6 ms·

Our research group does work in this space[1], so I’ll claim some familiarity. This article has multiple problems: 1. Privacy Sandbox is a project, consisting

Our research group does work in this space[1], so I’ll claim some familiarity. This article has multiple problems: 1. Privacy Sandbox is a project, consisting of many proposals. To pitch it as some cohesive product is misleading. 2. Related: FLoC and Topics are completely separate things, aside from existing under the same project. 3. Topics is reducible to (implementable using) third-party cookies. While the proposal has issues and doesn’t resist tracking as well as Google claims (see below article), Ars’ implication that this is somehow making Chrome less privacy-preserving is patently false. [1] https://arxiv.org/abs/2306.03825 https://arxiv.org/abs/2306.03825

StewardMcOy 3y ago
I didn't read the Ars article as saying FLoC or Topics make Chrome less privacy-preserving than it was before, but rather that, once Chrome disables third-party cookies, they make Chrome less privacy-preserving than other browsers with third-party cookies disabled. What the author would prefer is that Google also disable third-party cookies and also not ship FLoC or Topics.
- summerlight 3y ago
  > What the author would prefer is that Google also disable third-party cookies and also not ship FLoC or Topics. That's not an option now thanks to multiple antitrust regulatories. Google actually tried to get rid of 3p cookies to use it as an advantage against competitors as well as privacy friendly PR but this has been blocked. One example from CMA (but not limited to): https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf https://assets.publishing.service.gov.uk/media/62052c52e90e0...
  - StewardMcOy 3y ago
    Sorry for responding 12 hours later, but I felt I should actually read the ruling here before I replied. It's certainly interesting. The CMA seems to be attempting to balance interests of multiple parties, including both user privacy, healthy competition in the ads space, and the ability for digital publishers to generate revenue from displaying ads. However, most of it appears to focus on the way Google's superior access to information could distort competition. It's not just about cookies. For example. Google could mine synced history data from Chrome. Now, I'm not so naive as to think this would actually happen, but again, the Ars author's solution here could solve that particular problem: If Google ceased all behavior-based advertising in favor of, for example, subject-based advertising, there would be no distortions to competition. Google can't track you, and neither can other advertisers. Everyone has a level playing field. Of course, that would drop revenues for digital publishers and advertising networks, including Google, but it would solve the problems of user privacy and distorted competition. The one thing this ruling makes very clear though, is that it's very difficult to balance these concerns while Google makes a browser. There's a conflict between Google running a behavior-based advertising network and shipping a browser, and these regulatory bodies seem to be bending over backwards to try to find a solution where both of these things can exist. They could most certainly have taken the much easier road of forcing Google to discontinue Chrome.
    - Scion9066 3y ago
      Regarding the option of Google ceasing all behavior-based tracking to avoid competition issues: I doubt they could do that to the ad industry unilaterally. Even if they would then be following the same rules themselves, I don't think they'd be able to get away with choosing how all other advertisers must operate by doing that. Regarding the "easier road" of having Google discontinue Chrome: WTF That would not be easier and would affect so much more.
      - StewardMcOy 3y ago
        By "easier", I mean it would be easier for the regulators to say, "you can have a dominant ad network or a dominant web browser, but not both." But I was a bit imprecise with my language there. There are other regulatory remedies to a ruling like that besides discontinuing Chrome. For example, it could be spun off into a separate company, one which does not share any data with Google. As for the fantasy scenario where Google stops behavior-based tracking, reading that ruling, I think they could get away with it, but there would be some grumbling. Let's say Google stopped tracking on its end, and then six months later, decided to block third-party cookies by default. Regulators could insist that Google keep third-party cookies on, but what leg would they have to stand on? Yes, it would affect their competitors in a big way, but it wouldn't give Google a distorting advantage over them. And with every other browser blocking third-party cookies, if regulators tried to force Google to keep them, Google could just stop developing Chrome. Without behavior-based tracking, they have no business reason to develop it anymore, and how could regulators possibly say, "You have to keep making a browser, even though your competitors don't"?
    - summerlight 3y ago
