News: 1721693033

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Google's plan to drop third-party cookies in Chrome crumbles

(2024/07/23)


Google no longer intends to drop support for third-party cookies – the online identifiers used by the ad industry to track people and target them with ads based on their online activities.

In a Monday [1]post , Anthony Chavez, VP of Google's Privacy Sandbox, revealed that the search and ads giant has come to understand that its five-year effort to build a privacy-preserving ad-tech stack requires a lot of work and has implications for online advertisers – some of whom have been strident in their opposition.

"In light of this, we are proposing an updated approach that elevates user choice," wrote Chavez. "Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they'd be able to adjust that choice at any time."

[2]

The [3]Privacy Sandbox – a suite of APIs for notionally privacy-protecting online ad delivery and analytics – will co-exist with third-party cookies in Chrome for the foreseeable future.

[4]

[5]

And instead of [6]phasing out third-party cookie support in the Chrome browser next year – subject to testing that [7]started in January – Google intends to let Chrome users choose whether to play in its Privacy Sandbox, or in the adjacent land of data surveillance where third-party cookies support all manner of information gathering.

It remains to be seen whether Chrome's interface for choosing between its Privacy Sandbox and traditional third-party cookies will be less confusing than the widely criticized "Enhanced ad privacy in Chrome" popup that [8]heralded the arrival of Privacy Sandbox APIs in Chrome last year.

[9]

"This is a clear admission by Google that their plan to enclose the Open Web has failed," declared James Rosewell, co-founder of Movement for an Open Web (MOW). "Their goal was to remove the interoperability that enabled businesses to work together without interference from monopolists, but a combination of regulatory and industry pressure has put paid to that."

Google described its goal for the Privacy Sandbox years ago, in different terms: "We want to find a solution that both really protects user privacy and also helps content remain freely accessible on the web," claimed Justin Schuh, then the director of engineering for Chrome.

But the concern raised by MOW and other ad industry critics was that Google's Privacy Sandbox, in conjunction with the data signals it gets from signed-in Chrome users, would give it access to ad-relevant information that rivals could not access.

[10]

Google [11]began working on its Privacy Sandbox project in 2019, around the time [12]Apple and [13]Mozilla (before it [14]became an ad biz too ) committed to protecting users against trackers and began blocking third-party cookies by default.

[15]What does Google Gemini do with your data? Well, it's complicated...

[16]Oracle coughs up $115M to make privacy case go away

[17]Cellebrite got into Trump shooter's Samsung device in just 40 minutes

[18]Privacy warriors gripe to UK watchdog about Meta harvesting user data to train AI

By 2021, Google's plan prompted [19]an investigation by the UK's Competition and Markets Authority (CMA), urged on by foes of the ad industry like MOW. As a result of that investigation, in 2022 Google agreed to a set of commitments to accommodate competition.

To further complicate matters, Google's initial attempt to do without third-party cookies [20]fell short and [21]failed to provide the promised privacy. Technical setbacks and regulatory pressure led Google to delay its plan to phase out third-party cookies in Chrome.

Now it won't happen at all.

The UK's CMA announced it would not publish its quarterly update on Google's compliance at the end of the month, following the Chocolate Factory's announcement, and has invited interested parties to submit comments by August 12.

"We intervened and put in place commitments in 2022 because of concerns that Google's Privacy Sandbox proposals could distort competition by causing advertising spend to become even more concentrated on Google's ecosystem at the expense of its competitors," a CMA spokesperson explained.

"We will need to carefully consider Google’s new approach to Privacy Sandbox, working closely with the [Information Commissioner's Office] in this regard, and welcome views on Google's revised approach – including possible implications for consumers and market outcomes."

Lena Cohen, staff technologist for the Electronic Frontier Foundation – an advocacy group that has consistently [22]criticized the Privacy Sandbox proposal – lamented Google's decision to back away from its deprecation plan.

"This is an extremely disappointing decision that really just highlights Google's commitment to their own profits over users' privacy," Cohen told The Register .

"Safari and Firefox have blocked third-party cookies by default since 2020 and Google has been pledging to do the same since then. So I think that this reversal, after years of delays, is just a consequence of their advertising-driven business model, which relies on pervasive user surveillance."

Cohen noted that researchers and regulators have already found that Privacy Sandbox failed to meet some of its own privacy goals. "Third-party cookies are an even more invasive form of online tracking than Privacy Sandbox," Cohen said.

"So the fact that Privacy Sandbox didn't enable enough online surveillance is pretty alarming. It just shows that this advertising ecosystem incentivizes really invasive collections of user information. This is why EFF has been advocating for years for a ban on behavioral advertising, because this is the sort of surveillance that it incentivizes."

