4 ms·

I'm a Googler who works in ads, speaking only for myself. If Chrome blocked third party cookies today we'd see something between these two outcomes: a) Publis

by jefftk 7y ago

I'm a Googler who works in ads, speaking only for myself. If Chrome blocked third party cookies today we'd see something between these two outcomes: a) Publishers lose about half their revenue because ads aren't personalized anymore: https://services.google.com/fh/files/misc/disabling_third-party_cookies_publisher_revenue.pdf https://services.google.com/fh/files/misc/disabling_third-pa... b) Advertisers figure out how to keep personalizing ads through fingerprinting (non-cookie tracking) Since (b) is worse than the status quo (users can't reset their fingerprint) I think "a security improvement that is literally flipping a switch" doesn't fit. Chrome's approach (as described in https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html https://blog.chromium.org/2020/01/building-more-private-web-...) is: * Block fingerprinting * Figure out how to let advertisers personalize in privacy preserving ways (https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... primarily FLoC and TURTLE-DOV) * Then remove cookies I'm skeptical about the approach, since I think blocking fingerprinting and server-side correlation of requests is very difficult, but I think the people working on this are very good and have thought a lot more about it than I have.

driverdan 7y ago
In other words the Chrome team doesn't care about users, it cares about ads. If it put users first, as it should, third party cookies would have been blocked a long time ago and they would be working on blocking other fingerprinting techniques now. This is a great reason to not use Chrome.
- jefftk 7y ago
  Users don't care about ads, but users care about the things that ads fund. If publishers go out of business, users will be worse off. Do you think the browsers should block all ads by default?
  - HugoDaniel 7y ago
    Yes. (i am a user; i don't presume to know what is best for others; speaking as a user that talks to others like me; i don't need to speak about 'users' as a third party entity; i am a significant sample of the set)
    - vntok 7y ago
      Are you ready to pay every website you visit, then? With actual money that you yourself own?
      - HugoDaniel 7y ago
        As if ads is the only possible business model on the web. At best the ad revenue is taking money away from other web business models by instituting that kind of mentality that drives people away from donations and paid accounts. Please, consider a paid account/membership when you read the guardian, the intercept, or look for the donation page of quality content articles in wikipedia or any of the loads of blogs written by authors with patreon accounts.
        vntok 7y ago
        Yeah, people will not collect subscriptions to content publishers like they collect emojis on their phones. Estimate how many websites you visit each month; people would need dozens of monthly subscriptions if such a system was set up. Instead, they will rather go to and pay google news, facebook press or apple information to get all their news content. Where would money be taken away then? Content publishers.
      - smnthermes 7y ago
        Donations exist, LMAO.
      - deleted 7y ago
        [deleted]
    - jefftk 7y ago
      Why do you think Edge, Firefox, and Safari have chosen not to block all ads by default?
  - tcd 7y ago
    The web shouldn't block ads, it should block JS entirely. There should be a 'global' permission system (similar to Android) that allows me to control exactly what information websites are allowed to access from my browser. For example, I want to disable WebRTC as it can be used to collect my IP address, or disable WebGPU APIs or anything that can be used to finger print me. JS has far, far, far too much broad access to information that might seem mundane but can be used to profile a user. Android is the same - you can get the entire list of installed packages on the system and various other pieces of information to build a unique, persistable tracking ID. There's also a lack of accountability: What information is being sent to what servers? I want a detailed JSON formatted breakdown of EVERY single piece of data that is being sent from my device. I should be able to block anything that is outside my own determined comfort zone. But most OS' just make requests to US IP's without much thought now - just turn on Windows 10 in a VM and watch as it sends so many requests with no insight into the data, which many companies (including Google) don't tell you about. Ask me about a recent GDPR request to Google which I just got a generic response about (and they didn't action my request to delete information, so now I need to complain to the regulator because it was also late). So yes, blocking ALL tracking by default is sensible.
    - cageface 7y ago
      Do you hold your mobile native apps to the same standard? As a former iOS developer I guarantee you there's a lot more of your data getting collected from those than you'd think and you can't do anything about it.
