Cookies are soon to be a thing of the past; Google wants to play in the Sandbox instead. It might sound rather twee, but this marks a seismic shift in the online ecosystem that will affect us all.
The “cookie-less web” is nothing less than a total restructuring of the internet, which will spell the end of digital advertising as we know it with obvious ramifications for online publishers too.
It comes after increasing concerns over online safety as our lives become ever more digital. The UK Government’s new Online Safety Bill is just one of a number of recent legislative moves to protect us online.
[To find out more about the future of marketing, download the Lead Monitor white paper: B2B marketing after a pandemic: 8 key lessons for senior marketers]The death of third-party cookies
Since 1994, cookies have enabled websites to distinguish individuals from the otherwise faceless mass of online users.
These tiny text files store basic information about us from the websites we visit, such as our preferred language, our login details and how many items we’ve put in our virtual shopping basket etc, and are saved on our browsers.
Cookies are the foundation of the personalised browsing experience and web analytics, giving us visitor numbers, page views, reach etc.
But not all cookies are the same.
Cookies direct from the website you’ve visited, which can only be read by that website, are known as first-party cookies. Those from advertisers – the ad space on websites typically owned by large ad tech firms – are known as third-party cookies and these can track your browsing habits.
It’s not always the case that cookie data is stored on the user’s browser, however. As cookies have only a limited size, sometimes data is stored on servers and users given an ID that corresponds to it. While more data means better personalisation, it also raises privacy issues.
In 2012, the law changed in the EU so that people had to give informed consent for websites to save cookies on their browser, but concerns around online privacy continued to grow.
In 2018, the Cambridge Analytica scandal – which exposed data harvesting for political gain – and new legislation in the form of the General Data Privacy Regulation (GDPR) further pushed data privacy into the spotlight.
Google Chrome joined rival web browsers Apple Safari, Microsoft Edge and Mozilla Firefox in blocking third-party cookies that year.
Matt Rhodes, head of brand engagement strategy at media buying agency Engine, said the marketing industry still relies on cookies to serve ads, but it is assumed that “quite a significant proportion of people” are not accepting cookies when prompted online.
“Where we are at the moment is not ideal,” he told Press Gazette. “We’re in this in-between situation where it’s really not satisfactory because you’ve got consumers not accepting cookies and no solution in place.”
With cookies marked for extinction, the question now is: what will replace them? Enter Google Privacy Sandbox.
[Sign up for our fortnightly newsletter – Marketing Matters, produced by Press Gazette and Lead Monitor]What is Google Privacy Sandbox?
Google Privacy Sandbox marks the shift from tracking by default to privacy by default online. It is billed as a new initiative aiming to provide “a secure environment for personalisation that also protects user privacy”.
In a blog post announcing Privacy Sandbox last year, Google Chrome engineering director Justin Schuh said: “Technology that publishers and advertisers use to make advertising even more relevant to people is now being used far beyond its original design intent – to a point where some data practices don’t match up to user expectations for privacy.”
Schuh said that “without an agreed-upon set of standards, attempts to improve user privacy are having unintended consequences”. The challenge is to keep the web open and robust while being accountable and protecting privacy.
Schuh said Privacy Sandbox is a “first step in exploring how to address the measurement needs of the advertiser without letting the advertiser track a specific user across sites”.
He said Google’s Privacy Sandbox was partly driven by concerns over new workarounds that developers had come with up to keep their current systems working in response to the blocking of third-party cookies across browsers. One such approach is “fingerprinting”.
Explained Schuh: “With fingerprinting, developers have found ways to learn tiny bits of information that vary between users, such as what device they have or what fonts they have installed. By combining several of these small data points they can generate a unique identifier which can then be used to match a user across websites.
“Unlike cookies, users cannot clear their fingerprint, and this means that even if a user wishes not to be identified, they cannot stop the developer from doing so. We think this subversion of user choice is wrong.”
Google’s Privacy Sandbox will keep data on a user’s browser, rather than storing it on servers, and use application programming interfaces (APIs) to share data on users with advertisers. These will be limited by a “privacy budget” capping the number of APIs that can be “called” by a site.
Each call to an API will reveal more about a user. “Websites can call APIs until those calls have revealed enough information to narrow a user down to a group sufficiently large enough to maintain anonymity”, said Schuh. Any further attempts will be blocked, however.
Google Privacy Sandbox is being phased in and is currently in developer testing. It is expected to be completed in 2022.
The Information Commissioner’s Office, which enforces digital privacy laws in the UK, told Press Gazette it was “currently considering the proposals within the Privacy Sandbox and their potential for enhancing user privacy online”. A spokesperson added: “We will continue to engage with Google on this issue as the proposals are developed.”
Google dominance fears
But not everyone has welcomed Google’s cookie-less solution with open arms. There are fears that the tech giant, part of Alphabet, which Press Gazette has ranked as the world’s biggest media company, could come to dominate the ad market even more than it already does.
“Whereas cookies are essentially owned by the brand – the advertiser drops it and then the advertiser reads it – browser-based means that all the ownership then sits, in reality, with Google,” said ad-buyer Matt Rhodes.
