The Impact of Third-Party Cookie Removal

In summary:

Chrome

• Removal of third-party cookies originally planned by the end of 2022, now the transition period is scheduled for Q4 2022 into 2023 
• Minimal other restrictions by default

Safari (already in effect)

• Blocks third-party cookies by default
• Other restrictions included ITP for trackers and first-party cookie use

Firefox (already in effect)

• Blocks third-party cookies by default
• Additional restrictions included through “Enhanced tracking protection” to block additional trackers

The following website is very helpful in keeping up to date with the state of current browser blocking and the implications: https://www.cookiestatus.com/

Third-party cookies

Current uses for third-party cookies are largely:

• Remarketing lists and other personalisation techniques
• Measuring marketing effectiveness (view-through conversion tracking)
• Building audiences
• Cross-domain tracking (in some instances)
• Some onsite tools/functionality e.g. live chat, login functionality etc.

The cross-domain tracking aspect allows large companies to build up a comprehensive view of browsing behaviour on a user level, which is one of the key drivers of the change to third-party cookies.

What about first-party cookies?

First-party cookie solutions (such as Google Analytics for website tracking) will continue to function as normal for Chrome.

Some advertising platforms (e.g. Google Ads, Facebook ads, etc.) have options that use a first-party cookie tracking setup that will also be unaffected by the changes to third-party cookies. However, they are still affected by any restrictions applied to first-party cookies (common on many non-Chrome browsers, through blocking plugins, or the use of cookie banners to comply with legal rules, that prevent cookies from being set).

This article is focused on the changes to third-party cookies, however, it is worth keeping in mind that many browsers have also implemented restrictions on first-party cookies (as you can see on the cookiestatus.com website).

What is the impact on advertising services?

Below is a summary of some key likely impacts marketing services (across providers from PPC, Social, Display, Affiliates etc.):

• Remarketing will no longer be possible in its current guise
• Many of the techniques for personalising adverts will not be possible and must be adapted
• Audience list creation and targeting methodology will change
• Conversion tracking for clicks will likely continue as normal if the provider allows first-party data collection or is using a first-party analytical tool (e.g. GA)
• Conversion tracking for “view- through” conversions will no longer be possible (when a user has seen an advert, not clicked immediately, but later completed a desired action on the client’s website)

Alternatives to third-party cookies

Many tech companies are actively developing solutions in this space, to fill the gap left by the removal of third-party cookies:

• Google is updating the way they provide some of these services to remove the need for third-party cookies, moving towards on-device processing of such data with the release of Privacy sandbox and FLoC. These solutions aim to provide advertisers with similar levels of audience building and tracking, yet in an anonymous fashion
• TTD is working with various partners to develop a Unified ID 2.0 solution
• A variety of publishers have banded together to pitch another alternative to Floc - SWAN

Due to the size of companies like Google, Facebook, and Apple and the data they hold, it will be more difficult for rivals to produce something that is universally available with comparable reach.

Google and Apple have both said they do not like the idea of using a hashed email address or similar methods to replace user-level tracking (Apple have said it is not an acceptable replacement IDFA).

The EFF claim FLoC in its current setup could be abused, and used to better fingerprint users, potentially making the problem worse.

What about other tech and legal challenges?

The loss of third-party cookies in Chrome isn't the only change that is affecting the tracking landscape. Browser and OS providers have also improved their focus on privacy, making changes and adding features, while legal changes have also had a large impact.

iOS 14

• Apple is making changes in iOS14 that affect what can be measured by advertisers through various platforms

Browser privacy changes

• A variety of browsers are focusing on improving user privacy, including tracking prevention as standard (including some opposition to the new developments like FLOC, with DuckDuckGo, Firefox, and even Edge which is a Chromium based browser)
• Some browsers are limiting tracking including some first-party methodologies of data collection (cookiestatus.com for more details)

Cookie acceptance/banners

• Opt-in banners can reduce data collection significantly, but modelling techniques and tracking vendor features (e.g. Google Consent Mode) can help alleviate the issues with this. Visitors who opt-in are more likely to have a positive opinion of the brand, therefore it is not as simple to scale this group to estimate the whole population (likely to overestimate performance)

The rise of first-party data

The current changes will reduce the level of detail and availability of third-party data, leaving marketers with less information than previously available. As above, some solutions will seek to replace some of this functionality in a privacy-safe way, making good use of the data already available to marketers more important in 2021, and beyond.

Both advertisers and publishers will need to capitalise on their first-party data wherever possible. Advertisers will want to know as much about their customer base as possible, getting permission to gather, and take advantage of this data to personalise users’ experiences. 

