Google snubs ad industry with third-party cookie phaseout

Google is to phase out third-party cookies on its Chrome browser, in a move that observers say is likely to shake up the online advertising industry and could potentially drag the company into another antitrust row.

Google said it wants to render third-party cookies – which form the foundation of how advertisers track users across the internet and offer targeted ads – obsolete in the next two years.

In a 14 January announcement, Google’s director of Chrome engineering Justin Schuh said the process will start in February, when the browser will require stricter security certifications from third-party cookies.

The decision is part of Google’s “Privacy Sandbox” initiative, which launched in August and intends to “make the web more private and secure for users, while also supporting publishers”, Schuh said.

Google said it will find a way to phase out third-party cookies while also blocking workarounds such as “fingerprinting” – a method of giving web users a unique identifier that allows advertisers to track them from site to site.

It criticised other browser operators that have outright blocked third-party cookies in the past, arguing that such a “blunt approach” undermines the ad-supported web business model and encourages workarounds like fingerprinting.

Observers said the decision may trigger big changes in the adtech industry. Nick Johnson, a partner at Osborne Clarke in London, said the effect of the changes largely depends on Google’s implementation – notably whether Google successfully blocks workarounds – and on whether similar changes are implemented on mobile browsers.

If the changes block workarounds and take effect on mobile, Johnson said, the ad industry may have to work on a different form of universal ID – with appropriate choice mechanisms for users – as a way of tracking across the web. Alternatively, Johnson said, advertisers might choose to pivot to contextual rather than targeted advertising.

Adtech players may also be forced to work more closely with Google – which could allow advertisers to track users across the web but only using Google’s own tracking technology, rather than third-party cookies.

The decision is likely to “accelerate consolidation” within the ad industry, Johnson said – but he also noted that some adtech companies had probably already planned for Google making such a move.

“I don’t think it’s entirely unexpected – I think people knew the big browsers were looking at this,” he said. “I think it’s a development that most of the players of any size will have factored into their planning. I don’t think it’s a shock as such.”

Johnson also noted that Google appears to have “seen which way the wind is blowing” and attempted to use privacy as a competitive differentiator, following in the footsteps of other big tech companies.

Johnny Ryan, chief policy officer at privacy-focused browser company Brave – a competitor to Chrome – said Google has “good business reasons to take this step”.

“Blocking third-party cookies allows Google to flood a moat, of sorts. Google does not need third-party cookies to track people, since its tracking code is installed on virtually every website and app,” Ryan said.

Jordan Mitchell, a privacy official at the Interactive Advertising Bureau – the adtech industry's trade body – said that Google's approach of coupling increased privacy protection with "more industry accountability" is "absolutely the right direction". 

However, he warned that the changes must be made in the right way. "The trick is to have a plan that phases out third-party cookies without accidentally creating a situation that’s worse. The IAB Tech Lab believes that collaboration among all stakeholders – web browsers and publishers – is required."

Others noted that Google’s changes, which affect the business models of hundreds of companies, have competition implications. Damien Geradin, partner at Geradin Partners in Brussels, told GDR that Google “could run into antitrust trouble if it restricts the use of third-party cookies while at the same time using first-party cookies, such as its ubiquitous Google Analytics”.

Industry players view the decision with suspicion, Geradin said. “Google’s adtech rivals are generally sceptical about this new initiative as they fear that it is another tactic to affect them, as they are more reliant on third-party cookies than Google,” he said. “It is another illustration of Google’s ‘weaponisation’ of the GDPR.”

The search giant’s privacy sandbox is a “black box”, Geradin said. It appears to mean that Chrome will access user data – from which adtech vendors will be able to target ads – but without giving those vendors access to the data, he said.

Google faces a large-scale investigation by 51 state attorneys-general in the US over whether it has violated US antitrust law through its “overarching control” of online advertising and search traffic. The Irish data regulator has also said it is in the late stages of an investigation into the company.

Unlock unlimited access to all Global Data Review content