  - 6gvONxR4sf7o 7y ago
    Maybe free newspapers go out, and free blog platforms go out, but that means that physical local papers don't go out of business and stop having to rely on clickbait. Losing some things means gaining others.
    - jefftk 7y ago
      Sorry, clarifying: your prediction is that if internet ads became much less valuable we would see (a) the return of paper newspaper delivery and (b) the end of clickbait?
      - 6gvONxR4sf7o 7y ago
        I doubt it'll go as far as that, but I'd expect at least that if people had had to pay for news all along, the news ecosystem would have been less devastated by the pay-per-click internet than they have been in reality.
  - Nextgrid 7y ago
    Today's ads are what we used to call "spyware" back in the day and we used to purchase dedicated antispyware products that protected against them, so yes, browsers should block malware (so ads in their current state). Browsers, after all, are user-agents designed to serve the user and not corporate interests. Technology as a whole should be there to make our lives easier, not waste our time. Publishers will not go out of business don't worry. Clickbait will die off because the cheap nasty ads that currently make it viable will disappear. Tasteful, pleasant ads tailored to the current content, negotiated directly between the publisher and the advertiser will remain, and will be harder to block because they are just content served just like the rest of the content on the page instead from a nasty ad network domain.
  - Spivak 7y ago
    > Do you think the browsers should block all ads by default? Resounding yes. Such a thing would be the single greatest security improvement a browser could implement. It would also completely destroy pretty much the only vector online scammers have to reach you. Most forms of advertising are totally fine. Hell I’m even favor of targeted advertising so long as it’s targeted to the content demographics instead the literal individual following them around.
    - jefftk 7y ago
      I'm confused why you would say both that browsers should block all ads by default and that most forms of advertising are totally fine? > I’m even favor of targeted advertising so long as it’s targeted to the content demographics instead the literal individual following them around Then you might like FLoC (https://github.com/jkarlin/floc https://github.com/jkarlin/floc) and TURTLE-DOV (https://github.com/michaelkleber/turtledove https://github.com/michaelkleber/turtledove). These are both ways of implementing targeted advertising without letting the advertiser or ad network follow you around.
      - Spivak 7y ago
        Because internet ads are not most ads. If it's attached to an ad exchange or runs any code client side we're firmly in the "not fine category." Types of ads that I don't like but I won't be up in arms about from a security perspective. * Paying for sponsored reviews. * Affiliate links and partnerships. * Paying promoters and influences to push your product. * "One way broadcasts" like billboards, commercials, magazines. * In house ads like Kroger sending you coupons based on your purchase history at Kroger. * Corporate press events like E3. * Paying to post on the community billboard. * Paying have a booth at professional/enthusiast conferences/trade shows. * Stuff like E3/NintendoDirect/PAX/BlizzCon. * Selling air time on radio, podcasts, online videos. * Sponsored articles/announcements on blogs/news sites. * Native advertising a la Buzzfeed where they would get paid to write a listical "top 10 things you should order off the secret menu at Taco Bell." * Generic direct mailings and coupon books. * Paying employees to suggest and guide customers through the sale provided they're upfront about it. I've seen Lululemon do it somewhat tastefully on Reddit when people post topics looking for recommendations. But ads that come from ad networks/exchanges are nothing like these while simultaneously being the bulk of what ad blockers actually block. So I don't see it as a contradiction. The kinds of ads that ad blockers block aren't usually these and are instead are the spyware/malware kind.
- hesarenu 7y ago
  Nobody cares about users else apple would have allowed users to install others browser engines.
etaioinshrdlu 7y ago
The trouble is Apple shows this compromise is unnecessary. They work hard to block fingerprinting (especially on iOS) and it WORKS. iOS devices are mostly indistinguishable. Notoriously impossible to fingerprint. Granted desktop fingerprinting is more of a challenge due to differing OS's, screens, GPUs for WebGL, etc. But it doesn't seem impossible. They have also blocked third party cookies for so many years. The world did not catch on fire. They use an advertising ID the user can reset.
- Nextgrid 7y ago
  I believe they also have an "identifier for vendor" that persists even after app uninstalls/reinstalls and is the same across all the apps from the same developer, so Apple are not ideal either. Still better than the competition though.
