6 ms·

Google is killing third-party cookies – advertisers still aren't ready

35 points by thm 3y ago

sgbeal 3y ago
Paywall :(.
- shagie 3y ago
  Share link: https://www.wsj.com/tech/google-is-finally-killing-cookies-advertisers-still-arent-ready-7582fcac?st=g5gesxvu99ehk1u&reflink=desktopwebshare_permalink https://www.wsj.com/tech/google-is-finally-killing-cookies-a...
palata 3y ago
What's the catch? Google doesn't need cookies anymore because they can track users with Android/Chrome/GMail/some other trick?
- fsflover 3y ago
  https://news.ycombinator.com/item?id=26625369 https://news.ycombinator.com/item?id=26625369
- laszlojamf 3y ago
  Google tracks most users by them simply being logged in everywhere. I was working in this space a while back when FLoC was the next thing and the joke was that FLoC was just for the rest of us. Google always holds all the cards
  - TekMol 3y ago
    logged in everywhere Where? I doubt Google can track you because you are logged into HN.
    - digitcatphd 3y ago
      ~ 80% of browsers are Chrome, by my observation, they still track you even in 'incognito'
      - izzydata 3y ago
        So if I use Firefox and almost never encounter a website that uses a Google login then they aren't tracking me most of the time? It seems like they must have more tricks up their sleeve than that.
        AlexandrB 3y ago
        > It seems like they must have more tricks up their sleeve than that. Maybe, maybe not. Firefox market share is trivial at this point. I doubt Google invests a lot of time in figuring out how to track Firefox users specifically. Safari, especially on mobile, is a far more juicy target.
        capitainenemo 3y ago
        How about people using gstatic fonts and js? People embedding google calendars or youtube videos? People using google captcha? People monetising their site with google ads? Combine that with standard fingerprinting techniques.
        renegat0x0 3y ago
        Are tracking pixels still a thing? If so it allows to fingerprint you, and track you down across sites.
        red-iron-pine 3y ago
        definitely still a thing
      - Thorrez 3y ago
        >Chrome, by my observation, they still track you even in 'incognito' Can you explain this? I don't thinks this is the case. Disclosure: I work at Google but not on Chrome.
- noirscape 3y ago
  Chrome. Google is adding a dedicated "Topics API" to Chrome that they fully control the access to that does all tracking for them. (After repeatedly attempting to do it in an "agnostic" way that preserved privacy that just flat out didn't work, they just dropped the mask and openly started acting as gatekeepers for the Topics API.) That combined with the rollout of Manifest V3 permits them to axe adblockers whilst keeping full tracking enabled. The userbase percentage lost from Firefox users (around 3%, everything else runs a Firefox derivative or is iOS with Safari, which Google assumes is dead in the water due to the DMA) isn't enough to not have them transition fully to the Topics API at this point because of the ad profits they think they can get out of unwinding adblockers in Chrome. Google is closing the advertising jaws around Chrome and this is what that looks like.
  - ahahahahah 3y ago
    The "Topics API" isn't really for Google. Basically, in the market of ad platforms, platforms other than Google are much more reliant on third-party tracking than Google itself is. Given that, regulators would not allow Google to remove third party cookie support from Chrome because it would unfairly benefit their own ad platform. The "Topics API" (and previous attempts) have been Google trying to find the most privacy-preserving thing that they could use to replace third party cookies and that would convince the regulators to allow them to remove third party cookies.
    - noirscape 3y ago
      ...regulators aren't forbidding Google from blocking third party cookies as far as I can tell. I don't know what you're on about with that. The Topics API requires Google to approve your script before it works and if they didn't care about Ads and third party cookies, they'd have turned it off long ago.
      - Scion9066 3y ago
