When Google announced it would phase out third party cookies within Chrome, there was a significant caveat: they would not cull cookies without a replacement in place. Google has proposed the Privacy Sandbox as a browser-based replacement – but that remains a proposal, not yet implemented in Chrome, and unlikely to be established as the new web standard that Google hoped it would become. That means that if Chrome implements this replacement, we cannot expect Firefox, Edge, Safari or any other browser manufacturers to follow.

Beyond the browser, in open programmatic media ecosystems, there are several proprietary cookieless identity products that use fingerprinting or people-based identities, and there is an open industry solution in Unified ID 2.0.

None of these solutions are dominant, and with so many alternatives and so many unknowns, the required actions for marketers to future-proof their identity-based ad targeting, tracking and measurement efforts remains unclear.

Every other month a survey tells us that marketers are unprepared for the end of third-party cookies. But the future of third-party cookies is still unclear. It seems unfair to chastise marketers for being unprepared for an unclear future. With what we know now, what should marketers do? 

Will we see a new browser standard? Responses to Google’s Privacy Sandbox

The Privacy Sandbox is a set of browser features that Google suggested will enable ad measurement and targeting, while protecting the privacy of the end-user. It was proposed as a new web standard, to be adopted by all browsers. While maintaining privacy for users, the Privacy Sandbox would also help to maintain the viability of the online ad industry, and the many publishers the industry funds.

In early 2020, the Privacy Sandbox proposal was actively discussed within the Improving Web Advertising Business Group of the World Wide Web Consortium (W3C). The W3C is the body responsible for developing open web standards. This active discussion has not resulted in new standards and the digital advertising industry has not embraced the proposal.

At the same time, the Privacy Sandbox was also discussed in the Privacy Community Group of the W3C, a group chaired by members from the other major browser manufacturers – Microsoft, Apple and Mozilla. These community groups are more likely to develop proposals that move into the web standards track than the business groups. When we look at the goals of Google’s proposal and the mission and membership of the privacy community group, success of the proposal as a new standard was always unlikely.

Google’s proposal shifts the workload for ad tracking and targeting onto the browser. The approach is like asking you to keep a record of all the ads you’ve seen and clicked on, and then making sure to tell the company about what ads you’ve seen when you buy something from them.

With their user focus, the groups behind Firefox, Safari or Edge – the chairs of the W3C privacy community group – would be unlikely to support the proposal, but rather to view it as serving the interests of Google and the digital ad industry.

Without the support of the W3C, Chrome could implement the change alone. But this seems unlikely at present, as the antitrust case filed against Google in Texas has called out the Privacy Sandbox as an extension of Google’s anti-competitive dominance of the online advertising industry.

Without a warm reception from web standards bodies, the digital advertising industry, and the direct challenge of the antitrust case, the Privacy Sandbox is at long odds to be established as a new browser standard. It begs the question – will Google continue to hold that they will not disable third-party cookies without a replacement? If they do, an extension of Cookiepurgatory beyond 2023 seems a likely outcome.

Fingerprinting versus people-based Identities

The other proposed replacements to third-party cookies fall into two buckets – fingerprinting and people-based identity.

Fingerprinting involves producing a device identifier from factors that make a device unique. These include factors such as device hardware, operating system, installed fonts and browsing history. Fingerprinting technology can ensure that identity is maintained for a device, without necessarily requiring permission from the user. Browser manufacturers are already actively working against fingerprinting, and the EU has already ruled that a fingerprint constitutes personal information, and requires adequate consent. As privacy regulation is strengthened, fingerprinting will not be a direct replacement for the anonymous, consent-free third-party cookies that are still in use in Australia and many other countries today.

People-based identities replace anonymous cookies with an identifier such as an email address or phone number, which is hashed so that neither side can see the underlying data, but they can identify that it is the same user. They can then perform a match for targeting or measurement, without exposing the underlying personal information.

Targeting and measurement through people-based identity is dependent on the publisher and the advertiser both knowing who someone is. They can then target through identities with no dependency on third-party cookies. If they know who goes on to buy, they can measure sales outcomes through the same approach. There are numerous identity providers who use some form of this approach. UID 2.0 is based on a hashed email, as are solutions touted by commercial providers such as LiveRamp, LiveIntent and ID5.