- jefftk 7y ago
  I don't know very much about fingerprinting, but it sounds like the reason iOS devices are hard to fingerprint is that the hardware has very little variation?
ogre_codes 7y ago
Given the history of advertising on the web and advertising in general, I am hugely skeptical of anyone who claims that ethical personalized advertising is even possible. It was critical to election tampering in 2016, it's been used for racism, sexism, and every imaginable sort of scam. The only way personalized advertising would be remotely ethical is if it were explicitly opt-in. I notice that's not a thing on your list of steps Google is planning on doing. No surprise.
- jefftk 7y ago
  If you think personalized advertising is harmful and shouldn't exist anywhere across society you're going to need to pursue that through legislation and not technology. Otherwise platforms people log into (ex: Facebook) will continue personalizing regardless of what browsers implement.
  - ccmcarey 7y ago
    As an aside, I appreciate you candidly discussing this.
    - jefftk 7y ago
      Thanks!
      - ficklepickle 7y ago
        I second that. It shows bravery. (Pun not intended)
  - Nextgrid 7y ago
    I don't actually mind platforms personalising ads & content based on information I explicitly provide. I just don't want them stalking me around the web and trying to collect information behind my back.
    - jefftk 7y ago
DevKoala 7y ago
> a) Publishers lose about half their revenue because ads aren't personalized anymore: https://services.google.com/fh/files/misc/disabling_third-pa.. https://services.google.com/fh/files/misc/disabling_third-pa.... I am on the demand side, and the thesis and testing methodology seems extremely flawed. If you disable third party cookies on a test group of certain publishers our (demand side) bidders will start optimizing towards the control group; this is very obvious. Also, was this analysis conducted on other ad exchanges? For example, Google ADX makes only ~30% of the global traffic we get, and the traffic has very different characteristics from the traffic we get from APPNEXUS, Rubicon, etc. I believe this is an analysis for Google's internal conclusions, and not for the industry in general. Has this been made public before?
- jefftk 7y ago
  > If you disable third party cookies on a test group of certain publishers It says "turned off the availability of personalized data for a small fraction of randomly selected users" and "The experiment was applied to a small fraction of each publisher’s traffic because we did not want to materially affect publisher revenue, though in aggregate the amount of traffic evaluated as part of the experiment was significant". It sounds like you're responding to a version of the experiment that was run on a per-publisher basis? > was this analysis conducted on other ad exchanges? It says the experiment was conducted "through the programmatic arm of Google Ad Manager’s serving system". I'm not sure what this means, but I don't think it includes AppNexus or Rubicon. I believe any publisher could run their own version of this experiment by picking a slice of traffic and telling all their bidders to only show non-personalized ads. > Has this been made public before? This document was released in August: https://www.blog.google/products/ads/next-steps-transparency-choice-control/ https://www.blog.google/products/ads/next-steps-transparency...
  - DevKoala 7y ago
    > Using this system, we ran an experiment where we turned off the availability of personalized data for a small fraction of randomly selected users through the programmatic arm of Google Ad Manager’s serving system, thus effectively disabling access to cookies This means the cookies for the auctions of a control group of users were not exposed. The experiment is still wrong, the bidders will still react in real time discarding the traffic without identifiers; specially since it comes from ADX where the identifier is the key to evaluating the model. Not taking any other ad exchange into account is a huge flaw if you want to extrapolate the conclusions into conclusions for the whole industry. Other exchanges provide different identifying properties such as the 4th octet of the ip_address with each auction. Google ADX doesn't send this bit of information, they obfuscate the ip_address always. It's obvious that if you remove cookies from ADX, there is no reason to use ADX since the cookie is the proxy for your model on that exchange, but on the other ad exchanges you could survive just fine. There is no way I read this experiment in which it makes sense as a conclusion for the whole ad industry.
bloomer 7y ago
For an alternate empirical take: https://weis2019.econinfosec.org/wp-content/uploads/sites/6/2019/05/WEIS_2019_paper_38.pdf https://weis2019.econinfosec.org/wp-content/uploads/sites/6/... They find publishers only have a 4% premium on programatic ads that involve behavioral targeting.

