Chrome cookies reprieved amid Google Privacy Sandbox changes

Google abruptly changes tack on third-party cookies in its Chrome web browser, cancelling plans to deprecate them in favour of an unspecified ‘new experience’ for users

Alex Scroxton,
Security Editor

Published: 23 Jul 2024 16:15

Google has dramatically changed course on its proposals to deprecate third-party cookies in its Chrome web browser in favour of a “new experience” that it claims will enable people to make an “informed choice” about their web privacy.

The changes, which mirror those made already in the Firefox and Safari browsers, would have been due to roll out in the near future after a series of delays dating back years.

Many of these delays arose as Google sought to allay the concerns of online marketers and the UK’s Competition and Markets Authority (CMA), which had argued that eliminating third-party cookies would concentrate online ad spend in Google’s hands, damage competition and harm consumers.

In a blog post, Anthony Chavez, Google vice-president of Privacy Sandbox, said the project had been developed with the goal of finding services that meaningfully elevate online privacy while preserving the ad-supported web, supporting a vibrant ecosystem of online publishers, connecting businesses with users and offering free access to content.

“Throughout this process, we’ve received feedback from a wide variety of stakeholders, including regulators like the UK’s CMA and Information Commissioner’s Office (ICO), publishers, web developers and standards groups, civil society, and participants in the advertising industry,” he said.

“This feedback has helped us craft solutions that aim to support a competitive and thriving marketplace that works for publishers and advertisers, and encourage the adoption of privacy-enhancing technologies.

“Early testing from ad tech companies, including Google, has indicated that the Privacy Sandbox APIs have the potential to achieve these outcomes,” he continued. “We expect that overall performance using Privacy Sandbox APIs will improve over time as industry adoption increases.

“At the same time, we recognise this transition requires significant work by many participants, and will have an impact on publishers, advertisers and everyone involved in online advertising.

“In light of this, we are proposing an updated approach that elevates user choice,” said Chavez. “Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time. We’re discussing this new path with regulators, and will engage with the industry as we roll this out.”

He went on to state that Google remains committed to making the Privacy Sandbox APIs available and supported to further improve privacy and utility, and committed to offering additional privacy controls, such as introducing IP protection into Chrome’s Incognito mode.

James Rosewell, co-founder of Movement for an Open Web, the organisation that brought the complaint that kicked off the CMA’s initial investigation, hailed a “clear admission by Google” that its plan to “enclose” the Open Web was failing.

“Their goal was to remove the interoperability that enabled businesses to work together without interference from monopolists, but a combination of regulatory and industry pressure has put paid to that,” he said.

“We’ve long called for Privacy Sandbox to be allowed to compete on its merits,” said Rosewell. “If advertisers prefer its approach, and consumers value the alleged privacy benefits, then it will be universally adopted. What wasn’t acceptable was for a solution like this to be forced on the market whilst removing any alternative choices.”

Rosewell said that Movement for an Open Web would be keeping a close eye on developments going forward, saying it was important for the choice Google does eventually offer Chrome users to be truly informed, unbiased and applicable equally to Google’s properties and those of others.

He warned there was nothing in Google’s announcement that stopped it from revisiting the now-abandoned proposals, and regulators would need to work hard to make sure that Google is legally compelled to guarantee interoperability in perpetuity.

“Movement for an Open Web started this process in September 2020,” said Rosewell. “It’s now clear regulators are having an impact and they’re only just turning their attention to Apple and Google’s wider product range. After all, Google and Apple work as one company where Google pay Apple $20bn per year, and Apple receive 36% of search revenue. That unholy relationship needs to be unwound.”

CMA swings into action

The CMA, which intervened in the past over concerns Privacy Sandbox would distort competition, said it needed to carefully consider Google’s new proposals, and would be working closely with the ICO on this.

A spokesperson for the regulator said it would welcome views on the revised approach, including on potential implications for both consumers and markets, and is calling on interested parties to have their say in a refreshed consultation process, which will run until 12 August 2024.

Meanwhile, ICO deputy commissioner Stephen Bonner expressed disappointment at the changes.

“From the start of Google’s Sandbox project in 2019, it has been our view that blocking third-party cookies would be a positive step for consumers,” he said.

“Our ambition to support the creation of a more privacy-friendly internet continues. Despite Google’s decision, we continue to encourage the digital advertising industry to move to more private alternatives to third-party cookies, and not to resort to more opaque forms of tracking.

“We will monitor how the industry responds and consider regulatory action where systemic non-compliance is identified for all companies including Google,” said Bonner.

Read more on Privacy and data protection

Google killed third-party cookies: What’s next?