      > If Google ceased all behavior-based advertising in favor of, for example, subject-based advertising, there would be no distortions to competition. That still doesn't work. Google already has built dominant ad network/serving infrastructure as well as exclusive access to billions of its first party user data which gives asymmetric power to Google against any other competitors. Probably the only advantage that those competitors have is their own "secret sauce" on user data and removing 3p cookie effectively eliminates this edge and gives Google unilateral power. The core problem is that privacy and antitrust regulations usually don't work very well together unless it's carefully designed. EU tried it for GDPR (which took 4 years to design) and it only has strengthened big-tech's position. > They could most certainly have taken the much easier road of forcing Google to discontinue Chrome. It's much easier said than done. What's the legal basis of doing this? The only applicable law is too general and requires intervention from the Judiciary. And this level of landmark antitrust cases usually takes several years with extremely high level of uncertainties. And it's worth noting that the US congress has failed to introduce a basic level of digital antitrust laws such as AICOA or OAMA, so good luck with any new direct regulations. And even if assuming that everything works in your favor, the result is almost guaranteed to be other big guys (likely MS) taking the share and doing something worse since the market is already strongly incentivizing this behavior. To apply the same "correction", it will take another multiple years of trial against more well prepared defendant. Regulators and legislators are not that dumb and they actually care about all those unintended consequences.
hedora 3y ago
It's less privacy preserving in that it is anti-competitive, so now google gets a monopoly on this form of tracking. I assume they'll eventually combine all the data from their other monopolies, and continue to use lobbyists to block improved laws or even enforcement of the existing laws they break.
cageface 3y ago
Ron Amadeo has such a consistently snarky anti Google stance that I no longer read his articles. I haven't seen any other tech company get such dismissive treatment on Ars.
- drivebycomment 3y ago
  Agreed. I think he crossed the line way beyond being skeptical about Google, and into partisan politics level biased reporting against Google. E.g. his coverage of passkey was so bad - misleading half truths and outright incorrect claims - that made a subsequent article on the passkey by another Ars reporter look completely opposite from what he wrote.
  - ghusto 3y ago
    Isn't that much like how reporting of Microsoft during the 90s wasn't "sceptical", but just calling the pot black? At a certain point — i.e. given enough history — it's a given that a company acts against your best interests. I don't see judging a company on their actions as bias. Google is a corporation that does terrible things. That's not bias, it's observation. Having said all that, what were his half truths and incorrect claims on passkey? genuinely interested to educate myself.
    - drivebycomment 3y ago
      https://arstechnica.com/gadgets/2023/05/passwordless-google-accounts-are-here-you-can-now-switch-to-passkey-only/ https://arstechnica.com/gadgets/2023/05/passwordless-google-... is the article. The title is already misleading - Google doesn't support passwordless account, and there is no way to get a passkey only account. So factually incorrect title. Anyway, read that and contrast that with: https://arstechnica.com/information-technology/2023/05/passwordless-google-accounts-are-easier-and-more-secure-than-passwords-heres-why/ https://arstechnica.com/information-technology/2023/05/passw...
      - ghusto 3y ago
        Thanks. As an aside, I think this is the source of his confusion about password-less accounts. From Google's help page: > When you create a passkey, you opt in to a passkey-first, password-less sign-in experience That comma right there reads; "you opt in to a passkey-first _and_ password-less sign-in experience". I understand what they mean, but that kind of marketing speak is often misunderstood by more technically focussed people.
chrismorgan 3y ago
Although the source article here is clearly opinionated in one direction, I’m not impressed with your claims about actual problems in it. (For reference, I agree with the direction it takes and would make only minor adjustments to it if I were writing it—the only of any substance would be not calling the Privacy Sandbox an “ad platform” just because in a way it’s a little more like a shop that sells picks to ad platforms.) > 1. Privacy Sandbox is a project, consisting of many proposals. To pitch it as some cohesive product is misleading. Look, that’s how Google are branding it. It’s an initiative which has turned into a cohesive brand. Just look at how https://privacysandbox.com/news/privacy-sandbox-for-the-web-reaches-general-availability https://privacysandbox.com/news/privacy-sandbox-for-the-web-... speaks of it all. That’s pretty much how it’s being presented in the browser, too. > 2. Related: FLoC and Topics are completely separate things, aside from existing under the same project. They’re about as completely separate as Chrome 17 and Chrome 117, or StarOffice and