4 ms·
A first party is a website that a user is intentionally and knowingly visiting, as displayed by the URL field of the browser, and the set of resources on the we
by po 7y ago
A first party is a website that a user is intentionally and knowingly visiting, as displayed by the URL field of the browser, and the set of resources on the web operated by the same organization. In practice, we consider resources to belong to the same party if they are part of the same registrable domain: a public suffix plus one additional label. Example: site.example, www.site.example, and s.u.b.site.example are all the same party since site.example is their shared registrable domain.
A third party is any party that does not fall within the definition of first party above.
This policy doesn't distinguish between companies that own multiple top level domains. I understand that it may be technically hard to figure out but at the policy level are two domains owned by one company really third party to each other?
Are example.com and example.us really always different first parties? What about apple.com and iCloud.com? Or those redirect chains that happen after logging into google such that login cookies are set on youtube.com and whatnot?
It does say 'in practice' but I feel like this is mistaking a technical limitation that it's hard to know if two TLD's are controlled by the same legal entity for a policy.
- om2 7y agoWe have mixed feelings about this. Most people could probably figure out that google.com and google.co.uk are owned by the same entity. And probably many people are aware that youtube.com and google.com are related. But some entities own hundreds of domain names with no clear lexical relationship. I doubt a lot of people would expect TechCrunch.com and huffpost.com to be related and would not really expect to be tracked between the two. So common ownership might not be enough to give users a reasonable expectation of a cross-site relationship.
- tuxone 7y agoAlso, a tracking service could just ask to be CNAMEd to a random subdomain and become everybody’s “first party”, couldn’t it?
- lmkg 7y agoThis has been a feature of Adobe Analytics for over a decade. Google Analytics doesn't currently offer this as a feature, but some enterprising individuals have explored how to hack it in after ITP 2.1 was announced.
- om2 7y agoIt could, but access through these various CNAMEs would not give it stateful cross-site tracking ability, since each would be a different Origin. It would be providing a hosted first-party analytics/ads/whatever service within the storage space of the first party.
- randall 7y agoAdditionally, people who own the sites can use them together via methods like this, while third parties will have a more difficult time. Bravo.
- specialist 7y ago"We have mixed feelings about this." No need. Anyone choosing to mix and match also has the resources for some minor duplication of effort. Or they could just do it all service side.
- p4bl0 7y agoI think that's a problem for companies that owns multiple domains and want to track users between those. Browsers shouldn't have to help with that, but rather implement the most simple and efficient way of protecting their users, as long as it doesn't make the users' life more complicated. That's what should matter: users, not companies.
- dveditz_ 7y agoHow to know when unrelated domains are actually part of the same site is a hard problem. The Public-suffix List approach works okay-ish for cookies, but no one's really happy enough with it to trust for riskier features, and it doesn't help organizations with multiple names (apple.com and icloud.com, google.com and youtube.com, facebook.com and fb.com, etc). As that example list shows at least two major browser vendors have a vested interest in making this work while preserving security. One conversation-starter folks are discussing is https://github.com/mikewest/first-party-sets https://github.com/mikewest/first-party-sets
- w1nst0nsm1th 7y agococa-cola.dev is not owned by Coca-Cola, even if coca-cola.be, cocacola.be, cocacola.fr and coca-cola.fr is owned by Coca-Cola. The same way with bosch.com and bosch.dev. One is a famous tools manufacturer, the other is a web developer. It is impossible to guess the entity behind domain names by only the domain name.