The queen sacrifice: Is Google bringing us closer to the demise of third-party cookies?
Opinion
In the chess match that will decide the fate of third-party cookies, Google has pulled a Bobby Fischer. What does this mean for the industry?
On 17 October 1956, 13-year-old Bobby Fischer and chess grandmaster Donald Byrne played a match that became known as the Game of the Century.
After an opening where Byrne played aggressively and Fischer was on the back foot, Fischer decided to sacrifice his queen. Byrne took the queen but ended up so poorly positioned that, in the next few exchanges, he lost a rook, two bishops and a pawn. Fischer famously won the Game of the Century by checkmate.
In the chess match that will decide the fate of third-party cookies on Chrome, Google was squarely on the back foot. Having committed to the UK Competition & Markets Authority (CMA) that third-party cookies would not be deprecated until the Privacy Sandbox had been tested and widely adopted by the industry, Google had de facto given veto power to its competitors.
And even with CMA approval, replacing third-party cookies with the Privacy Sandbox would have made Google vulnerable to legal challenges.
That’s why Google pulled a Fischer: it sacrificed its prerogative to deprecate third-party cookies and instead proposed to “introduce a new experience in Chrome that lets people make an informed choice [on whether or not to enable/disable third-party cookies] that applies across their web browsing”.
By framing the issue as user choice, Google is simultaneously removing adtech’s veto power, decoupling the fate of cookies from that of the Privacy Sandbox and reducing its legal exposure.
It is sacrificing the queen to win the match.
Google cookie U-turn: Industry is ready to move on, leaders say
What does this mean for the industry?
At the time of writing, the CMA has not yet accepted Google’s proposal and will be seeking input from stakeholders by 12 August.
But it is reasonable to expect the proposal to go through: since users already have the ability to block third-party cookies on Chrome, Google would just make this choice easier, improving transparency and control.
The outcome of this “new experience” will likely be a sharp drop in the number of third-party cookies allowed on Chrome. It may not be a total ban, but it will likely be significant. How significant will depend on the consent mechanism used and the wording.
If Google uses a prompt similar to Apple’s App Tracking Transparency, consent rates might drop as much as 90%.
Expect the debate to shift from application programming interfaces, cost per mille and latency to language, prompts and coloured buttons — all issues on which the Information Commissioner’s Office (ICO) has a much stronger grasp and long-held views.
So what will this “informed choice” look like? Some elements are already clear.
>> Scale: Google has made clear that it wants user choice to apply across its web browsing, meaning browser-level controls. In principle, however, that wouldn’t “kill the consent management platform”, as some people claimed, because site-level controls are still needed.
So we are likely to see a browser-level choice to allow or block third-party cookies, complementing — but not replacing — the site-level choice to allow or block first-party data collection.
>> Scope: Although Google’s latest blogpost talked about third-party cookies, the Privacy Sandbox has always talked about “cross-site tracking”. That definition includes third-party cookies and other types of identifiers.
In the same post, Google also revealed that it is introducing IP address protection into Chrome’s Incognito mode — something that I read as a clear message: we’re going after all IDs, so when the user opts out of cookies, expect other signals to disappear too.
>> Options: I can also see regulators rooting for a simple binary choice, “accept/reject third-party cookies”, but I’m not sure this would work for Google’s Privacy Sandbox. So perhaps the user will have to choose among three options (see more below).
>> Consent: Google’s informed choice will likely follow the ICO’s guidance on consent, with general principles such as: a positive opt-in with no default consent; clear, specific and concise statements; and the ability to easily change the decision.
>> Language: I think Google’s language will be less aggressive than Apple’s and it will eventually refrain from using the word “tracking” for two reasons.
First, competition authorities will make sure the same wording used to get consent for third-party cookies is also used for cross-context data collection on Google products.
Secondly, if Google wants to nudge users to opt out of third-party cookies while accepting the Privacy Sandbox, it cannot frame the choice as enabling/disabling cross-site tracking, since the Privacy Sandbox is also a form of cross-site tracking — just a more benign one.
Lawyers will get creative, but we’ll probably end up somewhere closer to the consent prompt Google uses for its own products.
What about the Privacy Sandbox?
In my opinion, the most difficult problem for Google is how to enable the Privacy Sandbox.
The user choice framework will require a positive action (opt-in) for all options: third-party cookies, Privacy Sandbox and no cross-site tracking at all. Giving users three options and explaining the difference between them in simple, clear and concise terms is not going to be trivial.
Google is probably going to explain that the Privacy Sandbox “enables personalisation in a privacy-preserving way”, but the wording will be challenged and, anyway, I’m not sure how many people will end up accepting the Privacy Sandbox instead of just rejecting everything. If not enough users opt in, then the Privacy Sandbox will be even more useless.
It’s also unlikely that the Privacy Sandbox will be enabled when people accept third-party cookies because the user choice has to be clear, unambiguous and specific. And, crucially, enabling third-party cookies and Privacy Sandbox on a browser leaks data, since vendors would be able to attribute topics to a third-party cookie, building a richer user profile.
Let’s assume Google comes up with neutral wording with three equally unattractive options. Each option would get 33% of choices, making both third-party cookies and the Privacy Sandbox largely ineffective and unattractive.
That’s where first-party data, contextual solutions and other privacy-enhancing technologies would come into their own to help build a more sustainable, user-friendly internet economy.
What should we expect next?
After sacrificing the queen, Fischer forced a checkmate in a relatively short time. It’s highly likely that Google’s move will bring the advertising chess game to an end sooner than it would have otherwise happened.
While Google will not be off the regulatory hook for a long time (some commitments will continue to apply even if third-party cookies are no longer deprecated), agreeing a suitable form of words for the user choice mechanism with the CMA and ICO seems a decisively less daunting task than fixing the Privacy Sandbox.
Google’s proposal is likely to move forward at considerable speed. Once the CMA approves the proposal and the US Department of Justice hands out its verdict after the summer, nothing can stop Google from rolling out its user choice mechanism in early 2025.
Reading between the lines, Google has already suggested as much when it stated that it will engage with the industry “as we roll out” the user choice prompt.
Today, the industry is closer than ever to ridding itself of third-party cookies and finding a new equilibrium. Bring it on, Google, and let’s reset the board for another game.
Mattia Fosci is CEO at Anonymised