OpenOffice.org. OK, these are both very imperfect comparisons, but although FLoC and Topics work in somewhat different ways, Topics is for all practical purposes just a fork that continues FLoC. They even treated it that way in the browser (at the time at least, no idea if it’s still so). https://en.wikipedia.org/wiki/Federated_Learning_of_Cohorts#Rebranding_as_Topics_API https://en.wikipedia.org/wiki/Federated_Learning_of_Cohorts#... seems overall a fair enough portrayal. They simply rebranded the basic concept. > 3. Topics is reducible to (implementable using) third-party cookies. While the proposal has issues and doesn’t resist tracking as well as Google claims (see below article), Ars’ implication that this is somehow making Chrome less privacy-preserving is patently false. The first and last claims here are obvious nonsense. Third-party cookies only let you track stuff where your code runs, whereas the Topics API uses the entire browser history, so it’s not reducible to third-party cookies unless you mean something very different from me by that word. Ars’ implication is by no means patently false; as far as the current status is concerned, where they’ve added this and not removed third-party cookies, it’s patently true. In the longer term, it’s less clear, better in some ways and worse in others, but “patently false” is still an unreasonable characterisation.
- charcircuit 3y ago
  >whereas the Topics API uses the entire browser history It doesn't use the full history. If a site is using the Topics API it will only get back topics that it has observed from sites in the last 3 epochs. For site X to observe a topic from site Y. Site Y must either: * Be site X * Embed site X in an iframe on the page with a special attribute on the iframe element * Send a fetch request to site X with a special header and site X must respond with a special header
1vuio0pswjnm7 3y ago
Huh. I did not detect such an implication. The gist of the article for me was Google is using a new system. Perhaps there is an implication that based on the deceptive use of the term "privacy" some users might believe that Chrome is now more privacy preserving. That would of course be patently false. But it seems this comparison to third party cookies ignores the fact that now one company, Google, gets a maximum amount of tracking data without having to cooperate with any other entity. That potentially could be a loss for privacy because the concentration of personal data at one entity, i.e., Google, requires less cooperation, e.g., data sharing. It's easier.
seanhunter 3y ago
> Topics is reducible to (implementable using) third-party cookies. Yes, but aren't 3rd party cookies going to get banned? That seems to be the common assumption in the adtech space. If that's true isn't topics just google's mechanism to continue the kind of tracking that lawmakers are trying to ban by banning 3rd party cookies?
- jsnell 3y ago
  This is the first I've heard of such a law. Do you have a reference? Which country?
  - josefx 3y ago
    Going by GDPR any tracking that isn't necessary for your service to work has to be optional and the site operator has to list and explain every bit of data he tracks. Moving that tracking directly into the browser seems like a cheap attempt at trying to bypass the GDPR.
  - seanhunter 3y ago
    Search for "death of third party cookies" and you will find a huge amount of material about it. It's basically a trend that everyone in marketing expects. Here's a tiny sample but I've tried to draw on a wide swath of different sources. [1] https://www.mckinsey.com/capabilities/growth-marketing-and-sales/our-insights/the-demise-of-third-party-cookies-and-identifiers https://www.mckinsey.com/capabilities/growth-marketing-and-s... [2] https://www.forbes.com/sites/theyec/2022/09/12/the-slow-death-of-third-party-cookies/ https://www.forbes.com/sites/theyec/2022/09/12/the-slow-deat... [3] https://blog.hubspot.com/marketing/third-party-cookie-phase-out https://blog.hubspot.com/marketing/third-party-cookie-phase-... [4] https://www.marketingweek.com/death-third-party-cookies-google/ https://www.marketingweek.com/death-third-party-cookies-goog... [5] https://www.techtarget.com/whatis/feature/The-death-of-third-party-cookies-What-marketers-need-to-know https://www.techtarget.com/whatis/feature/The-death-of-third...
    - jsnell 3y ago
      As far I can tell, none of those links are talking about "lawmakers banning 3rd party cookies". They're mostly about Google wanting to remove 3p cookies from Chrome. A couple of them reference laws, but it's just talking about general privacy law trends by giving examples of laws that are already passed like GDPR and did not in fact lead to a ban of 3p cookies. Since none of your links provided any evidence for this, I'm going to guess that the waste swathe of material doesn't actually exist.
xinayder 3y ago
Disclaimer: you work for Google?
- Rebelgecko 3y ago
  If you go to his bio he doesn't say that on his CV, so seems kinda unlikely Disclaimer: I work for Google but my opinions and web crawling abilities are mine and mine alone.
- ericpauley 3y ago
  No.
the8472 3y ago
> 3. Topics is reducible to (implementable using) third-party cookies. Even with 1st-party cookie jar isolation?

