What you need to know

• Google has delayed the timing for finalising third-party cookie deprecation for the third time with the new "deadline" drifting into next year.
• But with the UK's Competition and Markets Authority now bringing the country's Information Commissioner's Office into its deliberations, regulatory scope-creep threatens more roadblocks down the track.
• Critics question Google's motives and even its competence.
• Locally, ADMA says brands need to act now, rather than waiting for resolution, while industry leaders suggest the world has already moved on considerably due to earlier deprecation by Safari and Mozilla.

Google first said it would deprecate third-party cookies in 2021, one year after Apple and Mozilla had already pulled the pin on third-party cookies in their browsers. 

In 2021, Google announced it was delaying cookie deprecation until 2023.

In 2022, Google announced it was delaying cookie deprecation until 2024.

Then last week, Google announced it was delaying cookie deprecation until 2025.

In a happy coincidence for the digital giant's P&L, Google’s Network Business has subsequently fallen every quarter since the 2022 announcement even as its higher-margin, owned and operated properties hoovered up a bigger share of the total mix. It's a point not lost on Jason Kint, the CEO of Digital Content Next DCN, which advocates for privacy and greater competition in digital advertising markets.

“They've [Google] been systematically shifting ad revenue mix to owned and operator properties for two decades but now they're straight up taking it,” Kint wrote on X (formerly Twitter) recently.

On this latest delay, Kint didn’t mince words, “A monopolist that collects a majority of its data thru surveillance while people use third-party services comes under pressure by global privacy laws yet finds a way to delay for five years improvements risking its biz based on “industry” and “regulatory" pushback.”

For critics like Kint, Google’s timetable looks increasingly less like a deadline and more like a benchmark for opportunity.

For its part, Google’s explanation this time concerned the work being done by the UK’s Competition and Markets Authority (CMA), which is likely to be used by other regulators around the world for guidance. According to a Google blog accompanying the announcement of this third delay, “We recognise that there are ongoing challenges related to reconciling divergent feedback from the industry, regulators, and developers, and will continue to engage closely with the entire ecosystem.”

It also noted the CMA, which is more focused on competition issues than privacy, will require “sufficient time to review all evidence including results from industry tests, which the CMA has asked market participants to provide by the end of June”.

But after three delays in three years, it's not an excuse that washes with critics. According to Alan Chapell, President of Chapell and Associates which acts as an outside counsel and chief privacy officer for over 100 technology companies, "On a product level, Google has failed to deliver what they've promised. Full stop."

On LinkedIn he wrote, "Maybe it's me, but it strikes me that many in our industry - perhaps even the Google folks - are thinking about Privacy Sandbox tools in a way that is a bit backwards. You certainly wouldn't confuse me for a product guy, but here's my understanding of how things are supposed to work; Build a product, make sure it works in alpha, test, scale to beta, test, determine a release schedule."

He said Google seems to have jumped from step one straight to step six. "They've got a whole ad stack that could have been testing all these tools and getting them closer to being workable."

Chapel further noted, "Google has some of the smartest and most talented people working for them. If the goal here were to really build a working platform that makes the world better and provides value to the ecosystem, the sandbox team would not have skipped steps.They've tried to make this about adtechs not being interested in privacy. And they've drastically understated the costs and overstated the effectiveness of their tools."

Fool me thrice (thanks, I need more time)

While its critics might be howling, many Australian marketers and media companies likely absorbed the news with something approaching relief.

As we reported earlier this year, marketers have had years to prepare for Google Chrome’s cookie deprecation – even to the extent of a copy and paste letter to their bosses via Mi3 back in 2020 – and yet many haven’t.  

While the top end of town has spent the last few years investing in first-party data architectures to wean off a reliance on third-party cookies, it’s the mid to upper tier where the progress is slowest and the pain is likely to be felt the most. 

