Google’s Cookie Pivot Eases Ad Concerns, Fuels Privacy Dilemma

Nearly five years after Google announced plans to cut off its Chrome web browser from third-party tracking tools, the tech giant suddenly backtracked last week and in the process traded some antitrust scrutiny for a looming privacy battle.

Google meticulously documented its plan to phase out third-party trackers—also known as cookies and often used for targeted advertising—since 2020, publishing multiple blog posts and press statements emphasizing the company’s privacy priorities. But as early as 2021, Google’s idea was also flagged by antitrust regulators in the UK who worried that the change could stifle competition in digital advertising markets.

Now, Google’s pivot has privacy regulators watching—and warning against relying on “opaque” forms of tracking. The new plan will not only require approval by regulators globally, but must also survive imminent litigation around the deployment of user tracking technologies.

“Google’s decision to continue allowing third-party cookies, despite other major browsers blocking them for years, is a direct consequence of their advertising-driven business model,” Lena Cohen, staff technologist at the Electronic Frontier Foundation, said in an email. “It’s clear why Chrome is putting advertisers’ interests above users’ privacy.”

Ads accounted for more than three-quarters of Google’s $307 billion in revenue in 2023, according to Bloomberg data. Google didn’t shy away from its profit motives when announcing its decision on July 22. The company in a blog post said the sudden pivot is based on calls from advertising stakeholders, as well as regulators, to keep third-party cookies in its Chrome web browser.

“This feedback helped us craft solutions that aim to support a competitive and thriving marketplace that works for publishers and advertisers,” Anthony Chavez, a vice president at Google, said in the post.

Regulators—and States—Watching

Instead of shuttering its third-party tracking program, Google is now proposing a “new experience” that “lets people make an informed choice that applies across their web browsing,” Chavez said in the blog post.

Google didn’t respond to requests for more details about what this new experience would look like in practice.

The company remains committed to what it calls its “Privacy Sandbox,” Google’s attempt to protect people’s privacy online, Sundar Pichai, CEO of Google and Alphabet Inc, said in a July 23 earnings call. “We now believe user choice is the best path forward there.”

The plan will have to be reviewed by regulators including the United Kingdom’s Competition and Markets Authority and its independent regulator for data protection and information rights, the Information Commissioner’s Office. The CMA has been leading an investigation into Google’s cookie removal proposal since 2021, looking into whether the change would cause Google to scoop an even bigger slice of the advertising spend and distort competition. Removing third-party cookies could prevent publishers from generating key revenue, according to a 2021 press release from the CMA announcing its investigation.

In a response to Google’s announcement that it would retain third-party cookies, the ICO’s Deputy Commissioner Stephen Bonner said he was “disappointed” and will continue to support the creation of a “more privacy-friendly internet.”

“Despite Google’s decision, we continue to encourage the digital advertising industry to move to more private alternatives to third-party cookies—and not to resort to more opaque forms of tracking,” he said in a July 23 statement.

The tech giant’s privacy initiative had already faced hurdles in the European Union. In June, noyb—European Center for Digital Rights, one of the EU’s leading privacy advocacy groups, filed a complaint against Google with the Austrian data protection authority over the Privacy Sandbox. The complaint said Google doesn’t obtain valid user consent, and instead tricks users to opt into a so-called “ad privacy feature” which actually turns on the browser’s own internal tracking.

“Google has simply lied to its users,” Max Schrems, honorary chairman and founder of noyb said in a statement. “People thought they were agreeing to a privacy feature, but were tricked into accepting Google’s first-party ad tracking. Consent has to be informed, transparent and fair to be legal. Google has done the exact opposite.”

Alternative Privacy Methods

Google will have to prove that it offers consumers a genuine choice, obtaining valid consent and steering away from dark patterns, said Peter K. Jackson, counsel at Greenberg Glusker Fields Claman & Machtinger LLP, where he advises clients on technology-related operations. Dark patterns are intentionally deceptive practices used to hinder a consumer’s ability to make an informed decision—like using hard-to-understand language when seeking consent to collect data.

“I don’t think that the story’s over by any stretch of the imagination, because I don’t think we’ve actually seen a fulsome response from the Competition and Markets Authority about its views on whether this should be over,” Jackson said.

Google’s Privacy Sandbox seeks to rely on what the provider says are a variety of new techniques to enhance users’ privacy online.

Differential privacy, for example, is a system that shares information about a dataset to reveal patterns of behavior without revealing private information about individuals or whether they belong to the dataset, Google says. K-anonymity—another technique listed as part of the Privacy Sandbox—is a measure of anonymity within a dataset.

“I would say the big trend is to try to find a way to not use historical types of data that have been used to do targeted advertising and instead shift to sort of like information about your behavior as opposed to, like, the behavior itself,” Jackson explained.

But some of these techniques may not be so privacy fool-proof, said Aaron K. Tantleff, partner in Foley & Lardner LLP’s Technology Transactions, Cybersecurity, and Privacy practice group. Ensuring that data in a set is completely isolated from the individual it belongs to, for example, could prove trickier in light of recent developments in artificial intelligence.

“Maybe when it was first envisioned there was a possibility that it could preserve privacy. I don’t know,” Tantleff said. “But I can tell you now, I find it very difficult to believe that privacy would be able to be preserved as the product was envisioned.”

Google isn’t the first to contemplate rolling back tracking cookies. Apple Inc. and Mozilla, for example, already removed the technology from their Safari and Firefox browsers.

Since then, US states have built policy momentum to reign in personalized advertising with legislation explicitly requiring companies to allow consumers to opt out of targeted advertising. As more states seem poised to move in that direction, pressure on companies to rethink current advertising techniques will keep growing, said Steven G. Stransky, co-chair of the Privacy & Cybersecurity practice at Thompson Hine LLP.

“We’re going to continue to see the trend of more states enacting privacy laws that give choices to consumers,” he added, especially as neither chamber of Congress has passed legislation that would set a national standard for all businesses regarding targeted advertising.