        Google definitely can't just block third-party cookies on their own: https://blog.google/products/chrome/privacy-sandbox-tracking-protection/ https://blog.google/products/chrome/privacy-sandbox-tracking... On January 4, we'll begin testing Tracking Protection, a new feature that limits cross-site tracking by restricting website access to third-party cookies by default. We'll roll this out to 1% of Chrome users globally, a key milestone in our Privacy Sandbox initiative to phase out third-party cookies for everyone in the second half of 2024, subject to addressing any remaining competition concerns from the UK’s Competition and Markets Authority. https://assets.publishing.service.gov.uk/media/653a58e2e6c968000daa9b94/__Q3_2023_update_report____.pdf https://assets.publishing.service.gov.uk/media/653a58e2e6c96... We would like to reassure the ecosystem that deprecation of third-party cookies can only take place once the competition concerns, identified by the CMA during its investigation, are addressed by Google. We have asked Google to be clear about this in its communications. Under the Commitments, there will be a Standstill Period of 60 days that applies before third-party cookies can be removed. This period can be extended to 120 days. During the Standstill Period, we will determine whether third-party cookie deprecation can go ahead based on the evidence we are gathering. This includes evidence from tests of the tools conducted by Google and other market participants. Our aim is to gather evidence of the likely impacts of the changes by the middle of 2024. The Standstill Period will take place following this, and once testing has been completed.
- jefftk 3y ago
  Google committed to removing support for cross-site tracking (which here is being confusingly called "cookies") because other browsers were implementing it as a privacy measure. They've taken a long time to do it because they made a somewhat impractical promise to remove cross-site tracking while maintaining its economic benefits via new privacy-preserving APIs (PrivacySandbox). For example, see https://developers.google.com/privacy-sandbox/relevance/protected-audience https://developers.google.com/privacy-sandbox/relevance/prot... (Disclosure: until 2022 I worked in this area at Google)
spicybbq 3y ago
https://ghostarchive.org/archive/oOa4d https://ghostarchive.org/archive/oOa4d
- Brajeshwar 3y ago
  This is new. Is this related to Archive.org or other independent group?
  - mannycalavera42 3y ago
    https://ghostarchive.org/about.html https://ghostarchive.org/about.html
  - OrderlyTiamat 3y ago
    This looks great! I'd also like to know some more details. Is this akin to archive.org, or more akin to archive.today? Those have different use cases. I'd like more information than is present in the FAQ, for example, will this archive block users of cloudflare DNS? I'd love to use an archive like archive.today, which is more dependable and less idiosyncratic in what users it allows, so this looks promising.
deleted 3y ago
[deleted]
flanked-evergl 3y ago
This applies to third-party cookies, right? So why does the article say "Killing Cookies" instead of "Killing Third-Party Cookies"?
- joecasson 3y ago
  You are correct - only third-party, cross domain cookies. WSJ and other writers simplify to "cookies" because it's a simpler headline and only a small percentage of people understand the difference (even tech workers!). It's terribly annoying that they do this because first party cookies are invaluable and will never go away until there is something just as easy to maintain state on on a website (e.g. remembering that you're logged in from page to page, session to session). Source - I work in marketing tech.
  - willsmith72 3y ago
    I guess depends on the definition of tech workers, I haven't worked with engineers who would think google was actually killing all cookies. Only true if you included design, content, sales etc
  - Dalewyn 3y ago
    >first party cookies are invaluable I am coming to find I don't want cookies, including first-party, on the vast majority of websites. Specifically, I only want first-party cookies on websites I login to. Otherwise, I can't remember the last time in recent memory when first-party cookies benefitted me in some worthwhile way. They only serve to track me or otherwise disturb my peace for the benefit of the webmaster. So far I've been opening a lot of websites in Private Mode, but maybe it's just easier to blanket blacklist all cookies and then handpick the small number I want to whitelist.
    - jefftk 3y ago
      > Otherwise, I can't remember the last time in recent memory when first-party cookies benefitted me in some worthwhile way. A very standard example is when you put something in a shopping cart the site needs some way to record this, which requires cookies or other client-side storage. And if it's a site you've never bought from before you wouldn't be logged in.
deleted 3y ago
[deleted]
xnx 3y ago
Killing third party cookies is great. Has fingerprinting mitigation gotten good enough to make fingerprinting (with any worthwhile specificity) useless?
dedoussis 3y ago
Would this also affect chrome extensions? For example, when an extension makes a request to a 3rd-party domain, browsers by default pass all the cookies associated with that domain to the server. AFAIU, these cookies are considered to be 3rd-party.

