This summer, Google conspicuously paused its long-held plans to abolish third-party cookies in its Chrome browser after failing to please a mix of privacy campaigners, regulators, and advertisers. The backlash was immediate, with critics seeing the move as a disaster and admission of failure.
Soon after the announcement, an article in Digiday described how Google execs were now “in full-on damage control mode, trying to soothe everyone’s nerves, both publicly and behind the scenes.” Meanwhile, digital rights group the Electronic Frontier Foundation (EFF) called the move “bad for your privacy and good for Google's business.”
“By abandoning this plan, Google leaves billions of Chrome users vulnerable to online surveillance,” the EFF’s Lena Cohen wrote.
Other browsers including Apple’s Safari have already eradicated third-party cookies that track people across the web and target them with adverts amid concerns about privacy. But as the world’s biggest browser with more than 65 percent share, Chrome’s decision to phase out cookies was set to be the final nail in the coffin for the intrusive trackers.
The news, therefore, came as a shock to all sides. So why has Google undergone such a seemingly large U-turn on third-party cookies, how will Chrome include the online trackers going forward, and how will that impact your privacy?
Don’t Call It a Backtrack
Google first announced it would be phasing out third-party cookies in Chrome in 2020. But the company has postponed the move several times after multiple attempts to find an alternative—including the ill-fated FLoC.
While it seems like a backtrack, Google argues its new approach offers control over privacy settings while continuing to support third-party cookies for those who want them. Google said in a blog post that it will allow people to “make an informed choice that applies across their web browsing, with the option to adjust that choice at any time.”
As this moves forward, it remains “important for developers to have privacy-enhancing alternatives,” a Google spokesperson told WIRED in an emailed statement.
Sources familiar with the matter say Google’s new plan will be similar to Apple’s App Tracking Transparency (ATT) feature. Introduced in 2021, ATT stipulates that advertisers must ask explicit permission before accessing a user’s mobile advertising ID, the identifier for advertisers (IDFA), for tracking. This means people must click on a pop-up to say “yes” or “no” to tracking when using Apple’s iOS mobile operating system.
Google’s Privacy Sandbox APIs, designed to reduce reliance on third-party cookies, will still be available. The firm also intends to offer additional privacy controls and is planning to introduce IP Protection into Chrome's Incognito mode.
In response to criticism, Google tells WIRED that “elevating user choice” for third-party cookies “is good for privacy.”
“Today’s Privacy Sandbox reflects years of feedback and engagement from privacy advocates, users, regulators, and others across the industry,” Google spokesperson Scott Westover says. “As this moves forward, we’ll continue to collaborate with the industry to build toward the next era of online privacy together.”
Cookies, Crumbled
Google might say it’s keeping third-party cookies, but experts argue that the tracking technology is dead either way. This means advertisers are already having to find other ways to monetize users.
“We should have an expectation that the value and utility of third-party cookies has essentially gone to zero,” says Nick Gernert, CEO of WordPress VIP. “Anyone making plans that leverage data from third-party cookies may have diminishing returns in the long run.”
The apparent death of cookies also won’t matter much to Google, which has a ton of data from multiple services in addition to Chrome and can target people without cookies.
According to Google's 2023 earnings report, $237.86 billion of the firm’s $307.39 billion in revenue came from ads. Ads on its search engine results page and other products including Gmail, Google Maps, and Google Play are the highest earner at a collective $175.03 billion, or 56.9 percent of overall revenue. YouTube ads bring in $31.51 billion (10.3 percent of the total), and Google Network ads including ads on Google’s partner sites come in at $31.31 billion, 10.2 percent of revenue. Network ad revenues were down by 4.5 percent last year, showing Google reliance on this area is reducing.
Google knows it’s quite possible privacy-conscious users will opt out of Chrome cookies, just as they did with Apple’s ATT, which saw Facebook taking a $10 billion hit. Now, ATT opt-in rates range from 12 percent to 40 percent across different app categories.
The mobile advertising industry has boomed over recent years, even with Apple’s ATT in place, says Jake Moore, global cybersecurity adviser at security outfit ESET. He calls the results of ATT “impressive” and suggests Google has been watching the outcome of Apple’s rules before implementing its own version.
Meanwhile, Google is already advising developers to act as if they don’t have cookies. The tech giant is working under the assumption that even if 80 percent do opt out, 20 percent of Chrome’s more than 3 billion users isn’t a bad result.
Ensuring users have a conscious choice over whether they use cookies or not is “a good step in practice,” says Simon Bain, CEO at data and analytics platform OmniIndex. But Google needs to consider how easy it is to opt out, he says.
“And is there a negative impact on opting out for users?” Bain says. “These are crucial because if opting out is buried in the privacy settings and there is a reduction in functionality or workflow as a result of not having them, then it is not really a fair or legitimate choice.”
Informed Choice
Google says its updated approach allows people to “make an informed choice that applies across their web browsing,” and says you’ll be able to “adjust that choice at any time.”
The plan is for this to be as usable as possible. Sources familiar with the matter confirmed Google’s current plan would be a prominent global prompt, meaning users would not be asked to make choices on a site-by-site basis.
Yet some experts question Google’s motives. Sean Wright, an independent security researcher, points out that Google has “an enormous amount of data on individuals,” which gives a lot of power to “a single entity.”
This level of control could put user privacy at risk, Wright says. “My concern is that you have a large company that is already well established, developing its own ecosystem with little competition. There seems little incentive to enhance the privacy of users.”
But Google argues that it has received feedback from “a wide variety of stakeholders,” including regulators such as the UK’s Competition and Markets Authority, publishers, web developers and standards groups, civil society, and participants in the advertising industry. “This has helped us craft solutions that aim to support a competitive and thriving marketplace that works for publishers and advertisers, and encourage the adoption of privacy-enhancing technologies,” the company says.
Even so, privacy is a difficult balance to strike for the world’s biggest browser whose business model is designed to rely on advertising.
This is already well known, and if you care about your privacy, it’s possible you’ve already ditched Chrome for another browser. If you haven’t, Chrome alternatives include Apple’s Safari, Brave, Vivaldi, Firefox, and the DuckDuckGo browser. Brave and Vivaldi and based on the same Chromium engine as Chrome, so they include some of the same functionality.