by jefftk 7y ago

driverdan 7y ago

In other words the Chrome team doesn't care about users, it cares about ads. If it put users first, as it should, third party cookies would have been blocked a long time ago and they would be working on blocking other fingerprinting techniques now. This is a great reason to not use Chrome.

jefftk 7y ago
Users don't care about ads, but users care about the things that ads fund. If publishers go out of business, users will be worse off. Do you think the browsers should block all ads by default?
- HugoDaniel 7y ago
  Yes. (i am a user; i don't presume to know what is best for others; speaking as a user that talks to others like me; i don't need to speak about 'users' as a third party entity; i am a significant sample of the set)
  - vntok 7y ago
    Are you ready to pay every website you visit, then? With actual money that you yourself own?
    - HugoDaniel 7y ago
      As if ads is the only possible business model on the web. At best the ad revenue is taking money away from other web business models by instituting that kind of mentality that drives people away from donations and paid accounts. Please, consider a paid account/membership when you read the guardian, the intercept, or look for the donation page of quality content articles in wikipedia or any of the loads of blogs written by authors with patreon accounts.
      - vntok 7y ago
        Yeah, people will not collect subscriptions to content publishers like they collect emojis on their phones. Estimate how many websites you visit each month; people would need dozens of monthly subscriptions if such a system was set up. Instead, they will rather go to and pay google news, facebook press or apple information to get all their news content. Where would money be taken away then? Content publishers.
    - smnthermes 7y ago
      Donations exist, LMAO.
    - deleted 7y ago
      [deleted]
  - jefftk 7y ago
    Why do you think Edge, Firefox, and Safari have chosen not to block all ads by default?
- tcd 7y ago
  The web shouldn't block ads, it should block JS entirely. There should be a 'global' permission system (similar to Android) that allows me to control exactly what information websites are allowed to access from my browser. For example, I want to disable WebRTC as it can be used to collect my IP address, or disable WebGPU APIs or anything that can be used to finger print me. JS has far, far, far too much broad access to information that might seem mundane but can be used to profile a user. Android is the same - you can get the entire list of installed packages on the system and various other pieces of information to build a unique, persistable tracking ID. There's also a lack of accountability: What information is being sent to what servers? I want a detailed JSON formatted breakdown of EVERY single piece of data that is being sent from my device. I should be able to block anything that is outside my own determined comfort zone. But most OS' just make requests to US IP's without much thought now - just turn on Windows 10 in a VM and watch as it sends so many requests with no insight into the data, which many companies (including Google) don't tell you about. Ask me about a recent GDPR request to Google which I just got a generic response about (and they didn't action my request to delete information, so now I need to complain to the regulator because it was also late). So yes, blocking ALL tracking by default is sensible.
  - cageface 7y ago
    Do you hold your mobile native apps to the same standard? As a former iOS developer I guarantee you there's a lot more of your data getting collected from those than you'd think and you can't do anything about it.
- 6gvONxR4sf7o 7y ago
  Maybe free newspapers go out, and free blog platforms go out, but that means that physical local papers don't go out of business and stop having to rely on clickbait. Losing some things means gaining others.
  - jefftk 7y ago
    Sorry, clarifying: your prediction is that if internet ads became much less valuable we would see (a) the return of paper newspaper delivery and (b) the end of clickbait?
    - 6gvONxR4sf7o 7y ago