StewardMcOy 3y ago

I didn't read the Ars article as saying FLoC or Topics make Chrome less privacy-preserving than it was before, but rather that, once Chrome disables third-party cookies, they make Chrome less privacy-preserving than other browsers with third-party cookies disabled. What the author would prefer is that Google also disable third-party cookies and also not ship FLoC or Topics.

summerlight 3y ago
> What the author would prefer is that Google also disable third-party cookies and also not ship FLoC or Topics. That's not an option now thanks to multiple antitrust regulatories. Google actually tried to get rid of 3p cookies to use it as an advantage against competitors as well as privacy friendly PR but this has been blocked. One example from CMA (but not limited to): https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf https://assets.publishing.service.gov.uk/media/62052c52e90e0...
- StewardMcOy 3y ago
  Sorry for responding 12 hours later, but I felt I should actually read the ruling here before I replied. It's certainly interesting. The CMA seems to be attempting to balance interests of multiple parties, including both user privacy, healthy competition in the ads space, and the ability for digital publishers to generate revenue from displaying ads. However, most of it appears to focus on the way Google's superior access to information could distort competition. It's not just about cookies. For example. Google could mine synced history data from Chrome. Now, I'm not so naive as to think this would actually happen, but again, the Ars author's solution here could solve that particular problem: If Google ceased all behavior-based advertising in favor of, for example, subject-based advertising, there would be no distortions to competition. Google can't track you, and neither can other advertisers. Everyone has a level playing field. Of course, that would drop revenues for digital publishers and advertising networks, including Google, but it would solve the problems of user privacy and distorted competition. The one thing this ruling makes very clear though, is that it's very difficult to balance these concerns while Google makes a browser. There's a conflict between Google running a behavior-based advertising network and shipping a browser, and these regulatory bodies seem to be bending over backwards to try to find a solution where both of these things can exist. They could most certainly have taken the much easier road of forcing Google to discontinue Chrome.
  - Scion9066 3y ago
    Regarding the option of Google ceasing all behavior-based tracking to avoid competition issues: I doubt they could do that to the ad industry unilaterally. Even if they would then be following the same rules themselves, I don't think they'd be able to get away with choosing how all other advertisers must operate by doing that. Regarding the "easier road" of having Google discontinue Chrome: WTF That would not be easier and would affect so much more.
    - StewardMcOy 3y ago
      By "easier", I mean it would be easier for the regulators to say, "you can have a dominant ad network or a dominant web browser, but not both." But I was a bit imprecise with my language there. There are other regulatory remedies to a ruling like that besides discontinuing Chrome. For example, it could be spun off into a separate company, one which does not share any data with Google. As for the fantasy scenario where Google stops behavior-based tracking, reading that ruling, I think they could get away with it, but there would be some grumbling. Let's say Google stopped tracking on its end, and then six months later, decided to block third-party cookies by default. Regulators could insist that Google keep third-party cookies on, but what leg would they have to stand on? Yes, it would affect their competitors in a big way, but it wouldn't give Google a distorting advantage over them. And with every other browser blocking third-party cookies, if regulators tried to force Google to keep them, Google could just stop developing Chrome. Without behavior-based tracking, they have no business reason to develop it anymore, and how could regulators possibly say, "You have to keep making a browser, even though your competitors don't"?
  - summerlight 3y ago
    > If Google ceased all behavior-based advertising in favor of, for example, subject-based advertising, there would be no distortions to competition. That still doesn't work. Google already has built dominant ad network/serving infrastructure as well as exclusive access to billions of its first party user data which gives asymmetric power to Google against any other competitors. Probably the only advantage that those competitors have is their own "secret sauce" on user data and removing 3p cookie effectively eliminates this edge and gives Google unilateral power. The core problem is that privacy and antitrust regulations usually don't work very well together unless it's carefully designed. EU tried it for GDPR (which took 4 years to design) and it only has strengthened big-tech's position. > They could most certainly have taken the much easier road of forcing Google to discontinue Chrome. It's much easier said than done. What's the legal basis of doing this? The only applicable law is too general and requires intervention from the Judiciary. And this level of landmark antitrust cases usually takes several years with extremely high level of uncertainties. And it's worth noting that the US congress has failed to introduce a basic level of digital antitrust laws such as AICOA or OAMA, so good luck with any new direct regulations. And even if assuming that everything works in your favor, the result is almost guaranteed to be other big guys (likely MS) taking the share and doing something worse since the market is already strongly incentivizing this behavior. To apply the same "correction", it will take another multiple years of trial against more well prepared defendant. Regulators and legislators are not that dumb and they actually care about all those unintended consequences.

