Cookies are soon to be a thing of the past; Google wants to play in the Sandbox instead. It might sound rather twee, but this marks a seismic shift in the online ecosystem that will affect us all.
The âcookie-less webâ is nothing less than a total restructuring of the internet, which will spell the end of digital advertising as we know it with obvious ramifications for online publishers too.
It comes after increasing concerns over online safety as our lives become ever more digital. The UK Governmentâs new Online Safety Bill is just one of a number of recent legislative moves to protect us online.
[To find out more about the future of marketing, download the Lead Monitor white paper: B2B marketing after a pandemic: 8 key lessons for senior marketers]The death of third-party cookies
Since 1994, cookies have enabled websites to distinguish individuals from the otherwise faceless mass of online users.
These tiny text files store basic information about us from the websites we visit, such as our preferred language, our login details and how many items weâve put in our virtual shopping basket etc, and are saved on our browsers.
Cookies are the foundation of the personalised browsing experience and web analytics, giving us visitor numbers, page views, reach etc.
But not all cookies are the same.
Cookies direct from the website youâve visited, which can only be read by that website, are known as first-party cookies. Those from advertisers â the ad space on websites typically owned by large ad tech firms â are known as third-party cookies and these can track your browsing habits.
Itâs not always the case that cookie data is stored on the userâs browser, however. As cookies have only a limited size, sometimes data is stored on servers and users given an ID that corresponds to it. While more data means better personalisation, it also raises privacy issues.
In 2012, the law changed in the EU so that people had to give informed consent for websites to save cookies on their browser, but concerns around online privacy continued to grow.
In 2018, the Cambridge Analytica scandal â which exposed data harvesting for political gain â and new legislation in the form of the General Data Privacy Regulation (GDPR) further pushed data privacy into the spotlight.
Google Chrome joined rival web browsers Apple Safari, Microsoft Edge and Mozilla Firefox in blocking third-party cookies that year.
Matt Rhodes, head of brand engagement strategy at media buying agency Engine, said the marketing industry still relies on cookies to serve ads, but it is assumed that âquite a significant proportion of peopleâ are not accepting cookies when prompted online.
âWhere we are at the moment is not ideal,â he told Press Gazette. âWeâre in this in-between situation where itâs really not satisfactory because youâve got consumers not accepting cookies and no solution in place.â
With cookies marked for extinction, the question now is: what will replace them? Enter Google Privacy Sandbox.
[Sign up for our fortnightly newsletter â Marketing Matters, produced by Press Gazette and Lead Monitor]What is Google Privacy Sandbox?
Google Privacy Sandbox marks the shift from tracking by default to privacy by default online. It is billed as a new initiative aiming to provide âa secure environment for personalisation that also protects user privacyâ.
In a blog post announcing Privacy Sandbox last year, Google Chrome engineering director Justin Schuh said: âTechnology that publishers and advertisers use to make advertising even more relevant to people is now being used far beyond its original design intent â to a point where some data practices donât match up to user expectations for privacy.â
Schuh said that âwithout an agreed-upon set of standards, attempts to improve user privacy are having unintended consequencesâ. The challenge is to keep the web open and robust while being accountable and protecting privacy.
Schuh said Privacy Sandbox is a âfirst step in exploring how to address the measurement needs of the advertiser without letting the advertiser track a specific user across sitesâ.
He said Googleâs Privacy Sandbox was partly driven by concerns over new workarounds that developers had come with up to keep their current systems working in response to the blocking of third-party cookies across browsers. One such approach is âfingerprintingâ.
Explained Schuh: âWith fingerprinting, developers have found ways to learn tiny bits of information that vary between users, such as what device they have or what fonts they have installed. By combining several of these small data points they can generate a unique identifier which can then be used to match a user across websites.
âUnlike cookies, users cannot clear their fingerprint, and this means that even if a user wishes not to be identified, they cannot stop the developer from doing so. We think this subversion of user choice is wrong.â
Googleâs Privacy Sandbox will keep data on a userâs browser, rather than storing it on servers, and use application programming interfaces (APIs) to share data on users with advertisers. These will be limited by a âprivacy budgetâ capping the number of APIs that can be âcalledâ by a site.
Each call to an API will reveal more about a user. âWebsites can call APIs until those calls have revealed enough information to narrow a user down to a group sufficiently large enough to maintain anonymityâ, said Schuh. Any further attempts will be blocked, however.
Google Privacy Sandbox is being phased in and is currently in developer testing. It is expected to be completed in 2022.
The Information Commissionerâs Office, which enforces digital privacy laws in the UK, told Press Gazette it was âcurrently considering the proposals within the Privacy Sandbox and their potential for enhancing user privacy onlineâ. A spokesperson added: âWe will continue to engage with Google on this issue as the proposals are developed.â
Google dominance fears
But not everyone has welcomed Googleâs cookie-less solution with open arms. There are fears that the tech giant, part of Alphabet, which Press Gazette has ranked as the worldâs biggest media company, could come to dominate the ad market even more than it already does.
âWhereas cookies are essentially owned by the brand â the advertiser drops it and then the advertiser reads it â browser-based means that all the ownership then sits, in reality, with Google,â said ad-buyer Matt Rhodes.
âAnd thatâs problematic because then youâve got the same kind of dynamic you had with whatâs happened with publishers and [social media].
âYouâre going from a situation of people whoâve got advertising space having the power, to all the power sitting with Google essentially and so revenue opportunities decrease because they control the market.â
He said that while on paper Google Privacy Sandbox looked like a better solution than existed at present, âyouâre then beholden to Googleâ and how it will work across browsers is yet to be determined.
But Rhodes said there were some good things to come from the proposal. He said âcross-device trackingâ of users should be easier through a browser-based solution, âbecause if youâre in Chrome youâll be signed in to Chrome across all your devices I would assume.
âSo if you watch an ad on Youtube, click through on your phone, and then buy that holiday later on your desktop, at the moment itâs actually quite tricky for us to know that that [ad] has had any impact, or have data which suggests thatâs had an impact, whereas with browser-based tracking you can at least do that.â
He added: âIt should be easier to track what people do, so from Googleâs perspective itâs easier for them to have a better understanding of who you are, which ultimately leads to a better ability to buy advertising. But all of thatâs wrapped up in the fact that itâs provided by Google.
âIt is moving the supply, the buy and the tracking and analytics to the same organisation. I donât think anyoneâs really sure how thatâs going to play out.â
A group calling themselves Marketers for an Open Web (MOW) has highlighted concerns that by denying news publishers access to the cookies they use to sell advertising, Googleâs Privacy Sandbox could cut their revenues by around two-thirds.
MOW warned that smaller regional publishers would be hardest hit, that journalist jobs would be lost and the changes would put âreliable, fact-checked online news under greater threat than everâ, Press Gazette reported last month.
A Google spokesperson said: âThe ad-supported web is at risk if digital advertising practices donât evolve to reflect peopleâs changing expectations around how data is collected and used. Thatâs why Google introduced the Privacy Sandbox, an open initiative built in collaboration with the industry, to provide strong privacy for users while also supporting publishers.â
Alternatives to Googleâs Privacy Sandbox
Googleâs is not the only âcookie-lessâ proposal out there.
Ad tech firm The Trade Deskâs Unified ID 2.0 bills itself as a ânew industry-wide approach to internet identity that preserves the value of relevant advertising, while putting user control and privacy at the forefrontâ. It has already received support from media data firm Nielsen.
The open-source framework can operate across ad channels: TV, mobile, audio and online. It is also collaborating with data connectivity platform Liverampâs Authenticated Identity Infrastructure.
Scott Howe, Liveramp chief executive, said: âThe combined demand from The Trade Desk, the largest independent demand-side platform, and the 400+ global brands using Liveramp, enables publishers and advertisers to thrive in a post-cookie environment.â
The Interactive Advertising Bureau Tech Labâs Project Rearc is not a product but rather a âglobal call-to-action for stakeholders across the digital supply chain to rethink and re-architect digital marketing to support core industry use cases, while balancing consumer privacy and personalisationâ.
The industry body said the loss of third-party cookies would mean the âdefault state of digital media will be 100% anonymous, non-addressable to third-party vendors that support advertising-funded media and services todayâ. Non-addressable advertising is where the people being advertised at are not directly identified, such as TV, radio or print ads.
The IAB added: âThe feasibility of direct addressability going forward, for any advertising-related use case, rests on trusted relationships between consumers and first parties: brands and publishers.â
Project Rearc fits in with a general shift in the online ad market towards greater transparency and privacy, and away from large-scale automated advertising. A change being shaped by public discourse around privacy.
[Read more: Ozone: How UK publishers are competing with duopoly to offer scale and quality]âA once in a generation opportunityâ
Richard Reeves, managing director of the Association of Online Publishers, believes this fundamental change to the structure of the internet is actually an opportunity for publishers.
âWithout trying to sound sensational, it probably is a once in a generation opportunity for publishers, and advertisers, to reinstate their position as the primary controllers of the data exchange,â he said.
âThatâs how weâve got to view it.â
Reeves said the AOP is âencouraging individual publishers to experiment with all sorts of solutionsâ for the cookie-less web. He said the Google Privacy Sandbox comes from the tech giants âgenuine, pragmatic desire to provide a solutionâ and they are not the âbad guysâ.
âI donât believe theyâre just doing this to follow Apple or to be awkward.
âThis is a conversation that Google and others, including ourselves, have been having with the ICO and everybody since GDPR came in: how do you allow an ecosystem to continue to grow and thrive whilst recognising your responsibilities and your legal obligations to protect data? Thatâs on one side, and then: is the data that is being applied for the types of advertising behaviour that are currently being undertaken entirely necessary? And the answer is no.â
He added: âOur industry has alienated its biggest asset for a very long time⊠the consumer is our biggest asset and behaviours and practices genuinely are at risk of alienating us from those consumers.
He told publishers to take the opportunity presented by changes to online privacy laws, such as GDPR, to sort themselves out. âIt lends itself to recognising the real value of environments and quality audiences and quality content and moves us away from the commoditisation that advertising has become.â
The Google Privacy Sandbox will create a new online ecosystem for the webâs most popular browser that has been built by its biggest gatekeeper. Itâs surely not a question of if, but when.
Email pged@pressgazette.co.uk to point out mistakes, provide story tips or send in a letter for publication on our "Letters Page" blog