What you need to know:

• Google is taking new fire over Privacy Sandbox, its ever-delayed post-cookie alternative that takes ad auctions off the web and onto people’s browsers.
• The UK's Competition and Markets Authority has underlined that Google’s timetable doesn’t matter if it’s not happy. And it’s not.
• Neither is the IAB Tech Lab, publishing a forensic list of concerns and earning a sharp rebuke from a Google insider.
• Google last month culled 1 per cent of cookies within Chrome – an experiment spanning 30 million browsers.
• Few have run the numbers, but those that have, including New York-based ad network Raptive told Mi3 to expect a 30 per cent fall in ad prices, or CPMs. Adtech firms closest to Google’s mooted solution, such as Criteo, are baking in the similar assumptions – at least in the near term. Others, such as The Trade Desk, warn Google’s “primitive” solution is taking the industry backwards but are reluctantly coming to the testing table.
• Agencies – even those that spend a significant amount of money with Google – say they have only relatively recently received training on how things might work.
• Meanwhile, brands below the top end of the market appear underprepared.
• But whatever Google does, or does not do with cookies, Australia’s own privacy overhaul may soon overshadow the impact.

Privacy versus profit

The heat around the third party cookie cull rose last week after the UK's Competition and Markets Authority outlined a number of problems with Google's proposed alternative and reiterated that Google wouldn't be killing them off this year without its say so and "until our concerns are addressed". 

The CMA has some sizeable concerns: lower interoperability than cookies with other ad tech solutions that could lead advertisers to push more money into walled gardens... like Google; whether the proposed new tools actually reinforce Google's ad server/SSP dominance; whether purpose limitations are needed to stop Google getting an even bigger advantage by using its massive first party data on its owned and operated inventory; and how Google avoids self-preferencing in the future, should it get the green light to kill cookies and then be left to run much of the digital ad world's central nervous system in everyone's best interests.

However, the regulator also indicated that it felt Google was operating in good faith, had followed due process "and is engaging with us to resolve our remaining concerns ahead of third-party cookie deprecation.”

The CMA indicated that once a resolution is achieved, “Google will be able to remove third-party cookies without delay. Subject to our concerns being resolved, Google intends to deprecate third-party cookies in the second half of 2024”.

For now, Google has culled one per cent of cookies, will feed everything back into the CMA mid-year and then the regulator has said it will take up to 120 days to make a call on whether Google can then phase out cookies completely. That timetable in theory allows Google to meet its Q4 ambition to begin killing off the lot. Provided it can satisfy the CMA, which is being furiously courted by the rest of the digital ad industry. As soon as its report dropped, the IAB Tech Lab published its own report identifying myriad concerns in minute detail.

Across 106 pages, the report flags a range of issues underscoring the challenges media companies, advertisers, and the broader industry face in adapting to the changes mandated by Privacy Sandbox. For example a lack of transparency, the inability to third party audit, lack of standardisation (such as the MRC accreditation for measurement), not to mention the technical impact of shifting everything into the browser, transparency aside. Plus the risk of locking everybody in, reducing competition and taking a big bite out of revenues. Per IAB Tech Lab CEO Anthony Katsur, the patchwork that Google has proposed "cannot be assembled into a whole that provides a viable business foundation.”

Google immediately fired back.

Alex Cone, Privacy Sandbox product manager at Google, responded on X (formerly Twitter) to the IAB’s paper, writing, “IAB Tech Lab published a report on Privacy Sandbox today, and I wanted to share the team's POV: - We always welcome input from the industry, however, IAB Tech Lab’s report includes dozens of fundamental errors, inaccuracies and instances of incomplete information.”

He wrote that while Google is disappointed that IAB Tech Lab released the report in this state, it is nonetheless encouraged by the many IAB members who are actively building solutions using the Privacy Sandbox APIs.

“We look forward to partnering with the IAB Tech Lab in transitioning the industry toward more private solutions. And we'll be publishing an in-depth technical response next week, so stay tuned for more.”