A people-based approach will be much narrower in scope than third-party cookies have been, for two reasons. Firstly, it requires a user to be logged in with the same email address on both platforms to create the match. This is a hard constraint.

The second limitation depends on how the hashed email is treated by the regulators. If it is treated as personally identifiable information, consent will be required to use it – this is proposed in the discussion paper for Australia’s Privacy Act review. This treatment would be similar to how the EU treats fingerprints, meaning that it would not be a direct replacement for anonymous, consent-free third-party cookies. If this is the case, we can expect low rates of consent, in line with Facebook’s loss of targeted-advertising consent with the introduction of iOS 14.5’s App Tracking Transparency.

It seems that there will not be a replacement that will enable advertisers to freely target users based on behaviour across the web as they have done with third-party cookies. However, for those advertisers and publishers with high numbers of logged-in users and either favourable regulation, or adequate consent, a reduced form of targeted digital advertising and measurement will be able to continue.

Winners and losers

As the utility of third-party cookies in browsers other than Chrome continues to degrade, sites with a high proportion of logged-in users can continue to offer targeted advertising and facilitate measurement, while those who don’t, cannot.

Brands and publishers that regularly see their customers logged-in to their digital assets will find themselves in a far better position than those with anonymous visitors. They will be able to connect online and offline behaviour and transaction data, and activate it in a publisher world where an increasing proportion of users are logged in. To varying degrees, this is true of banks, telcos, retailers, utility companies, video platforms, social media sites and other products that are facilitated through an online account. It will benefit large publishers, for which consumers are more likely to bother setting up an account and logging in, and some niche publishers with strong engagement.

For those without a logged-in population, ad targeting, personalisation and measurement will be limited. The ability to target based on third-party data, and to tie impressions to digital conversion results, will generally be restricted to such a small subset of overlapping users that in some cases it may not be useful at all.

From this understanding, it is an easily drawn conclusion that with an incredible logged-in population, visiting their sites daily, the dominance of Google and Meta in digital advertising will increase. But with both subject to ongoing antitrust cases in the US alleging abuse of their dominance in their respective markets, a marked increase in dominance is, at this point, a liability.

More significantly, and more positively, we can expect the change to favour better quality media. Those niche publishers that can’t target through identity may see a higher value placed on their contextual ad placements and unique audience. This will benefit publishers with high value audiences, and high attention ad placements. Having lost cookie-based measurement of exposure through to sales outcomes, advertisers will need to differentiate between publishers and advertising sources by assessing the quality of their inventory. Karen Nelson-Field from Amplified Intelligence’s work has demonstrated the clear link between media attention and sales outcomes. We can expect measurement of this nature to be increasingly important, alongside a creative rebalancing that comes with a focus on brands connecting to people and getting their attention rather than delivering impressions on devices.

What should marketers do?

Even if you are convinced that Google’s 2023 date is ambitious, that is only a reason to reduce the panic – not ignore the issue altogether. It is, after all, only Chrome that retains full third-party cookie support by default. Our ability to use them is already significantly diminished.

You can treat the lifetime of third-party cookies as a general unknown. While it continues to work for you, you can keep at it. It could be around for months. But it could also be years. So while it may not make sense to pursue major new investments in tech dependent on third-party cookies, if it’s working for you, it still makes sense to maintain or even grow what you’re doing while you still can.

We know the cookies are going, browser support is already diminished, and you should start planning for the future. So if you are in a position to shift to a focus on people-based marketing, do it. And do it now. There is no need to wait for an announcement. The response to the third-party cookie problem that you already have for Safari and Firefox, is the same shift to people-based marketing that you’d make if Chrome pulled the pin tomorrow. If you’ve got direct customer relationships at scale, you’ve got the first-party data needed to make the change – don’t delay it.

But that’s not the only action. The world of people-based marketing will be smaller than the world of third-party cookies. Better understanding of the media you are buying is even more important. It will be crucial regardless of the scale of an advertiser’s first-party data. Better understanding of media is important both in terms of planning for contextual targeting and understanding media quality through measuring and buying for attention. Connecting that better media understanding to better creative. Delivering ideas that work for the media, ideas that cut through and get people’s attention. Again, there is no reason to delay getting better at understanding media and using that to connect to people again, with better creative.