“And that’s problematic because then you’ve got the same kind of dynamic you had with what’s happened with publishers and [social media].
“You’re going from a situation of people who’ve got advertising space having the power, to all the power sitting with Google essentially and so revenue opportunities decrease because they control the market.”
He said that while on paper Google Privacy Sandbox looked like a better solution than existed at present, “you’re then beholden to Google” and how it will work across browsers is yet to be determined.
But Rhodes said there were some good things to come from the proposal. He said “cross-device tracking” of users should be easier through a browser-based solution, “because if you’re in Chrome you’ll be signed in to Chrome across all your devices I would assume.
“So if you watch an ad on Youtube, click through on your phone, and then buy that holiday later on your desktop, at the moment it’s actually quite tricky for us to know that that [ad] has had any impact, or have data which suggests that’s had an impact, whereas with browser-based tracking you can at least do that.”
He added: “It should be easier to track what people do, so from Google’s perspective it’s easier for them to have a better understanding of who you are, which ultimately leads to a better ability to buy advertising. But all of that’s wrapped up in the fact that it’s provided by Google.
“It is moving the supply, the buy and the tracking and analytics to the same organisation. I don’t think anyone’s really sure how that’s going to play out.”
A group calling themselves Marketers for an Open Web (MOW) has highlighted concerns that by denying news publishers access to the cookies they use to sell advertising, Google’s Privacy Sandbox could cut their revenues by around two-thirds.
MOW warned that smaller regional publishers would be hardest hit, that journalist jobs would be lost and the changes would put “reliable, fact-checked online news under greater threat than ever”, Press Gazette reported last month.
A Google spokesperson said: “The ad-supported web is at risk if digital advertising practices don’t evolve to reflect people’s changing expectations around how data is collected and used. That’s why Google introduced the Privacy Sandbox, an open initiative built in collaboration with the industry, to provide strong privacy for users while also supporting publishers.”
Alternatives to Google’s Privacy Sandbox
Google’s is not the only “cookie-less” proposal out there.
Ad tech firm The Trade Desk’s Unified ID 2.0 bills itself as a “new industry-wide approach to internet identity that preserves the value of relevant advertising, while putting user control and privacy at the forefront”. It has already received support from media data firm Nielsen.
The open-source framework can operate across ad channels: TV, mobile, audio and online. It is also collaborating with data connectivity platform Liveramp’s Authenticated Identity Infrastructure.
Scott Howe, Liveramp chief executive, said: “The combined demand from The Trade Desk, the largest independent demand-side platform, and the 400+ global brands using Liveramp, enables publishers and advertisers to thrive in a post-cookie environment.”
The Interactive Advertising Bureau Tech Lab’s Project Rearc is not a product but rather a “global call-to-action for stakeholders across the digital supply chain to rethink and re-architect digital marketing to support core industry use cases, while balancing consumer privacy and personalisation”.
The industry body said the loss of third-party cookies would mean the “default state of digital media will be 100% anonymous, non-addressable to third-party vendors that support advertising-funded media and services today”. Non-addressable advertising is where the people being advertised at are not directly identified, such as TV, radio or print ads.
The IAB added: “The feasibility of direct addressability going forward, for any advertising-related use case, rests on trusted relationships between consumers and first parties: brands and publishers.”
Project Rearc fits in with a general shift in the online ad market towards greater transparency and privacy, and away from large-scale automated advertising. A change being shaped by public discourse around privacy.
[Read more: Ozone: How UK publishers are competing with duopoly to offer scale and quality]‘A once in a generation opportunity’
Richard Reeves, managing director of the Association of Online Publishers, believes this fundamental change to the structure of the internet is actually an opportunity for publishers.
“Without trying to sound sensational, it probably is a once in a generation opportunity for publishers, and advertisers, to reinstate their position as the primary controllers of the data exchange,” he said.
“That’s how we’ve got to view it.”
Reeves said the AOP is “encouraging individual publishers to experiment with all sorts of solutions” for the cookie-less web. He said the Google Privacy Sandbox comes from the tech giants “genuine, pragmatic desire to provide a solution” and they are not the “bad guys”.
“I don’t believe they’re just doing this to follow Apple or to be awkward.
“This is a conversation that Google and others, including ourselves, have been having with the ICO and everybody since GDPR came in: how do you allow an ecosystem to continue to grow and thrive whilst recognising your responsibilities and your legal obligations to protect data? That’s on one side, and then: is the data that is being applied for the types of advertising behaviour that are currently being undertaken entirely necessary? And the answer is no.”
He added: “Our industry has alienated its biggest asset for a very long time… the consumer is our biggest asset and behaviours and practices genuinely are at risk of alienating us from those consumers.
He told publishers to take the opportunity presented by changes to online privacy laws, such as GDPR, to sort themselves out. “It lends itself to recognising the real value of environments and quality audiences and quality content and moves us away from the commoditisation that advertising has become.”
The Google Privacy Sandbox will create a new online ecosystem for the web’s most popular browser that has been built by its biggest gatekeeper. It’s surely not a question of if, but when.
Email pged@pressgazette.co.uk to point out mistakes, provide story tips or send in a letter for publication on our "Letters Page" blog