      I doubt it'll go as far as that, but I'd expect at least that if people had had to pay for news all along, the news ecosystem would have been less devastated by the pay-per-click internet than they have been in reality.
- Nextgrid 7y ago
  Today's ads are what we used to call "spyware" back in the day and we used to purchase dedicated antispyware products that protected against them, so yes, browsers should block malware (so ads in their current state). Browsers, after all, are user-agents designed to serve the user and not corporate interests. Technology as a whole should be there to make our lives easier, not waste our time. Publishers will not go out of business don't worry. Clickbait will die off because the cheap nasty ads that currently make it viable will disappear. Tasteful, pleasant ads tailored to the current content, negotiated directly between the publisher and the advertiser will remain, and will be harder to block because they are just content served just like the rest of the content on the page instead from a nasty ad network domain.
- Spivak 7y ago
  > Do you think the browsers should block all ads by default? Resounding yes. Such a thing would be the single greatest security improvement a browser could implement. It would also completely destroy pretty much the only vector online scammers have to reach you. Most forms of advertising are totally fine. Hell I’m even favor of targeted advertising so long as it’s targeted to the content demographics instead the literal individual following them around.
  - jefftk 7y ago
    I'm confused why you would say both that browsers should block all ads by default and that most forms of advertising are totally fine? > I’m even favor of targeted advertising so long as it’s targeted to the content demographics instead the literal individual following them around Then you might like FLoC (https://github.com/jkarlin/floc https://github.com/jkarlin/floc) and TURTLE-DOV (https://github.com/michaelkleber/turtledove https://github.com/michaelkleber/turtledove). These are both ways of implementing targeted advertising without letting the advertiser or ad network follow you around.
    - Spivak 7y ago
      Because internet ads are not most ads. If it's attached to an ad exchange or runs any code client side we're firmly in the "not fine category." Types of ads that I don't like but I won't be up in arms about from a security perspective. * Paying for sponsored reviews. * Affiliate links and partnerships. * Paying promoters and influences to push your product. * "One way broadcasts" like billboards, commercials, magazines. * In house ads like Kroger sending you coupons based on your purchase history at Kroger. * Corporate press events like E3. * Paying to post on the community billboard. * Paying have a booth at professional/enthusiast conferences/trade shows. * Stuff like E3/NintendoDirect/PAX/BlizzCon. * Selling air time on radio, podcasts, online videos. * Sponsored articles/announcements on blogs/news sites. * Native advertising a la Buzzfeed where they would get paid to write a listical "top 10 things you should order off the secret menu at Taco Bell." * Generic direct mailings and coupon books. * Paying employees to suggest and guide customers through the sale provided they're upfront about it. I've seen Lululemon do it somewhat tastefully on Reddit when people post topics looking for recommendations. But ads that come from ad networks/exchanges are nothing like these while simultaneously being the bulk of what ad blockers actually block. So I don't see it as a contradiction. The kinds of ads that ad blockers block aren't usually these and are instead are the spyware/malware kind.
hesarenu 7y ago
Nobody cares about users else apple would have allowed users to install others browser engines.

etaioinshrdlu 7y ago

The trouble is Apple shows this compromise is unnecessary. They work hard to block fingerprinting (especially on iOS) and it WORKS. iOS devices are mostly indistinguishable. Notoriously impossible to fingerprint. Granted desktop fingerprinting is more of a challenge due to differing OS's, screens, GPUs for WebGL, etc. But it doesn't seem impossible. They have also blocked third party cookies for so many years. The world did not catch on fire. They use an advertising ID the user can reset.