The one per cent club

Six weeks after Google started deprecating cookies on Chrome there is almost no evidence about the impact. Cutting one per cent of cookies equates to a trial involving about 30 million Chrome users (here's how you can check if you're one of them). So it's not an insignificant sample. Yet Google’s Chrome blog is silent on the matter and none of the Australian agencies or brands contacted by Mi3 in the last fortnight has yet run any numbers.

One exception was New York-based ad network Raptive, an ad network which represents about 5,000 sites, with a heavy skew towards Youtube and Instagram creators. Its chief strategy officer, Paul Bannister, shared some very early figures on X on January 9, and he updated those for Mi3 Australia this week with data up to late January.

Given Raptive makes all of its money from programmatic ads, "how the cookie thing ends up is very important to us," Bannister drily observed. But he's been here before.

"When Safari got rid of third-party cookies about five years ago we saw CPMs for Safari users go from being at near parity with Chrome users to being 60 per cent worse.”

Having run the numbers after the first few weeks of deprecation, Bannister says the impact is significant – but not nearly as bad as with Safari.

“Chrome users without cookies are performing 30 per cent worse than from those users with cookies. To clarify, ‘performing worse' in this context means revenue per user on a web site,’ he says.

"That sounds bad but it's far better than Safari."

There’s direct implications for brand as well. “While we don't have advertiser data yet because it takes longer to collect, and we have less of it ourselves, we have often found a pretty good correlation between how much money we or a publisher makes and the performance of the advertisers' KPI,” added Bannister.

He clarified however that the impact is highly dependent on the advertiser strategy.

“For instance, if you’re selling cars and you find that contextually targeting car websites drives a certain return on ad spend – or whatever your KPI is – that will remain the same because contextual targeting is not affected by all these things. But if you are reliant on partnering with a third-party data company to find an audience that you want to target, the quality of that audience will degrade, and therefore your performance will degrade at the same time," said Bannister.

As to the ability of Google Privacy Sandbox to claw back the loss of revenue, there is some early encouraging data. Of the 30 percent that’s been lost, Sandbox looks like its helped claw back four to five per cent in the first few weeks.

That should get better he suggests, as some of the bigger demand side platforms start initiating their responses.

“We definitely think that there's going to be a big step change. As a good example, Yahoo is a big DSP. We know that in a few weeks, they're going to turn on some of the features that will work with Privacy Sandbox, and we think when that happens, that the number will pop up.”

Signalling signal loss

Beyond the kind of performance data that Bannister and his team track, there is another place to hunt for evidence of the impact of deprecation – the financial forecasts of the big ad tech vendors. With the latest round of financial results and outlook guidance, those signals are starting to blink.

For instance, Criteo CFO Sarah Glickman said the company expects to drop $US30 million to $40 million in revenue in the second half of 2024. It's likely to be an informed estimate, given Criteo has been one of the most active ad tech firms involved in testing out Google's new tech clothes. Unlike rival ad tech The Trade Desk, whose CEO Jeff Green last month reluctantly committed to testing the tools via a broadside lamenting what he describes as a "primitive ... downgrade for advertisers". Per Green: "Google has had thousands of engineers spend more than three years creating a product that takes the industry backwards ... This is it? Google invested billions to make the internet worse?".

Criteo's Glickman was more circumspect. While the CMA appears to be asserting its primacy by saying nothing happens unless it's happy, that was ever thus – and Criteo's baking that in to its plans. “Our outlook assumes third-party cookie deprecation on Chrome in the second half of the year," she last week told analysts.

“Our 2024 guidance assumes that Google starts phasing out third-party cookies in the latter half of Q3, resulting in an expected signal loss impact of approximately $30 million to $40 million in the second half of the year."

Her read on the impact in percentage terms is broadly in line with Raptive's Bannister. 

“This assumption is consistent with our previously communicated estimated impact to signal loss on Chrome with the remainder of the signal loss impact expected in 2025. As previously communicated, we would expect we would retain approximately 60 per cent of our retargeting contribution ex-TAC [excluding traffic acquisition costs] on Chrome post-third-party cookie deprecation.”

