What might this mean for ad tech companies and digital publishers?

In June 2019, the adtech world was abuzz with rumours that Google would announce plans to follow in the footsteps of Apple and Mozilla by blocking third-party cookies in their dominant web browser, Chrome, at their Google I/O event. Such a move was widely heralded to mark the end of ad tech for the open ecosystem and for publishers heavily reliant on digital advertising revenues.

The June I/O announcements did not quite come to fruition on that day. Instead, Google majored on their new data collaboration tool 'Private Join and Compute'; a protocol that many looked at as Google’s proposed solution to enabling the adtech industry to thrive without third-party cookies.‍

Winter is (now) coming for third-party cookies

As we moved into winter, the adtech industry again waited with bated breath for any announcements at the Chrome Dev Summit 2019. Following the trend they set in June, Google did not directly announce that they would begin blocking third-party cookies in Chrome, but this time they did make a number of announcements that hinted more strongly at the future demise of third-party cookies. 

Michael Kleber’s introduction to the stage grabbed the attention of much of the adtech industry with the statement that he was going to tackle the subject of limiting third-party tracking of user behaviour across the website while enabling a thriving alternative ecosystem.

To my mind, the most significant announcement that Google made has interestingly received the least amount of focus. Google announced that when it releases Chrome M80 in February 2020, all cookies will need to be labelled ‘same-site’. What happens to the cookies not labelled as same-site? Well Google is being rather ambiguous about this crucial element. But an educated guess would see, the natural evolution surely being Chrome beginning to block them.

What does ‘same-site’ mean for third-party cookies?

Labelling a cookie same-site essentially means that the data collected by these cookies is strictly for first-party (site only) usage. These cookies will still be capable of collecting data, but that data will only be accessible to the site owner which placed it on the user’s browser  - removing any portability of data that third-party cookies previously provided and upon which most legacy ad tech platforms depended. 

What does this mean in practical terms? Essentially ‘same-site’ means that while a cookie can still be fired on a brand’s site, for example, by the DMP installed by the brand, the data collected can not then be used by the DMP to inform segmentation and audience targeting capabilities across all of its client base. The core challenge facing the majority of ad tech vendors is that same-site would effectively remove the data portability and cross-site tracking that powers their platform capabilities...and which much of the digital advertising ecosystem relies upon for advertising revenues. 

During his presentation, Michael Kleber pointed to the need to introduce a solution to cross-site tracking before killing third-party cookies entirely, as the complete removal would inevitably lead to more questionable forms of tracking, such as fingerprinting, being introduced to fill the void. How does Google plan to fill this tracking void? They pointed to their previously announced ‘Private Join and Compute’ protocol, with further enhancements around federated computation and differential privacy.