knowing the specific sites you visited.

• FLEDGE: This on-device auction system would allow advertisers to bid to show ads to users who previously visited their site, without any third-party tracking. The ad selection and bidding logic would run locally in your browser rather than on an external ad server.

• Attribution Reporting: This API would provide web-scale reporting on which ads drove conversions (like purchases or signups) in a privacy-preserving way. It uses sophisticated cryptography and differential privacy techniques to prevent tracking of individuals.

Google is actively seeking feedback on these proposals from web standards bodies, browser vendors, advertisers, publishers, and privacy advocates. There are still many open questions and concerns to address before the Privacy Sandbox can fully replace third-party cookies.

Some privacy advocates worry that Google‘s proposals don‘t go far enough and will simply entrench its dominance in the browser and ad tech markets. On the other side, some advertisers fear that the Privacy Sandbox will limit their ability to measure ad performance and optimize campaigns.

As a cybersecurity expert, my view is that phasing out third-party cookies is a necessary step to protect user privacy, but it‘s not sufficient on its own. We need a combination of strong regulation, privacy-preserving technologies, and industry best practices to build a more ethical and sustainable online ecosystem.

What You Can Do to Protect Your Privacy

While Chrome‘s third-party cookie phase-out is a significant victory for privacy, it won‘t solve everything. Here are some steps you can take to further guard your personal data:

1. Adjust your Chrome settings: Even before third-party cookies are fully blocked by default, you can go into Chrome settings and select "Block third-party cookies." This will provide immediate privacy benefits, though may cause some websites to break.

2. Use privacy extensions: Browser add-ons like uBlock Origin, Privacy Badger, and HTTPS Everywhere can block trackers, upgrade insecure connections, and give you more control over your data. Just be sure to only install trusted extensions from official sources.

3. Opt out of ad personalization: You can tell advertisers not to target you based on your browsing history by opting out through industry self-regulatory programs. The Digital Advertising Alliance has a WebChoices tool and the Network Advertising Initiative has a Consumer Opt-Out Page.

4. Use a private search engine: Search queries can reveal incredibly sensitive information. Consider switching to a privacy-focused search engine like DuckDuckGo or Startpage that doesn‘t track you or share your searches with third parties.

5. Protect your IP address with a VPN: Your IP address can be used to infer your rough location and link your activities across sites. Using a trusted virtual private network (VPN) service can mask your real IP and encrypt your traffic from prying eyes.

Of course, these technical tools are no substitute for strong privacy laws and responsible data practices by companies. But they can help you take back some control over your personal information.

Implications for Websites and Advertisers

If you operate a website or work in digital marketing, preparing for a post-third-party-cookie world is essential. While the full impact remains to be seen, here are some steps you can take to adapt:

• Audit your cookie usage: Inventory all the cookies and tracking scripts on your site to determine which are essential for functionality and which are used for analytics or advertising. Ensure you have a clear and compliant cookie consent banner and privacy policy.

• Prioritize first-party data: Focus on building trust with your audience and giving them compelling reasons to share information directly with you. Strategies could include email newsletters, loyalty programs, customer accounts, and progressive profiling.

• Explore contextual advertising: Instead of micro-targeting users based on invasive profiles, consider placing ads in relevant contexts. For example, a food brand could advertise on recipe websites. Contextual ads have been shown to perform well and don‘t require personal data.

• Evaluate alternative ad platforms: If you rely heavily on programmatic advertising powered by third-party cookies, start testing other options. Upcoming privacy-focused solutions like Google‘s Privacy Sandbox APIs, LiveRamp‘s Authenticated Traffic Solution, and Unified ID 2.0 are worth exploring.

• Advocate for industry standards: Help shape the future of online advertising by engaging with industry groups like the IAB, W3C, and Partnership for Responsible Addressable Media. Collaboration and input from diverse stakeholders will be key to developing viable privacy-preserving ad solutions.

The digital advertising landscape is undoubtedly shifting, but that brings opportunity as well as challenge. By getting ahead of the curve and aligning with the growing consumer demand for privacy, forward-thinking brands can build deeper trust and drive better long-term results.

Conclusion

The web has operated on an unsustainable foundation of invasive tracking and surveillance advertising for too long. By phasing out support for third-party cookies, Google is accelerating a long-overdue course correction and raising the bar for user privacy.

However, this is not a silver bullet. Protecting privacy in an increasingly digital world will require ongoing collaboration between tech platforms, advertisers, policymakers, and consumer advocates. We need robust laws, innovative privacy-enhancing technologies, and a fundamental realignment of incentives to build an online ecosystem that respects human dignity.

As individuals, we have both the right and the responsibility to control our personal data. By making informed choices about the tools and services we use, we can collectively demand a more privacy-focused web. Supporting businesses that are transparent and responsible with user data is one of the most impactful things we can do.

If we get this right, we have the opportunity to build a web that is more secure, more equitable, and more aligned with our values. A web where individuals are treated with respect, not as data points to be exploited. A web that fosters authentic human connection and empowers diverse voices. That‘s a vision worth fighting for.

What do you think about Google‘s decision to sunset third-party cookies in Chrome? How are you adapting to the shifting landscape of online privacy? Let me know in the comments!

References:

1. Englehardt, Wood, Janssen, Zarras, Acar, and Narayanan. "A Bird‘s Eye View on the Evolution of Third-Party Cookie Policies", Microsoft Research, 2020.

2. Wolfie Christl. "Corporate Surveillance in Everyday Life", Cracked Labs, June 2017.

3. Wessel Derksen. "The SolarWinds hack timeline: Who knew what, and when?", CSO Online, March 26, 2021.

4. Natasha Lomas. "European Court of Justice restricts use of third-party website plugins", IAPP Daily Dashboard, July 31, 2019.

5. The Privacy Sandbox initiative. "The Privacy Sandbox Timeline", privacysandbox.com, 2023.