Third-party cookies are one among many tracking technologies that you can employ on websites for the benefit of running analytics solutions, marketing platforms and social media integrations in addition to online advertising.<\/p>\n\n\n\n
Why are third-party cookies under scrutiny?<\/h3>\n\n\n\n
Third-party cookies not only serve the website they\u2019re placed on, they also serve their providers, and the adtech industry at large revolves around mass data harvesting, profiling, and real-time bidding.<\/p>\n\n\n\n
In return for optimization services on your website, a lot of third-party cookies will amass enormous amounts of personal data from your end users \u2014 without their consent or often even their knowledge \u2014 that is sent, traded and sold in the digital advertising industries.<\/p>\n\n\n\n
The types of personal data that third-party cookies harvest range from individual IP addresses, sensitive search and browser history, specific details about devices, to private information about health, sexuality, family, political convictions, religious beliefs and much more.<\/p>\n\n\n\n
The problem with third-party cookies is not only the amount of personal data they collect, or the sensitive nature of that data. All of the data that third-party cookies collect can be put together to create extensive profiles on users consisting of thousands upon thousands of data points, such as your Google searches in the last five years, your credit card transactions, your profile on dating apps, and so on.<\/p>\n\n\n\n
Inferences are made about the user's personality and life from these profiles, which can be sold to advertisers, who in turn will target their ads on a micro, individual level.<\/p>\n\n\n\n
Third-party cookies supply this raw, privacy-infringing data to a nearly trillion-US-dollar adtech industry that relies on these inferences to predict the behavior of users, which advertisers pay for every day in real-time bidding auctions that make up the mechanics of how personalized ads are shown to users on your website<\/a>.<\/p>\n\n\n\n In January 2020, Google announced that Chrome would phase out support for third-party cookies<\/a> in the browser, starting with trials on conversion measurement and personalization by the end of 2020.<\/p>\n\n\n\n Google's decision to remove Chrome's third-party cookie support is part of a larger Privacy Sandbox launched in August 2019<\/a>, a series of initiatives \u201cto develop a set of open standards to fundamentally enhance privacy on the web.\u201d<\/p>\n\n\n\n Google's Privacy Sandbox initiatives focus on:<\/p>\n\n\n\n On June 24, 2021, after considerable industry pushback<\/a> and a debate<\/a> about what would replace them, Google announced a two-year delay for the third-party cookie phase out to the end of 2024<\/a>. While Google did begin phasing out third-party cookies in Chrome in early 2024, they also delayed the planned full deprecation once again.<\/p>\n\n\n\n Google is not the first to make the shift away from third-party cookies. Mozilla\u2019s Firefox, Brave Software\u2019s Brave, and Apple\u2019s Safari browsers have been blocking third-party cookies for years, while major publishers and media houses like the New York Times<\/a> also are in the process of transitioning away from third-party advertising data entirely.<\/p>\n\n\n\n However, Google's initiative to kill third-party cookies in Chrome has been met by resistance from the ad tech industry<\/a>, especially from marketers and advertising agencies. They\u2019re worried that the blanket stop to third-party cookies will hurt the internet economy and particularly startups. They have urged Google to keep third-party cookies in operation until tried and tested alternatives are in place.<\/p>\n\n\n\n The end of third-party cookies doesn't mean the end of the need for user consent. <\/p>\n\n\n\n There are numerous tracking technologies available to determine a user's identity across websites. Unless Chrome and other web browsers discontinue support not only for third-party cookies, but also for any other kind of similar website tracking<\/a> techniques, users will still be tracked by some technologies as they browse the internet. <\/p>\n\n\n\n Tracking technologies can also be nested in the services used on websites and apps, so site owners may not always even know what data is being collected by third parties without deep scanning<\/a>.<\/p>\n\n\n\n That's why consent remains the central requirement of many of the world's major data protection laws, led by the European Union's General Data Protection Regulation (GDPR)<\/a> and reflected in laws the GDPR has influenced, like Brazil's LGPD<\/a>.<\/p>\n\n\n\n Under the jurisdiction of these laws, your website must obtain the explicit consent from users before activating cookies, or collecting or storing any data on their browsers, or processing personal data for tracking and advertising, regardless of the technology used.<\/p>\n\n\n\n Your website is also obliged to clearly inform end users about the tracking technologies you use, detailing the providers, purposes, and duration of data collection. <\/p>\n\n\n\n You must also safely document the consents obtained and be able to provide the data in the event of an audit or data subject access request. New consent must typically be obtained if the processing conditions \u2014 like purpose \u2014 change, or after a certain period of time, the length of which is different under each law. Under many laws, users must also be able to change or revoke their consent preferences as easily as they gave consent..