35 points by thm 3y ago

sgbeal 3y ago

Paywall :(.

shagie 3y ago
Share link: https://www.wsj.com/tech/google-is-finally-killing-cookies-advertisers-still-arent-ready-7582fcac?st=g5gesxvu99ehk1u&reflink=desktopwebshare_permalink https://www.wsj.com/tech/google-is-finally-killing-cookies-a...

palata 3y ago

What's the catch? Google doesn't need cookies anymore because they can track users with Android/Chrome/GMail/some other trick?

fsflover 3y ago
https://news.ycombinator.com/item?id=26625369 https://news.ycombinator.com/item?id=26625369
laszlojamf 3y ago
Google tracks most users by them simply being logged in everywhere. I was working in this space a while back when FLoC was the next thing and the joke was that FLoC was just for the rest of us. Google always holds all the cards
- TekMol 3y ago
  logged in everywhere Where? I doubt Google can track you because you are logged into HN.
  - digitcatphd 3y ago
    ~ 80% of browsers are Chrome, by my observation, they still track you even in 'incognito'
    - izzydata 3y ago
      So if I use Firefox and almost never encounter a website that uses a Google login then they aren't tracking me most of the time? It seems like they must have more tricks up their sleeve than that.
      - AlexandrB 3y ago
        > It seems like they must have more tricks up their sleeve than that. Maybe, maybe not. Firefox market share is trivial at this point. I doubt Google invests a lot of time in figuring out how to track Firefox users specifically. Safari, especially on mobile, is a far more juicy target.
      - capitainenemo 3y ago
        How about people using gstatic fonts and js? People embedding google calendars or youtube videos? People using google captcha? People monetising their site with google ads? Combine that with standard fingerprinting techniques.
      - renegat0x0 3y ago
        Are tracking pixels still a thing? If so it allows to fingerprint you, and track you down across sites.
        red-iron-pine 3y ago
        definitely still a thing
    - Thorrez 3y ago
      >Chrome, by my observation, they still track you even in 'incognito' Can you explain this? I don't thinks this is the case. Disclosure: I work at Google but not on Chrome.
noirscape 3y ago
Chrome. Google is adding a dedicated "Topics API" to Chrome that they fully control the access to that does all tracking for them. (After repeatedly attempting to do it in an "agnostic" way that preserved privacy that just flat out didn't work, they just dropped the mask and openly started acting as gatekeepers for the Topics API.) That combined with the rollout of Manifest V3 permits them to axe adblockers whilst keeping full tracking enabled. The userbase percentage lost from Firefox users (around 3%, everything else runs a Firefox derivative or is iOS with Safari, which Google assumes is dead in the water due to the DMA) isn't enough to not have them transition fully to the Topics API at this point because of the ad profits they think they can get out of unwinding adblockers in Chrome. Google is closing the advertising jaws around Chrome and this is what that looks like.
- ahahahahah 3y ago
  The "Topics API" isn't really for Google. Basically, in the market of ad platforms, platforms other than Google are much more reliant on third-party tracking than Google itself is. Given that, regulators would not allow Google to remove third party cookie support from Chrome because it would unfairly benefit their own ad platform. The "Topics API" (and previous attempts) have been Google trying to find the most privacy-preserving thing that they could use to replace third party cookies and that would convince the regulators to allow them to remove third party cookies.
  - noirscape 3y ago
    ...regulators aren't forbidding Google from blocking third party cookies as far as I can tell. I don't know what you're on about with that. The Topics API requires Google to approve your script before it works and if they didn't care about Ads and third party cookies, they'd have turned it off long ago.
    - Scion9066 3y ago
      Google definitely can't just block third-party cookies on their own: https://blog.google/products/chrome/privacy-sandbox-tracking-protection/ https://blog.google/products/chrome/privacy-sandbox-tracking... On January 4, we'll begin testing Tracking Protection, a new feature that limits cross-site tracking by restricting website access to third-party cookies by default. We'll roll this out to 1% of Chrome users globally, a key milestone in our Privacy Sandbox initiative to phase out third-party cookies for everyone in the second half of 2024, subject to addressing any remaining competition concerns from the UK’s Competition and Markets Authority. https://assets.publishing.service.gov.uk/media/653a58e2e6c968000daa9b94/__Q3_2023_update_report____.pdf https://assets.publishing.service.gov.uk/media/653a58e2e6c96... We would like to reassure the ecosystem that deprecation of third-party cookies can only take place once the competition concerns, identified by the CMA during its investigation, are addressed by Google. We have asked Google to be clear about this in its communications. Under the Commitments, there will be a Standstill Period of 60 days that applies before third-party cookies can be removed. This period can be extended to 120 days. During the Standstill Period, we will determine whether third-party cookie deprecation can go ahead based on the evidence we are gathering. This includes evidence from tests of the tools conducted by Google and other market participants. Our aim is to gather evidence of the likely impacts of the changes by the middle of 2024. The Standstill Period will take place following this, and once testing has been completed.
jefftk 3y ago
Google committed to removing support for cross-site tracking (which here is being confusingly called "cookies") because other browsers were implementing it as a privacy measure. They've taken a long time to do it because they made a somewhat impractical promise to remove cross-site tracking while maintaining its economic benefits via new privacy-preserving APIs (PrivacySandbox). For example, see https://developers.google.com/privacy-sandbox/relevance/protected-audience https://developers.google.com/privacy-sandbox/relevance/prot... (Disclosure: until 2022 I worked in this area at Google)