These days Criteo positioning itself much more as a retail and commerce media play, anticipating that part of its business to make up 75 per cent of revenues by next year. But during its retargeting era towards the end of last decade, it got smacked when Apple deprecated cookies on Safari – and some in the industry believe Criteo’s assumptions around revenue impact might be conservative.

Either way, the company has found a novel use for AI in a cookieless world: "using AI to make the right decision on what identity solution to choose" in real time, according to Chief Product Officer, Todd Parsons. Which is useful, given there are tonnes alt IDs vying for adoption. "It's very promising, and we're very excited about it."

Two-speed marketers

Marketers have had years to prepare for Google Chrome’s cookie deprecation – even to the extent of a copy and paste letter to their bosses via Mi3 back in 2020 – so of course many haven’t.  

But the top end of town appears more ready than brands with fewer resources and have invested significantly in first party data, new ID solutions, customer data platforms, decisioning engines and increasingly data clean rooms. They have the budgets that justify the investment, the incentive to gain both efficiencies and control of who they target or avoid targeting with ads, and are acutely aware of the incoming regulatory wave on privacy.

It’s the mid to upper tier where the progress is slowest and the pain is likely to be felt most according to industry execs Mi3 spoke with. The reason given are myriad, but it mostly comes down to a lack of prioritisation, and a degree of scepticism about Google’s timelines given the constantly moving goalposts.

But agencies are often in the same boat – even those that spend vast amounts of client money with Google and are among the first names on its 'Premier Partners' list.

Opacity

According to Hadrien Huneau, national head of performance and programmatic at Atomic 212, “Google didn't provide a clear roadmap or solutions for an extended period of time. They had to push back the date, because they were not ready. They couldn't find a replacement solution that could help both in terms of privacy on one side and business decision on the other side."

He said the first training his agency received was in Q3 last year. 

“Most advertisers are not extremely savvy and their digital maturity is not that high. No one had any clue about what to do really, so I'm not surprised that to see that the industry is behind.”

He believes that despite the very long run up to Google's big cull, “In most people's heads, a third-party cookie is not an issue yet. It's something in the future. But 40 per cent of the web has no third-party cookies. So the depreciation of third-party cookies is not something in the future, it has already happened." 

Identity imperatives

Roland Irwin, head of sales at identity provider AdFixus, reckons the cookieless web is even higher than that.

"For the clients that we're seeing, 50 per cent of the traffic is not coming from Chrome. No matter what Google pushes out at best it only solves 50 per cent of the problem."

He said that means brands are already measuring the wrong things and making the wrong decisions.

“When we work with customers we are proving out that if you care about a returning user, you're literally using metrics that are incorrect when you're looking at new versus returning users.” 

Reading both the targeting, measurement and privacy runes, larger brands and publishers have already been investing in cookie alternatives.

Carsales for instance has largely rebuilt visibility over its Safari audience through a tech infrastructure that utilises the first party IDs and an Adobe CDP to orchestrate data.

Stephen Kyefulumya, general manager, media - product and technology, believes the publisher is well placed after several years of building out a robust and sophisticated platform to future-proof itself in a more privacy compliant world as, when or if, Google culls cookies.

"But we would say that with humbleness, because who knows right? What we do know is that right now we've got the components in place based on what we have assessed. We understand what deprecation looks like, we know what it was like in Safari, we know that the identity solution works, and we know that the CDP has good identity resolution. We also know that we've got features in there that enable us to manage preference," he said.

"But we are by no means the finished article. We're not sitting here saying we have all the answers. What we're saying is, as things evolve, the privacy legislation is very complicated to review at the moment. Who knows what curveballs will come out of it?"

Chris Brinkworth, managing partner at Civic Data said the publishers and brands he works with are hedging their bets both on deprecation and local privacy law overhauls across four key areas: Investing in first party data, exploring contextual advertising, utilising privacy friendly identifiers and moving towards towards secure environments for data sharing and analysis - like data clean rooms - to ensure user privacy is not compromised.

Above all, he said, consent is king, whatever Google does, or doesn't do.

"It's crucial in our view for all strategies to be underpinned by consent and being very clear about what you are collecting and using data for, regardless of what it says on the tin."