<\/p>\n\n\n\n Consent is the cornerstone of privacy-compliant tracking practices, today and in the future.<\/p>\n\n\n\n Google has already started introducing features and requirements that make consent pivotal to use some of its services and protect user privacy. Recent laws with strong data privacy components, like the EU\u2019s Digital Markets Act (DMA)<\/a>, with requirements that explicitly target Google and other influential tech companies, are at least one likely catalyst for such changes.<\/p>\n\n\n\n Google Consent Mode<\/a> launched in September 2020 and enabled websites to collect aggregate and non-identifying data as well as display contextual advertisement if end users chose not to give their consent to statistics and marketing cookies. With Google Consent Mode v2<\/a>, implemented in November 2023, it has evolved into more of a signaling tool, and users\u2019 consent preferences determine whether Google tags collect and process full or anonymized data.<\/p>\n\n\n\n As of January 2024, publishers who use Google\u2019s AdSense, Ad Manager, or AdMob products must use a Google-certified consent management platform (CMP)<\/a> to serve ads to website visitors from the European Union (EU), European Economic Area (EEA) and the United Kingdom (UK). To receive certification, a CMP must integrate with the Interactive Advertising Bureau Europe\u2019s Transparency and Consent Framework (IAB TCF v2.2<\/a>), which aids in aligning with data privacy laws like the GDPR and its strict consent requirements.<\/p>\n\n\n\n Google\u2019s Privacy Sandbox includes APIs and measures designed to support advertising functionalities without relying on tracking users across different websites. Some of these include the following functions.<\/p>\n\n\n\n Topics enables browsers to convey information about users\u2019 interests with third parties without tracking user activity or disclosing their personal information. Topics<\/a> is \u201cdesigned to preserve privacy while showing relevant content and ads.\u201d Google has released a list of topics<\/a>, which it expects to evolve over time.<\/p>\n\n\n\n Formerly called FLEDGE (First Locally-Executed Decision over Groups Experiment), Protected Audience enables advertisers to run ad auctions using JavaScript code within the browser itself. Advertisers can run targeted remarketing campaigns to custom audiences or a group of people with a common interest.<\/p>\n\n\n\n Formerly called Trust Tokens, Private State Tokens are designed to enable websites to determine whether a user is real or a bot without engaging in passive tracking. According to Google, these tokens are encrypted<\/a> and cannot be used to identify individual users. They can be used to protect advertisers against fraud and enhance user privacy by eliminating the invasive tracking commonly associated with third-party cookies.<\/p>\n\n\n\n Attribution Reporting enables measurement of conversions from ad clicks and views, as well as ads on other platforms, without tracking user activity across websites. It groups user interactions (like ad clicks or views) into large sets, obscuring individual users' actions. It employs two types of reporting: event-level, which provides detailed conversion data without revealing user identities, and aggregate-level, which presents summarized data across large groups of users.<\/p>\n\n\n\n For a full list of APIs and other measures, you can view Google\u2019s Privacy Sandbox website<\/a>.<\/p>\n\n\n\n The effectiveness of these new approaches remains unproven, and many details are still being worked out. Website owners and advertisers may need to rely more on first-party data as the move away from using third-party cookies unfolds.<\/p>\n\n\n\n Google intends to eliminate the use of third-party cookies for all Chrome users, but the final deadline to do so has been pushed back several times, and website owners must prepare for how their websites will work once these cookies are deprecated.<\/p>\n\n\n\n To prepare for these changes, you need to know which third-party cookies your website uses and you can use a cookie scanner<\/a> to find out.<\/p>\n\n\n\nWhy is Google removing third-party cookies in Chrome, and what does it mean?<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2022\/01\/Why-is-Google-removing-third-party-cookies-in-Chrome-and-what-does-it-mean_.svg\")
<\/figure>\n\n\n\n\n
If third-party cookies are going away, do websites still need consent?<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2022\/01\/If-third-party-cookies-are-going-away-do-websites-still-need-consent_.svg\")
<\/figure>\n\n\n\nConsent and Google ads and analytics platforms<\/h3>\n\n\n\n
What is replacing third-party cookies in Chrome?<\/h2>\n\n\n\n
Topics<\/h3>\n\n\n\n
Protected audience<\/h3>\n\n\n\n
Private State Tokens<\/h3>\n\n\n\n
Attribution Reporting<\/h3>\n\n\n\n
Preparing for Google\u2019s third-party cookie deprecation<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2022\/01\/Preparing-for-Googles-third-party-cookie-deprecation-1.svg\")
<\/figure>\n\n\n\n