hedora 3y ago

It's less privacy preserving in that it is anti-competitive, so now google gets a monopoly on this form of tracking. I assume they'll eventually combine all the data from their other monopolies, and continue to use lobbyists to block improved laws or even enforcement of the existing laws they break.

cageface 3y ago

Ron Amadeo has such a consistently snarky anti Google stance that I no longer read his articles. I haven't seen any other tech company get such dismissive treatment on Ars.

drivebycomment 3y ago
Agreed. I think he crossed the line way beyond being skeptical about Google, and into partisan politics level biased reporting against Google. E.g. his coverage of passkey was so bad - misleading half truths and outright incorrect claims - that made a subsequent article on the passkey by another Ars reporter look completely opposite from what he wrote.
- ghusto 3y ago
  Isn't that much like how reporting of Microsoft during the 90s wasn't "sceptical", but just calling the pot black? At a certain point — i.e. given enough history — it's a given that a company acts against your best interests. I don't see judging a company on their actions as bias. Google is a corporation that does terrible things. That's not bias, it's observation. Having said all that, what were his half truths and incorrect claims on passkey? genuinely interested to educate myself.
  - drivebycomment 3y ago
    https://arstechnica.com/gadgets/2023/05/passwordless-google-accounts-are-here-you-can-now-switch-to-passkey-only/ https://arstechnica.com/gadgets/2023/05/passwordless-google-... is the article. The title is already misleading - Google doesn't support passwordless account, and there is no way to get a passkey only account. So factually incorrect title. Anyway, read that and contrast that with: https://arstechnica.com/information-technology/2023/05/passwordless-google-accounts-are-easier-and-more-secure-than-passwords-heres-why/ https://arstechnica.com/information-technology/2023/05/passw...
    - ghusto 3y ago
      Thanks. As an aside, I think this is the source of his confusion about password-less accounts. From Google's help page: > When you create a passkey, you opt in to a passkey-first, password-less sign-in experience That comma right there reads; "you opt in to a passkey-first _and_ password-less sign-in experience". I understand what they mean, but that kind of marketing speak is often misunderstood by more technically focussed people.

chrismorgan 3y ago

Although the source article here is clearly opinionated in one direction, I’m not impressed with your claims about actual problems in it. (For reference, I agree with the direction it takes and would make only minor adjustments to it if I were writing it—the only of any substance would be not calling the Privacy Sandbox an “ad platform” just because in a way it’s a little more like a shop that sells picks to ad platforms.) > 1. Privacy Sandbox is a project, consisting of many proposals. To pitch it as some cohesive product is misleading. Look, that’s how Google are branding it. It’s an initiative which has turned into a cohesive brand. Just look at how https://privacysandbox.com/news/privacy-sandbox-for-the-web-reaches-general-availability https://privacysandbox.com/news/privacy-sandbox-for-the-web-... speaks of it all. That’s pretty much how it’s being presented in the browser, too. > 2. Related: FLoC and Topics are completely separate things, aside from existing under the same project. They’re about as completely separate as Chrome 17 and Chrome 117, or StarOffice and OpenOffice.org. OK, these are both very imperfect comparisons, but although FLoC and Topics work in somewhat different ways, Topics is for all practical purposes just a fork that continues FLoC. They even treated it that way in the browser (at the time at least, no idea if it’s still so). https://en.wikipedia.org/wiki/Federated_Learning_of_Cohorts#Rebranding_as_Topics_API https://en.wikipedia.org/wiki/Federated_Learning_of_Cohorts#... seems overall a fair enough portrayal. They simply rebranded the basic concept. > 3. Topics is reducible to (implementable using) third-party cookies. While the proposal has issues and doesn’t resist tracking as well as Google claims (see below article), Ars’ implication that this is somehow making Chrome less privacy-preserving is patently false. The first and last claims here are obvious nonsense. Third-party cookies only let you track stuff where your code runs, whereas the Topics API uses the entire browser history, so it’s not reducible to third-party cookies unless you mean something very different from me by that word. Ars’ implication is by no means patently false; as far as the current status is concerned, where they’ve added this and not removed third-party cookies, it’s patently true. In the longer term, it’s less clear, better in some ways and worse in others, but “patently false” is still an unreasonable characterisation.