Nextgrid 7y ago
I believe they also have an "identifier for vendor" that persists even after app uninstalls/reinstalls and is the same across all the apps from the same developer, so Apple are not ideal either. Still better than the competition though.
jefftk 7y ago
I don't know very much about fingerprinting, but it sounds like the reason iOS devices are hard to fingerprint is that the hardware has very little variation?

ogre_codes 7y ago

Given the history of advertising on the web and advertising in general, I am hugely skeptical of anyone who claims that ethical personalized advertising is even possible. It was critical to election tampering in 2016, it's been used for racism, sexism, and every imaginable sort of scam. The only way personalized advertising would be remotely ethical is if it were explicitly opt-in. I notice that's not a thing on your list of steps Google is planning on doing. No surprise.

jefftk 7y ago
If you think personalized advertising is harmful and shouldn't exist anywhere across society you're going to need to pursue that through legislation and not technology. Otherwise platforms people log into (ex: Facebook) will continue personalizing regardless of what browsers implement.
- ccmcarey 7y ago
  As an aside, I appreciate you candidly discussing this.
  - jefftk 7y ago
    Thanks!
    - ficklepickle 7y ago
      I second that. It shows bravery. (Pun not intended)
- Nextgrid 7y ago
  I don't actually mind platforms personalising ads & content based on information I explicitly provide. I just don't want them stalking me around the web and trying to collect information behind my back.
  - jefftk 7y ago

DevKoala 7y ago

> a) Publishers lose about half their revenue because ads aren't personalized anymore: https://services.google.com/fh/files/misc/disabling_third-pa.. https://services.google.com/fh/files/misc/disabling_third-pa.... I am on the demand side, and the thesis and testing methodology seems extremely flawed. If you disable third party cookies on a test group of certain publishers our (demand side) bidders will start optimizing towards the control group; this is very obvious. Also, was this analysis conducted on other ad exchanges? For example, Google ADX makes only ~30% of the global traffic we get, and the traffic has very different characteristics from the traffic we get from APPNEXUS, Rubicon, etc. I believe this is an analysis for Google's internal conclusions, and not for the industry in general. Has this been made public before?

jefftk 7y ago
> If you disable third party cookies on a test group of certain publishers It says "turned off the availability of personalized data for a small fraction of randomly selected users" and "The experiment was applied to a small fraction of each publisher’s traffic because we did not want to materially affect publisher revenue, though in aggregate the amount of traffic evaluated as part of the experiment was significant". It sounds like you're responding to a version of the experiment that was run on a per-publisher basis? > was this analysis conducted on other ad exchanges? It says the experiment was conducted "through the programmatic arm of Google Ad Manager’s serving system". I'm not sure what this means, but I don't think it includes AppNexus or Rubicon. I believe any publisher could run their own version of this experiment by picking a slice of traffic and telling all their bidders to only show non-personalized ads. > Has this been made public before? This document was released in August: https://www.blog.google/products/ads/next-steps-transparency-choice-control/ https://www.blog.google/products/ads/next-steps-transparency...
- DevKoala 7y ago
  > Using this system, we ran an experiment where we turned off the availability of personalized data for a small fraction of randomly selected users through the programmatic arm of Google Ad Manager’s serving system, thus effectively disabling access to cookies This means the cookies for the auctions of a control group of users were not exposed. The experiment is still wrong, the bidders will still react in real time discarding the traffic without identifiers; specially since it comes from ADX where the identifier is the key to evaluating the model. Not taking any other ad exchange into account is a huge flaw if you want to extrapolate the conclusions into conclusions for the whole industry. Other exchanges provide different identifying properties such as the 4th octet of the ip_address with each auction. Google ADX doesn't send this bit of information, they obfuscate the ip_address always. It's obvious that if you remove cookies from ADX, there is no reason to use ADX since the cookie is the proxy for your model on that exchange, but on the other ad exchanges you could survive just fine. There is no way I read this experiment in which it makes sense as a conclusion for the whole ad industry.

bloomer 7y ago

For an alternate empirical take: https://weis2019.econinfosec.org/wp-content/uploads/sites/6/2019/05/WEIS_2019_paper_38.pdf https://weis2019.econinfosec.org/wp-content/uploads/sites/6/... They find publishers only have a 4% premium on programatic ads that involve behavioral targeting.