There is even a hint of relief reflected in the response of industry association ADMA, which is a leading advocate for brands in the ongoing regulatory debate about privacy and digital advertising. According to Sarla Fernando, ADMA’s Director of Regulatory and Advocacy, "ADMA welcomes the responsible approach from Google in delaying the deprecation of third-party cookies in recognition of ongoing challenges, which have been highlighted in the divergent feedback from the industry, as well as regulators and developers.”

Fernando, however, is not exactly cutting the brands much slack. “While this announcement confirms that third-party cookie deprecation by Google will no longer be completed in 2024, ADMA reminds businesses that the reliance on third-party cookies is already changing, and alternative options are already available to test and adopt.”

She said businesses should not take Google's announcement as an excuse to further delay preparing for the changes that will eventually come.  

“The marketing landscape has been undergoing significant changes and these will only accelerate with the upcoming Privacy Act reforms. The changes will have a dramatic impact on the marketing landscape for almost every brand and every size of business. We don’t need to know the exact dates of cookie deprecation or privacy reform legislation to start preparing your business for this change.”

Fernando said it was important not to wait until the changes finally happened. This is true, she said, both for how businesses use first and third-party cookies, and for the need to build first-party data strategies that help support good and trustworthy customer experiences. 

“New frameworks are coming in, regardless of whether they are motivated by platform changes or regulatory reform, so it is vital all businesses are alert to their responsibilities [and opportunities] in this environment,” she said. 

False sense of security

Meanwhile, Chris Brinkworth, managing partner, of Civic Data, told Mi3’s Fast News last week: "What's concerning about these delays, are they continue to give unprepared marketing leaders a false sense of security, by overlooking the fact that their marketing, media, and measurement investments already have poor efficacy in over 30 per cent of the 'aggregated' browser ecosystem, excluding Chrome."

Worse still, he noted, "If 90 per cent of their addressable market resides within that post-deprecation ecosystem that already exists, the pushbacks by Chrome will further disadvantage those not yet educated about the rest of the market."

It is a sentiment echoed by James McDonald, co-founder and director of independent advertising services agency Audience Group who told Mi3 Google’s latest delay is irrelevant to anyone who is thinking beyond traditional digital performance media strategies. 

“Cookies have been deprecated in non-Chrome browsers for a long time. Anyone who isn’t prepared with a first-party data strategy and a non-pixel measurement strategy, should not delay. A non-cookie targeting approach using your first-party data will be at least as good as a cookie-based approach and it sets you up for post post-cookie world while also allowing you to better target iOS devices and non-Chrome browsers."

Don’t expect the fog to clear on the issue, or to assume the latest Google guidance on timing is set in stone. If anything, the regulatory outlook is even more unclear after the release of the CMA’s latest report last week which leans heavily on a preliminary assessment of the UK’s Information Commissioner’s Office (ICO) on the privacy and data protection impacts of Privacy Sandbox.

That led James Rosewell, co-founder of the Movement for an Open Web, to say the ICO’s involvement, a new development, broadens the scope of the investigation and raises numerous additional issues for Google.

“The involvement of the ICO in this report for the first time is hugely significant and shows that the regulators are jointly turning up the heat on Google. It represents a step change in taking a serious position and careful review of Google’s proposals. The fact that this additional scrutiny has already led to the latest delays is evidence of Google’s inability to resolve these concerns quickly," he commented.

According to Roswell, regulators are showing real concern about some significant areas - "from latency and the role of cloud providers through to governance and privacy". "These are fundamental issues that are not going to be addressed overnight. The fact that the issues list is growing as the technology gets closer is a sign that Google has tied itself up in knots that it simply can’t unwind," he continued.

Roswell was particularly scathing of the impact of Google’s approach to governance.

“We’re talking about a project that will disrupt the $1trn+ digital advertising industry and – perhaps eight months before it goes live – we are still completely in the dark about how it’s going to be run. This is amateur hour and clearly not the way that a project of this sort should be brought to market.”