Google has delayed a major privacy change to its Chrome browser, pushing back a plan to block third-party cookies until late 2023 as it determines how to protect users while providing web publishers a way to make money.
Last year, the search giant said it would prevent the world’s most widely used browser from accepting the snippets of text called third-party cookies that help advertisers, publishers and data brokers profile you to help advertisers target ads toward you. The change would prevent an advertiser that recorded your visit to a dieting website from later showing you ads for weight loss programs on other sites, for example.
On Thursday, Google pushed that move out by nearly two years, allowing itself more time to develop and test privacy-preserving alternatives to third-party cookies, and for websites to adopt the changes. The company said it had delayed the change, part of a collection of adjustments to what Google calls its Privacy Sandbox, to chart a better course for advertisers and everyone else on the web.
“We need to move at a responsible pace, allowing sufficient time for public discussion on the right solutions and for publishers and the advertising industry to migrate their services,” Chrome Engineering Director Vinay Goel said in a blog post. “This is important to avoid jeopardizing the business models of many web publishers which support freely available content.”
The delay comes amid intensifying pressure on Silicon Valley giants to fix the internet’s privacy problem. Laws like Europe’s GDPR and the California Consumer Privacy Act (CCPA) target the data collection that Google and other companies want for fine tuning the advertisements they deliver. The ad tech industry doesn’t have forever to change course because anyone dissatisfied with Chrome’s pace has abundant alternatives.
All Chrome’s top rivals, including Apple’s Safari, Mozilla’s Firefox, Microsoft’s Edge and Brave Software’s Brave, take more aggressive measures at stopping tracking than Google. If you want to stick with Chrome, browser extensions like Ghostery, DuckDuckGo, Privacy Badger and uBlock Origin, are designed to block trackers.
One part of Google’s rationale for pushing back its plan is that moving too fast will encourage tracking companies to use sneakier tracking methods than cookies. One such method, fingerprinting, uses trackers to gather browser configuration details, such as the version you’re using and which fonts you’ve downloaded. With enough of those details, trackers can identify you accurately.
Google believes blocking third-party cookies at this stage is actually bad for people using the web because it drives tracking companies to covert approaches such as fingerprinting. “Unlike cookies, users cannot clear their fingerprint, and therefore cannot control how their information is collected or used. We don’t think that’s a sustainable long term investment,” Goel said in a statement to CNET.
Websites also are moving to other tracking methods like requiring logins for free content. That provides them a very specific identifier for profiling your behavior and potentially matching it to your activity on other sites that know it.
Browsers don’t block first-party cookies, which are set by the operator of the website you’re visiting or advertisers contributing ads. First-party cookies help with tasks like remembering what’s in your e-commerce shopping cart or keeping you logged in for subsequent visits. One ad tech workaround for third-party cookie blocking, though, is to tie in with websites to use their first-party privileges.
First-party cookies also are a thorny issue for Google. It has giant websites like search and YouTube that let it set first-party cookies. It also has a big online advertising business that can benefit from Google’s cookies and tracking information. Other advertising companies don’t have that privileged status, which is why the European Commission opened an antitrust investigation on Google’s ad technology and the US Justice Department reportedly also is examining Google’s cookie approach.
Goel denied that Google will get an edge, though. “Privacy Sandbox technologies will not give preferential treatment or advantage to Google’s advertising products or to Google’s own sites,” he told CNET. Indeed, Google committed to “no data advantage for Google advertising products” after the UK’s Competitions and Markets Authority started investigating Google ad-tech competition issues.
In addition to eventually phasing out third-party cookies, Google is working on a technology called federated learning of cohorts, or FLOC, that matches ads to large groups of people, rather than individuals. With it, the browser monitors your browsing history and groups you with thousands of others with similar behavior into a cohort. Advertisers, noticing that a particular cohort is visiting a type of website, can then show ads to other members of that cohort on other sites.
FLOC has its critics. Brave opposes FLOC, as does the Vivaldi browser. The Electronic Frontier Foundation, a digital rights nonprofit, says FLOC is a “terrible idea.” And Mozilla concluded FLOC lets sites “learn a lot about you with far less effort than they would need to expend today.”
Google is working on revisions to FLOC, too. It plans to incorporate feedback for changes and a new round of testing.