Similarly, publishers will want to capitalise on their audience data, so they can offer targeted and tailored adverts to their audience and advertisers alike, improving the experience for all. 

Data clean rooms 

Google, Facebook etc. have a lot of data but keep it to themselves in a “Walled Garden”. Data clean rooms have been developed to match a client’s own first-party customer data with data from these walled gardens in a secure and privacy-safe way.  

A good first party data set is vital to capitalise on the use of data clean rooms. See: 

• https://www.infosum.com/solutions/data-clean-room 
• https://digiday.com/marketing/data-clean-room/ 

Server-side tracking

Server-side tracking will likely bypass some of the browser-based restrictions (a server needs a base level of detail to be able to provide website functionality) but is limited to tracking activity on a client’s site.

Google Tag Manager has released a server-side tracking module that could be used to bypass some of the tech changes, which may become more prevalent in future.  

But from a legal point of view, GDPRs suggest that any ID passed to a backend system still requires permission (not just a cookie), so the cookie banner or equivalent would likely be required to do this, server-side tracking should not be used as a way to avoid adhering to the law. 

Challenges by channel/team

The various advertising teams/channels will be affected differently by the upcoming changes to third-party cookies. Below are some speculated challenges by the team: 

Paid Search 

• Core keyword bidding is unlikely to be heavily impacted by third-party cookie changes 
• Some services will be adapted, using new technologies for audience building, remarketing etc. – marketing teams will have to learn how to use these new services 
• Gaps in onsite data from cookie acceptance will become more prevalent, likely to need some modelling skill to fill the gap

Display 

• Adapt and use any new solutions as they are developed  
• View-through conversion tracking stats will no longer be available as they are currently 
• Potentially return to regional uplift testing to judge campaigns’ impact 
• Adapt to using new technologies (such as the one Google are developing) for audience building, remarketing etc – marketing teams will have to pick up how to use these new services 
• Potentially use of third-party clean rooms
• Reduced targeting capability from audiences and many third parties (likely to be replaced by alternatives) 
• Gaps in onsite data from cookie acceptance

Social 

• Adapt and use the solutions developed by the social platforms themselves 
• Rely on strong first-party data to help with audience definition 
• Potentially partner with or use of third-party clean rooms 
• Reduced targeting capability from audiences and many third parties (likely to be replaced by alternatives) 
• Gaps in onsite data from cookie acceptance 

Affiliates 

• A lot of modern affiliates use first-party cookies 
• Potential for alternative methodologies such as server to server integration or other strong first-party methodologies 
• Potentially partner with, or use third-party clean rooms 

Organic 

• Largely use first-party analytics solutions, which are unlikely to be impacted significantly; keyword-level data was restricted a long time ago 
• Gaps in data from cookie acceptance 

Analysis/Analytics/Tracking teams 

• Increased levels of support with implementing Cookie Banners, and ensuring that on-site tracking respects user choices 
• Support modelling solutions for gaps in onsite data from cookie acceptance 
• Server-side solution support 
• Support client and internal teams with data collection, modelling methodologies, using new features as they are released  

Attribution 

• Gaps in onsite data from cookie acceptance 
• Tracking the impact of view through conversions becomes more difficult requiring testing and modelling in place of individual user tracked behaviour 
• Lift testing is more difficult from some platforms – at least in the current guise 

CRO/UX 

• Potentially some issues with tools depending on their use of third-party cookies - likely to be relatively easy to resolve 
• Potential gaps in data from onsite data from cookie acceptance depend on classification

UK Diverging from current GDPR implementation?

The UK appears to have plans to shake up its interpretation/implementation of GDPR, in particular, the current implementation of “cookie banners”, as discussed in The Telegraph interview with Oliver Dowden.

It will be interesting how much the implementation will change, as the UK will presumably want to remain a data-sharing partner with the rest of the EU, which may prevent the complete removal of certain aspects. 

John Edwards was the UK’s preferred candidate, previously New Zealand’s Privacy Commissioner (whose data protection laws are deemed adequate by the EU), and has now been confirmed as the UK's new Information Commissioner.

The following articles also discuss a similar topic: 

• https://www.theguardian.com/technology/2021/aug/26/uk-to-overhaul-privacy-rules-in-post-brexit-departure-from-gdpr 
• https://www.bbc.co.uk/news/technology-58340333 

It will be very interesting to see what impact the new commissioner has in any short-term changes in this space. 

Reference Links

• https://www.searchenginejournal.com/duckduckgo-announces-plans-to-block-googles-floc/401993/ 
• https://www.techradar.com/uk/news/microsoft-edge-becomes-latest-browser-to-disable-googles-floc