charcircuit 3y ago
>whereas the Topics API uses the entire browser history It doesn't use the full history. If a site is using the Topics API it will only get back topics that it has observed from sites in the last 3 epochs. For site X to observe a topic from site Y. Site Y must either: * Be site X * Embed site X in an iframe on the page with a special attribute on the iframe element * Send a fetch request to site X with a special header and site X must respond with a special header

1vuio0pswjnm7 3y ago

Huh. I did not detect such an implication. The gist of the article for me was Google is using a new system. Perhaps there is an implication that based on the deceptive use of the term "privacy" some users might believe that Chrome is now more privacy preserving. That would of course be patently false. But it seems this comparison to third party cookies ignores the fact that now one company, Google, gets a maximum amount of tracking data without having to cooperate with any other entity. That potentially could be a loss for privacy because the concentration of personal data at one entity, i.e., Google, requires less cooperation, e.g., data sharing. It's easier.

seanhunter 3y ago

> Topics is reducible to (implementable using) third-party cookies. Yes, but aren't 3rd party cookies going to get banned? That seems to be the common assumption in the adtech space. If that's true isn't topics just google's mechanism to continue the kind of tracking that lawmakers are trying to ban by banning 3rd party cookies?

jsnell 3y ago
This is the first I've heard of such a law. Do you have a reference? Which country?
- josefx 3y ago
  Going by GDPR any tracking that isn't necessary for your service to work has to be optional and the site operator has to list and explain every bit of data he tracks. Moving that tracking directly into the browser seems like a cheap attempt at trying to bypass the GDPR.
- seanhunter 3y ago
  Search for "death of third party cookies" and you will find a huge amount of material about it. It's basically a trend that everyone in marketing expects. Here's a tiny sample but I've tried to draw on a wide swath of different sources. [1] https://www.mckinsey.com/capabilities/growth-marketing-and-sales/our-insights/the-demise-of-third-party-cookies-and-identifiers https://www.mckinsey.com/capabilities/growth-marketing-and-s... [2] https://www.forbes.com/sites/theyec/2022/09/12/the-slow-death-of-third-party-cookies/ https://www.forbes.com/sites/theyec/2022/09/12/the-slow-deat... [3] https://blog.hubspot.com/marketing/third-party-cookie-phase-out https://blog.hubspot.com/marketing/third-party-cookie-phase-... [4] https://www.marketingweek.com/death-third-party-cookies-google/ https://www.marketingweek.com/death-third-party-cookies-goog... [5] https://www.techtarget.com/whatis/feature/The-death-of-third-party-cookies-What-marketers-need-to-know https://www.techtarget.com/whatis/feature/The-death-of-third...
  - jsnell 3y ago
    As far I can tell, none of those links are talking about "lawmakers banning 3rd party cookies". They're mostly about Google wanting to remove 3p cookies from Chrome. A couple of them reference laws, but it's just talking about general privacy law trends by giving examples of laws that are already passed like GDPR and did not in fact lead to a ban of 3p cookies. Since none of your links provided any evidence for this, I'm going to guess that the waste swathe of material doesn't actually exist.

xinayder 3y ago

Disclaimer: you work for Google?

Rebelgecko 3y ago
If you go to his bio he doesn't say that on his CV, so seems kinda unlikely Disclaimer: I work for Google but my opinions and web crawling abilities are mine and mine alone.
ericpauley 3y ago
No.

the8472 3y ago

> 3. Topics is reducible to (implementable using) third-party cookies. Even with 1st-party cookie jar isolation?