Google Cookie Change Eases Advertising Concerns, Intensifies Privacy Dilemma

Almost five years later Google announced plans to cut off its Chrome web browser from third-party tracking tools, but the tech giant unexpectedly backtracked on its intentions last week, trading some antitrust scrutiny for a looming privacy battle.

Google has been meticulously documenting its plan to phase out third-party trackers — also known as cookies and often used for targeted advertising — since 2020, with multiple blog posts and press releases highlighting the company’s privacy priorities. But as early as 2021, Google’s idea was also flagged by competition regulators in the U.K., who feared the change could stifle competition in digital advertising markets.

Now, as Google changes direction, privacy regulators are watching and warning against relying on “opaque” forms of tracking. The new plan will not only require approval from regulators around the world, but it must also survive upcoming litigation over the implementation of user-tracking technology.

“Google’s decision to continue allowing third-party cookies when other major browsers have been blocking them for years is a direct consequence of their ad-based business model,” Lena Cohen, a research technologist at the Electronic Frontier Foundation, said in an email. “It’s clear why Chrome is putting advertisers’ interests ahead of users’ privacy.”

Advertising accounted for more than three-quarters of Google’s $307 billion in revenue in 2023, according to Bloomberg data. Google didn’t shy away from profit motives when it announced its decision on July 22. The company said in a blog post that the sudden U-turn was based on calls from advertising stakeholders, as well as regulators, to keep third-party cookies in its Chrome web browser.

“This feedback has helped us develop solutions that are designed to support a competitive and thriving marketplace that works for both publishers and advertisers,” Anthony Chavez, a Google vice president, said in the post.

Regulators and states are watching

Instead of shutting down its third-party tracking program, Google is now offering a “new experience” that “empowers people to make informed choices that apply to their web browsing experience,” Chavez said in a blog post.

Google did not respond to requests for more detailed information about what this new solution will look like in practice.

The company remains committed to what it calls the “Privacy Sandbox,” Google’s attempt to protect people’s privacy online, Google and Alphabet Inc. CEO Sundar Pichai said during a July 23 earnings conference call. “We currently believe that user choice is the best path forward.”

The plan will need to be reviewed by regulators, including the UK Competition and Markets Authority and its independent data protection and information rights regulator, the Information Commissioner’s Office. The CMA is investigating Google’s proposal to remove cookies from 2021, examining whether the change would result in Google taking an even bigger share of advertising spend and distorting competition. Removing third-party cookies could prevent publishers from generating key revenue, according to a 2021 CMA press release announcing the investigation.

In response to Google’s announcement that the company would be using third-party cookies, ICO deputy commissioner Stephen Bonner said he was “disappointed” and would continue to support the creation of a “more privacy-friendly internet”.

“Despite Google’s decision, we continue to encourage the digital advertising industry to move to more private alternatives to third-party cookies and not resort to more opaque forms of tracking,” he said in a July 23 statement.

The tech giant’s privacy initiative has already run into obstacles in the European Union. In June, noyb—the European Centre for Digital Rights, one of the EU’s leading privacy groups, filed a complaint against Google with the Austrian data protection authority over Privacy Sandbox. The complaint alleged that Google fails to obtain valid user consent and instead tricks users into opting for a so-called “ad privacy feature” that actually enables internal browser tracking.

“Google simply lied to its users,” Max Schrems, honorary chairman and founder of noyb, said in a statement. “People thought they were consenting to a privacy feature, but were tricked into accepting Google’s own ad tracking. Consent must be informed, transparent and fair to be legal. Google did the exact opposite.”

Alternative methods of protecting privacy

Google will have to prove it offers consumers real choice by obtaining valid consent and avoiding dark patterns, said Peter K. Jackson, an attorney at Greenberg Glusker Fields Claman & Machtinger LLP, where he advises clients on technology operations. Dark patterns are intentionally deceptive practices used to make it harder for consumers to make informed decisions — for example, using hard-to-understand language when seeking consent to collect data.

“I don’t think this is the end of the story because I don’t think we’ve actually had a comprehensive answer from the Competition and Markets Authority about whether this case should be closed,” Jackson said.

Google’s Privacy Sandbox solution is based on a series of new techniques that the vendor claims are designed to enhance users’ privacy online.

For example, differential privacy is a system that shares information about a dataset to reveal patterns of behavior without revealing private information about individuals or whether they belong in the dataset, Google says. K-anonymity — another technique listed as part of Privacy Sandbox — is a measure of anonymity in a dataset.

“I would say the main trend is trying to find a way to not use the historical types of data that have been used to create targeted ads, and instead go to information about your behavior, rather than, for example, the behavior itself,” Jackson explained.

But some of these techniques may not be as robust from a privacy perspective, said Aaron K. Tantleff, a partner in the technology transactions, cybersecurity and privacy group at Foley & Lardner LLP. Ensuring that the data in a set is completely isolated from the person it belongs to may prove more difficult in light of recent advances in artificial intelligence.

“Maybe when this was first imagined, there was a possibility that it would protect privacy. I don’t know,” Tantleff said. “But now I can tell you that I have a very hard time believing that privacy could be preserved in the way that this product was imagined.”

Google is not the first company to consider phasing out tracking cookies. Apple Inc. and Mozilla, for example, has already removed this technology from its Safari and Firefox browsers.

Since then, U.S. states have gained political momentum to restrict personalized advertising, with laws explicitly requiring companies to allow consumers to opt out of targeted advertising. As more states appear poised to move in this direction, the pressure on companies to rethink current advertising techniques will only grow, said Steven G. Stransky, co-chair of the Privacy & Cybersecurity practice at Thompson Hine LLP.

“We will continue to see a trend of more states passing privacy laws that give consumers choice,” he added, especially since neither house of Congress has passed legislation that would set a national standard for all companies on targeted advertising.