The pain of saying goodbye is undeniable, and it often leads to prolonged farewells. Such was the case with Google’s planned phase-out of third-party cookies, the cornerstone of cross-site tracking and targeted advertising. After initially promising to phase out third-party or “tracking” cookies “within two years” in January 2020, Google repeatedly pushed back the deadline.
We say “was” like this because Google has just changed its mind. Instead of saying goodbye to third-party cookies forever, the company now plans to keep them, possibly indefinitely.
In a blog post quietly titled “A New Path for Privacy Sandbox on the Web,” Google Vice President Anthony Chavez quietly dropped a bombshell: He announced that while Google remains committed to implementing Privacy Sandbox APIs (initially pitched as a more private alternative to third-party cookies), it will not be removing tracking cookies.
“Instead of discontinuing third-party cookies, we would introduce a new experience in Chrome that would allow people to make an informed choice that applies to all of their web browsing, and they could adjust that choice at any time.”
The announcement, which is hidden in the post, came as a bolt from the blue. A Privacy Sandbox website still maintains a timeline that indicates the phasing out of third-party cookies should happen in Q2 2025. At this point, Chrome has already restricted third-party cookies by default for 1% of users on the stable version of Chrome, and 20% of Canary, Dev, and Beta users have been affected.
Informed choice
Instead of getting rid of third-party cookies, Google says it will offer “a new experience” in Chrome that would allow users to “make an informed choice that applies to all of their web browsing.” Chavez didn’t give many details about how this informed choice concept would be implemented. Since we don’t have many details (or rather, none at all), we can only speculate.
“Informed choice” sounds good if implemented correctly. Ideally, users would be able to choose what data they want to share (for whatever reason) and what data they don’t want anyone to snoop on. “Informed” implies that users have all the information they need to make these decisions, understanding exactly what data is being collected, how it will be used, who will have access to it, and the potential implications for their privacy. This transparency ensures that users don’t inadvertently sacrifice their privacy and can make informed choices about their data.
If we look deeper into what a third-party cookie does, the choice, if made in an informed manner, should be seemingly obvious. Third-party cookies essentially have no other use than to help advertisers, data brokers, and others spy on users across the web. Unlike first-party cookies, which store useful site-specific data (such as login information), third-party cookies track users across different websites. This creates a detailed profile of a user's browsing habits, interests, and online behavior.
Advertisers can then use this data to target users with eerily specific ads, often for products they've casually viewed but not necessarily purchased.
The question then is, if there is a clear understanding of what third-party cookies do, who would be willing to allow them? Apple’s App Tracking Transparency (ATT) feature provides a real-world example. When users were given the direct option to opt-in to app tracking, the vast majority chose not to. Gaming apps, generally known for their targeted advertising, were more successful in persuading users to allow them to be tracked, but even in their case, the average opt-in rate for tracking was a meager 37% in Q2 2023.
I’m going out on a limb, but it’s likely that if Google follows in Apple’s footsteps, third-party cookie adoption rates won’t be high. While the details of Chrome’s “informed choice” aren’t clear, users who decline third-party cookies could be directed to Google’s replacement system, the Protected Audiences API within the Privacy Sandbox initiative. Privacy Sandbox offers a more private approach than third-party cookies, but only in isolation. When context is added, it makes user tracking harder for smaller companies — but not necessarily for giants like Meta or Google itself, which benefit from vast portfolios of interconnected services.
Our doubts go beyond the concept itself. Google’s history of using confusing interfaces, or “dark patterns,” raises concerns about the authenticity of this “informed choice.” For example, Chrome previously used a combination of settings to track user location. Even if users turned off Location History, Google could still track them through the default “Web & App Activity” setting. This Web & App Activity functionality to collect location was not revealed by Google until mid-2018 at the earliest.
Advertisers weren't thrilled either
It wasn’t just privacy advocates who protested Google’s replacement of third-party cookies, but advertisers themselves as well. Criteo, for example, reports that testing and publisher feedback suggests that Google’s Privacy Sandbox, in its current form, falls short of the company’s stated goal of limiting publisher revenue loss to 5%. And that would be an understatement, since according to Criteo’s own analysis, if third-party cookies were discontinued today and the Privacy Sandbox launched in its current state, publisher revenue would decline “by an average of 60% for those who have fully integrated the Privacy Sandbox.”
It’s also no surprise that the adoption rate for the new technology has remained fairly low, at under 55%, according to Criteo. Criteo isn’t the only company to have reported similar results, though many other advertising companies have also seen disappointing results.
“We're still looking at that 30% revenue loss in the cookieless Chrome world, and that's a lot of revenue for people to lose,” an executive at ad tech company Raptive recently said, according to Marketing Brew.
How will this affect privacy?
Google's decision not to eliminate third-party cookies is a blow to privacy, let's not kid ourselves.
Almost all browsers block them by default, while others, like Microsoft’s Edge, are also on track to phase them out (although, in light of Google’s announcement, Microsoft may start to think twice). That means that, when all is said and done, Chrome will emerge as an outlier. At the same time, it remains the most popular browser with an impressive 65% market share. What it means is that the majority of internet users will be affected by this decision – and in a negative way.
No matter how you twist the language, third-party cookies are an inherently non-private tracking mechanism. A tacit admission by Google that its replacement failed demonstrates that trying to have everything in order (protecting both privacy and advertisers’ interests) is hardly viable today, at least in the way Google had envisioned. Ultimately, while its goal was to satisfy both parties, it failed to meet the expectations of either.
These days, the onus is on users to protect themselves from privacy intrusions, and ad blockers are one of the many tools available to help them with that. Relying on Google for privacy protection always seemed like a far-fetched idea, and recent developments have shown that, if anything, Google is going in the opposite direction.
We have introduced the best business VPN.
This article was produced as part of TechRadarPro's Expert Insights channel, where we showcase the brightest and brightest minds in the tech industry today. The views expressed here are those of the author, and not necessarily those of TechRadarPro or Future plc. If you're interested in contributing, find out more here:
