Google announced last week that it will not proceed with deprecating third party cookies, a stark reversal from its messaging around the topic for the past four years. 

In a blog post authored by Anthony Chavez, a VP at Google in charge of Privacy Sandbox, the following quote summarizes their position:

“�W]e are proposing an updated approach that elevates user choice. Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time. We're discussing this new path with regulators, and will engage with the industry as we roll this out.”

There’s a lot to unpack. Let’s rewind and take a look back at how we got here.

What are third-party cookies used for?

Cookies are small pieces of information stored in your browser to personalize your web browsing experience. First-party cookies are set by the domain of the site you’re visiting, while third-party cookies are set by external domains.

For example, if you're on supermetrics.com, it will drop a first-party cookie on your browser to save preferences like language and timezone. Third-party cookies, such as those from advertising pixels, allow services like Google and Facebook to track your activity across different sites for ad attribution, helping them link actions on Supermetrics to their ads seen elsewhere. This is a crucial link for advertising attribution.

Why was Google planning to get rid of them? 

Google has stated that it’s main aim in removing third party cookies from Google Chrome is to protect user privacy. In a post about the topic, Eric Seufert writes:

“Cookies, unquestionably, present severe data leakage risks to consumers: they allow anonymous services to observe the web activities of users with little preventative recourse.”

Fair enough, but in the same post, Seufert outlines the fact that removing third party cookies would cause advertisers to favor more heavily its higher margin ad placements that don’t rely as much on third party cookies. These include properties like YouTube and Google Search.  

Approximately one fifth of programmatic ad spend is run through the “open web”, a set of technologies that rely heavily on third-party cookies. Estimates from BIONIC show that this was in the ballpark of $65B in 2023. Removing third-party cookies in Chrome, which has a browser marketshare of 65% at the time of writing would, undoubtedly shift a significant portion of this ad spend to Google’s properties.

A privacy preserving measure for consumers? Certainly. An opportunity to capture a sizable portion of the industry’s ad revenue? Plausible.

Why didn’t they get rid of them earlier? 

Google’s alternative to third party cookies is known as the Privacy Sandbox. While there’s an entire post that could be written on whether or not it is a suitable alternative to third party cookies, that is somewhat of a moot point. This is because the UK’s Competition and Markets Authority launched an investigation in 2021 into Google for “suspected breaches of competition law”. Regardless of Google’s true intent behind removing third party cookies from Chrome, it’s clear that the UK’s competition regulator interpreted this as a potential abuse of market power at best and monopolistic behavior at worst. 

As a result of this inquiry, Google entered into a binding agreement with the CMA to ensure that the Privacy Sandbox would reasonably accommodate the interests of the rest of the advertising industry. Google has been working closely with industry groups and regulators for the past three years to build a product that would allow them to achieve their goal of removing third party cookies from Chrome.

By 2024, Google had built out Privacy Sandbox and worked with a range of industry partners to test the impact of removing third party cookies from 1% of users. One estimate from Criteo showed that publishers using Privacy Sandbox could see revenues decrease by and average of 60%. Several tests were conducted that showed a wide range of effects, but provided sufficient evidence that the Privacy Sandbox would cause existing publishers to experience significant revenue losses.

This arguably put Google in a tough position where its alternative to third party cookies would be unlikely to satisfy the demands of the CMA.

The cookie is dead. Long live the cookie.

In light of these results, last week’s announcement looks like less of a surprise. However, there is still a great deal left unknown about how Google plans to “let people make an informed choice that applies across their web browsing”. 

First is the specificity of user choice. Will Google offer the users of Chrome a blanket choice for cookies across all websites, or will it allow users to set and select preferences for each individual site? Will it be opt-in, or opt-out? These are all questions that will be answered in the coming months.

If Apple’s ATT, which offers a separate opt-in prompt for every iOS app, is any guide, opt-in rates could be around 34% (reported by Adjust). Getting rid of two thirds of users with third party cookies enabled could still be devastating for the industry.

What’s clear is that while third party cookies will not be going away anytime soon, Google has opted to pass the choice to its users who may end up taking cookies out of play without the need for a full-scale deprecation.

What should advertisers do now?

Advertisers who have been planning for a cookie-free future are already ahead of the game and should likely stay the course. While there are still significant benefits to using third-party cookies, the uncertainty of the future of this technology makes it an unstable foundation to build a business on.

My personal recommendations to advertisers are as follows:

1. Continue to build out first-party data assets. Your company’s data and your customer data will continue to be an asset that differentiates you from your competitors. Your ability to build a context-rich and consented profile of your customers will enable you to reap the benefits of solutions that exist without a dependence on third-party cookies. These include data activation within walled-garden networks and conversion APIs for capturing actions on your properties and powering the feedback loops that media algorithms depend on.
2. Transition to a statistical measurement stack. As if in anticipation of this announcement, Google released the Modern Measurement Playbook in March. This comprehensive guide outlines how to effectively use a combination of three techniques in concert to measure the effectiveness of marketing in a privacy-forward way. These techniques are Marketing Mix Modeling (MMM), Incrementality studies and Attribution (which will still be identity driven but is unlikely to fully go away).
3. Consider adding contextual media to your mix. If you’ve sufficiently invested in the first two items on this list, supplementing your media mix with contextual partners is a strong way to mitigate the impact of cookie-free targeting and measurement. Contextual media relies on the context surrounding an ad to ensure that it is relevant to the user rather than relying on their identity. For example, showing car ads to users who are on browsing a car forum is a reasonable approach.