The End of Third-Party Cookies

Google’s decision to phase out third-party cookies in Chrome was initially announced in 2020, but has since been postponed several times. In January 2024, Google finally began phase one of phasing out third-party cookies by applying this to 11% of all Chrome users as a test. And by the end of 2024, this would apply to 100% of Google Chrome users.

Meanwhile, Google is no longer planning to completely phase out third-party cookies, but instead, like Safari and Firefox, will give users the choice to disable third-party cookies. Their own deadline has also been pushed back to 2025. Google states that they will introduce a new experience in Chrome that will allow people to make an informed choice that applies to the user's entire internet usage, and the user would be able to adjust that choice at any time.

In this article, we delve deep into the world of cookies, the reasons behind the abolition of third-party cookies, the emerging alternatives, and how businesses can continue to navigate these changes.

What are third-party cookies and why are they so important?

Cookies are text files that are stored on a visitor's computer when they visit a website. They play a crucial role in personalising the user experience, for example, by remembering login details or saving shopping baskets. If the visitor returns to the site at a later time, the same text files are called up so that they are immediately logged in again or their shopping basket is automatically refilled with the previous products. However, cookies can also be used to track users across different websites, which is known as cross-site tracking.

Third-party cookies are text files that are not placed by the website you are visiting, but by another party, such as an advertiser or a social media platform. These cookies have been essential for the advertising industry because they allow companies to show targeted advertisements based on a user's behaviour across different websites. Collecting this data enables companies to build a detailed profile of a user's interests and preferences, leading to more effective advertisements. However, this also used to mean that interests shown by a visitor visiting a particular site could be used by anyone collecting that data to target the visitor.

Due to increasing privacy concerns and the growing demand from internet users for more control over their personal data, third-party cookies are increasingly being discussed. These cookies, which were once introduced at a time when there was less attention to regulation on the internet, have for years been a standard method for online marketers and businesses.

This has led to them becoming accustomed to using them for things like tracking visitor behaviour and showing personalised advertisements. The disappearance of third-party cookies therefore presents a challenge, as this familiar tool has become an important part of how they operate with online tracking and online marketing. Tracking methods such as third-party tracking and client-side tagging rely on the visitor's browser and the use of cookies present in a user's session.

The difference between first-party and third-party cookies

First-party cookies are placed on a visitor's browser by the website owner when they visit the site. What makes these cookies first-party is that they are set by the domain of the website being visited. This distinguishes them from third-party cookies, which are placed by a domain other than the one being visited. While first-party cookies are often associated with session cookies and essential cookies for a website's functionality, they can also be used for tracking and analytical purposes. It's a common misconception to assume that first-party cookies are only short-lived or exclusively essential for the website.

Third-party cookies, on the other hand, are often used for cross-site tracking. They allow third parties to follow users across multiple websites for personalised advertising and analytics. This ability to track users across different sites, along with the fact that they are placed by a different domain, is the main distinction between third-party and first-party cookies. However, both types of cookies can be used for functions such as remembering user preferences or tracking session information. Furthermore, both first- and third-party cookies can be session cookies, which are deleted when the user closes the browser. It is therefore important to always ask for consent via a Consent Management Platform before placing cookies, unless they are strictly necessary for the core functionality of the website.

Browsers like Firefox and Safari have already taken steps to block those third-party cookies, meaning you're reliant on first-party cookies there, and now Google Chrome is also on the verge of phasing out third-party cookies.

Why are all browsers stopping third-party cookies?

The decision to phase out third-party cookies stems from growing concerns about privacy. Internet users are increasingly aware of how their data is collected and used online, leading to a growing demand for greater control and transparency. Furthermore, various privacy regulations, such as the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) in the US, have increased pressure on companies to adapt their data collection practices.

Browsers like Firefox and Safari have previously taken measures to block third-party cookies through their respective programmes, Enhanced Tracking Protection (ETP) and Intelligent Tracking Prevention (ITP). These features limit the ability to track users across different websites, posing a challenge for advertisers who rely on personalised advertising.

Google Chrome, the most widely used browser globally, has chosen a different approach. In addition to allowing Chrome users to block third-party cookies, Google is also introducing a new initiative called the Privacy Sandbox. This initiative is intended to develop alternatives that can replace the functionality of third-party cookies while simultaneously respecting user privacy. Google finds itself in a difficult position. As a browser, they want to protect their users' privacy, just like Safari and Firefox, but Google also has a large advertising platform that relies on third-party cookies.

Wat gaat third-party cookies vervangen?

Google's Privacy Sandbox is one of the most promising initiatives to replace third-party cookies. The Privacy Sandbox consists of several APIs aimed at protecting user privacy while still allowing advertisers to show effective, targeted ads.

Here are some of the key APIs within the Privacy Sandbox:

1. Topics APIThis API enables browsers to categorise users based on broad topics such as /Arts & Entertainment/Music & Audio/Rock Music of /Computers & Electronics/Software/Web Browsers without tracking their behaviour across different websites. Advertisements are then shown based on these topics, meaning users see relevant adverts without their privacy being compromised.
2. Protected Audience APIThis API allows users to join specific interest groups, managed within their Google Chrome browser. This gives users more control over which advertisements they want to see based on the specified interests without being tracked across the internet by a third party.
3. Attribution Reporting APIThis API helps advertisers understand which ads are effective without having to collect personal information about users. So, as an advertiser, you will be able to see how effective your campaigns are, without seeing any personally identifiable information (PII).
4. Shared Storage APIThis API allows advertisers to store information about users in a privacy-preserving manner. It aims to provide the necessary data storage, processing, and sharing without the ability to track and profile users.
5. Fenced Frames APIA fenced frame is an HTML element that is similar to an iframe, but with added privacy protection. Whereas iframes can normally exchange data with the page they are embedded in, a fenced frame restricts this communication. This allows the frame to access cross-site data without sharing it with the page it is embedded in. This prevents advertisers from collecting information about the user through the ad itself.

Although the Privacy Sandbox is promising, it has also faced criticism, notably from the UK's Competition and Markets Authority (CMA). The CMA is concerned that Google's new technologies could limit competition in the advertising market and further strengthen Google's dominant position. This has led to a delay in the rollout of the Privacy Sandbox, as Google works closely with the CMA to ensure the new technologies are both privacy-friendly and fair.

The CMA has also expressed specific concerns regarding the various APIs within the Privacy Sandbox, such as the need for more transparency and better control mechanisms to prevent misuse. This highlights the complexity of developing new technologies that protect user privacy while retaining advertising capabilities.

The role of Consent Management Platforms

With the abolition of third-party cookies and the introduction of new technologies such as the Privacy Sandbox, it is becoming increasingly important for companies to have a solid data management and consent strategy. Consent Management Platforms play a crucial role in this.

A CMP helps companies manage user permissions for placing cookies and collecting data. It ensures companies comply with privacy regulations such as GDPR and CCPA by informing users about what data is collected, why, and how it is used. This not only helps to minimise legal risks but also contributes to building consumer trust.

For example, a good CMP can automatically differentiate between first-party and third-party cookies, and ensure that only necessary cookies are placed until the user explicitly consents to other cookies. This is essential at a time when users increasingly want control over their own data. We, at AdPage, always set up our Server-Side Tagging implementations via Cookiebot or Cookiecode because these CMPs also function well in combination with Google Tag Manager, where this often goes wrong with other Google Certified CMPs.