Separately, Cohen penned an EFF [23]statement on Monday urging Chrome users to install the advocacy group's Privacy Badger browser extension – to opt-out of Google's Privacy Sandbox. ®

Get our [24]Tech Resources



[1] https://privacysandbox.com/news/privacy-sandbox-update/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zp8q2aVzwanoOwwWGPVBpQAAAEU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://privacysandbox.com/intl/en_us/

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zp8q2aVzwanoOwwWGPVBpQAAAEU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zp8q2aVzwanoOwwWGPVBpQAAAEU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2023/11/14/google_chrome_devs_third_party_cookie/

[7] https://www.theregister.com/2024/01/04/google_set_to_start_cookie/

[8] https://www.theregister.com/2023/09/06/google_privacy_popup_chrome/

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zp8q2aVzwanoOwwWGPVBpQAAAEU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zp8q2aVzwanoOwwWGPVBpQAAAEU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[11] https://www.theregister.com/2019/08/22/google_chrome_privacy_sandbox/

[12] https://www.theregister.com/2019/08/16/apples_webkit_security/

[13] https://blog.mozilla.org/futurereleases/2018/08/30/changing-our-approach-to-anti-tracking/

[14] https://www.theregister.com/2024/06/18/mozilla_buys_anonym_betting_privacy/

[15] https://www.theregister.com/2024/07/22/google_workspace_gemini/

[16] https://www.theregister.com/2024/07/22/oracle_settles_privacy_case/

[17] https://www.theregister.com/2024/07/22/infosec_in_brief/

[18] https://www.theregister.com/2024/07/16/campaign_group_complains_to_uk/

[19] https://www.gov.uk/government/news/cma-to-investigate-google-s-privacy-sandbox-browser-changes

[20] https://www.theregister.com/2023/01/18/google_topics_api/

[21] https://www.theregister.com/2024/04/22/ico_google_privacy_sandbox/

[22] https://www.theregister.com/2023/09/30/eff_chrome_google_sandbox/

[23] https://www.eff.org/deeplinks/2024/07/why-privacy-badger-opts-you-out-googles-privacy-sandbox

[24] https://whitepapers.theregister.com/



Firefox

Anonymous Coward

Just set Firefox to strict enhanced tracking protection. Presto, 3rd party cookies blocked.

I've been running it like that for years. Sure, it breaks a few sites, but I didn't want those sites to load anyway.

Why are you still using Chrome?

Huh?

Jamie Jones

Google Chrome - Version 127.0.6533.50 (Official Build) beta (64-bit)

Navigate through the security menu, or use these URLs directly:

chrome://settings/cookies -- Enable "Block third party cookies."

chrome://settings/content/siteData - Enable "Delete all cookies and site data on exit."

Both pages allow white listing of domains, if required.

Re: Huh?

sev.monster

ETP does a lot more than just block 3rd party cookies. OP didn't really do it justice. I'd recommend looking a bit more into it. The user experience is also way better, with a quick toggle in the address bar.

Re: Firefox

Falmari

Don't most browsers even Chromium bases ones have the option to block 3rd party cookies?

I use vivaldi and it has tracking and ad blocking and 3rd party cookies blocking.

Even Edge has tracking and 3rd party cookies blocking.

More choices than that have always been available

Cincinnataroo

Google intends to let Chrome users choose whether to play in its Privacy Sandbox, or in the adjacent land of data surveillance where third-party cookies support all manner of information gathering.

Whaat? There have always been choices to switch off 3rd party cookies entirely. (Or with exceptions should you wish!)

This statement is, and afaict, has always been misleading. The choices are:

1. No cookies stored at all (clear when it shuts)

2. No third party cookies

3. No third party cookies with exception that you choose

4. All the cookies that can eat you, if you want

5. Weird untrusted "other stuff" like privacy sandbox

6. The great unmentioned area of local storage which should have equivalent controls

I reckon that people who accept the defaults get all they deserve, but that's a separate story. (One solution is you have to switch it all on (opt in), or you're forced to set each and every one when you fresh install a browser.)

What some users want is in-browser-tools to examine, copy, delete, and edit cookies as they choose. Linked to analysis tools so that they can see what the cookie setters are up to, if they choose.

Re: More choices than that have always been available

Jamie Jones

[1]https://webextension.org/listing/cookie-editor.html

and the store page: [2]https://chromewebstore.google.com/detail/cookiemanager-cookie-edit/hdhngoamekjhmnpenphenpaiindoinpo?pli=1

[1] https://webextension.org/listing/cookie-editor.html

[2] https://chromewebstore.google.com/detail/cookiemanager-cookie-edit/hdhngoamekjhmnpenphenpaiindoinpo?pli=1

Re: More choices than that have always been available

sev.monster

Firefox adds First Party Isolation to this list, where each site has its own cookie jar, so third party cookies can't track you cross domain. FPI, Enhanced Tracking Protection, Fingerprinting Protection (different from the soon-to-be legacy Resist Fingerprinting)... Chrome has no answer to this, and Privacy Sandbox is a suspiciously named red herring that they've dressed up as a koi.

Also, both Firefox and Chrome have cookie editors built in to the inspector... and Firefox has a UI to see all sites with saved cookies. I believe Chrome and derivatives do too but it's been a while since I've used Chrome.

sev.monster

"In light of this, we are proposing an updated approach that elevates user choice," wrote Chavez. "Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they'd be able to adjust that choice at any time."

Yeah, an informed choice to "who do I want to track me across the Internet and build advertising profiles about my habits"?

How about neither and we call it good?

Who’s clicking anyway?

Anonymous Coward

Who actually clicks on and follows advertising links?

Tracking aside, who’s supporting these parasites?

Or are advertisers just happy with being seen?

Re: Who’s clicking anyway?

sev.monster

Unfortunately, we are a minority. There are plenty of people out there that click on ads, and they're especially more likely to click on ads if they're targeted at their interests. I mean, imagine if the advertisement is for something you already need. Got a cat? Here's an ad for 50% off your favorite brand. click

Spock: We suffered 23 casualties in that attack, Captain.