spicybbq 3y ago

https://ghostarchive.org/archive/oOa4d https://ghostarchive.org/archive/oOa4d

Brajeshwar 3y ago
This is new. Is this related to Archive.org or other independent group?
- mannycalavera42 3y ago
  https://ghostarchive.org/about.html https://ghostarchive.org/about.html
- OrderlyTiamat 3y ago
  This looks great! I'd also like to know some more details. Is this akin to archive.org, or more akin to archive.today? Those have different use cases. I'd like more information than is present in the FAQ, for example, will this archive block users of cloudflare DNS? I'd love to use an archive like archive.today, which is more dependable and less idiosyncratic in what users it allows, so this looks promising.

deleted 3y ago

[deleted]

flanked-evergl 3y ago

This applies to third-party cookies, right? So why does the article say "Killing Cookies" instead of "Killing Third-Party Cookies"?

joecasson 3y ago
You are correct - only third-party, cross domain cookies. WSJ and other writers simplify to "cookies" because it's a simpler headline and only a small percentage of people understand the difference (even tech workers!). It's terribly annoying that they do this because first party cookies are invaluable and will never go away until there is something just as easy to maintain state on on a website (e.g. remembering that you're logged in from page to page, session to session). Source - I work in marketing tech.
- willsmith72 3y ago
  I guess depends on the definition of tech workers, I haven't worked with engineers who would think google was actually killing all cookies. Only true if you included design, content, sales etc
- Dalewyn 3y ago
  >first party cookies are invaluable I am coming to find I don't want cookies, including first-party, on the vast majority of websites. Specifically, I only want first-party cookies on websites I login to. Otherwise, I can't remember the last time in recent memory when first-party cookies benefitted me in some worthwhile way. They only serve to track me or otherwise disturb my peace for the benefit of the webmaster. So far I've been opening a lot of websites in Private Mode, but maybe it's just easier to blanket blacklist all cookies and then handpick the small number I want to whitelist.
  - jefftk 3y ago
    > Otherwise, I can't remember the last time in recent memory when first-party cookies benefitted me in some worthwhile way. A very standard example is when you put something in a shopping cart the site needs some way to record this, which requires cookies or other client-side storage. And if it's a site you've never bought from before you wouldn't be logged in.

deleted 3y ago

[deleted]

xnx 3y ago

Killing third party cookies is great. Has fingerprinting mitigation gotten good enough to make fingerprinting (with any worthwhile specificity) useless?

dedoussis 3y ago

Would this also affect chrome extensions? For example, when an extension makes a request to a 3rd-party domain, browsers by default pass all the cookies associated with that domain to the server. AFAIU, these cookies are considered to be 3rd-party.