Google and the Cookie Crunch

For decades, third party cookies have driven web tracking. Those small text files on your computer were used by website owners to login their users, by marketers to track contact activity, and by ad networks to build audience profiles for their customers. Not any more. Last year, Google announced a plan to kill tracking cookies in 2022. Last week, they outlined the technology that is going to replace them.

Third party cookies have long been controversial. Apple and Mozilla both ban third-party cookies in their browsers. Ad blockers target them too. That's because they're mostly used for cross-site web tracking. When pages set a cookie, they tell the browser what website it belongs to. Each site is supposed to only have access to their cookies, but in practice third party tracking scripts allow tracking cookies to be shared across the entire web. This behaviour enables Facebook to target ads based on visits to any page with a like button.

Now Google is phasing out third-party tracking cookies as part of a scheme called "Privacy Sandbox". Nor are they replacing them with the obvious alternative. Whenever people browse the web a huge amount of detail about your browser is sent to website owners. All this information is supposed to serve you the right version of the page, but is instead leveraged by ad networks to uniquely identify every device on the web. This practice is called Browser Fingerprinting, and is currently used to work around existing ad blockers, but Google are going to crack down on fingerprinting too. That's significant for consumers because there is no way to block sites from collecting browser fingerprints.

Offline Tracking

Instead, Google will shift the creation and storage of audience profiles into the browser. Chrome will use machine learning to build a picture of your interests based upon the pages you visit. That already happens today. However, this profile will no longer be stored on Google's servers. It will remain on your device, inaccessible to anyone else. The only thing sent back to HQ will be the number of users tagged with a particular interest. Even that's only collected so that Google Ads customers know which audiences are large enough to be viable for campaigns.

As a result, the decision about which ads to serve on which page will be made in the browser. That has to happen because the ad network doesn't have access to your audience profile. They have to ask the browser whether you're a member of a pre-defined interest group or audience segment. If the browser says yes, then the digital auction process used to match ads to ad space will be run on your device as you load the page.

Flocks and Cohorts

The technology powering all this is called Federated Learning of Cohorts (FLoC). This fancy name refers to the algorithm used to determine your interests based upon the sites you visit. It uses cohort analysis to aggregate your browsing history into a set of topics available for advertisers to personalise ads. Your combination of interests is given a Cohort ID which is, in theory, shared with thousands of other people worldwide. This Cohort ID is the only thing advertisers have access to. In order to be available for targeting, each cohort must have a minimum number of users.

The main problem with this proposal is that it hands control over audience segmentation to Google. If the browser is responsible for calculating your cohort and deciding your interests, then the worlds most popular browser gets to determine what segments are viable and which segments are too small. A related proposal called FLEDGE is currently being developed to solve this problem. FLEDGE will allow advertiser defined interest groups to be generated and stored by the browser. The most relevant use case for this is retargeting, as it enables new interest groups to be created in real-time for displaying specific ads based upon visits to particular URLs. More importantly, it ensures that the likes of Criteo, Magnite and NextRoll can develop and run their own ad networks independently of any browser maker. As a result, there is widespread industry backing for all the privacy sandbox technologies. FLoC and FLEDGE will be used by many ad networks, and not just by Google. That's an important consideration for a company undergoing anti-trust investigations in other areas of their business.

Conversion Tracking

The proposals don't just stop at the point of ad placement. They cover reporting and conversion tracking too. Ad networks use third-party cookies to measure conversions as well as to build audience profiles. They're the only way to link the original ad on the publisher's site with the conversion pixel on the ad buyer's checkout page. A new API has been developed to eliminate this problem. When an ad is clicked, a unique id identifying the ad will be stored in the browser. When a visitor reaches the goal page, the conversion pixel looks for this identifier and flags it as converted before sending it back to the ad server so the conversion can be logged in reporting. This unique ad id is further randomised so that it can't be used to detect the individual. This randomisation doesn't affect the accuracy of the click and conversion statistics presented to the advertiser, only the ability to build detailed audience profiles based on ad click data.

The downside of this new conversion tracking technology is that it locks advertisers into the reporting tools from their ad networks. Those reports will be the only way media buyers can measure the success of their campaigns, as third parties won't have access to the tracking or conversion data needed to compile reports. That's great for ad networks and media agencies, but will require adtech vendors to better integrate their reporting tools with the wider martech and BI tech stack. Many marketers struggle with end to end reporting because they can't link their media reports with their funnel reports to get a holistic picture of campaign performance.

Privacy by Design

For consumers, Google's proposals are a big win. For starters, it closes a major security loophole in the design of the web that has been used to hack websites and serve malware. Ad networks will no longer be able to identify individual users, but few advertisers were interested in doing so anyway. Advertising is a volume game. The individual only becomes important once they've converted, by which point you know who they are anyway. Now that reality is being baked into the foundations of adtech.

Advertising segments won't be quite as detailed as they once were, but increased accuracy for the remaining segments will compensate for this deficiency. That's a net positive because too much personalisation is bad for consumers and worse for advertisers. Whether the privacy sandbox will actually increase trust in personalised advertising is an open question. Many people are opposed to the very concept, but it will make a difference to some. Such variations could make a big difference to the bottom line of advertisers.