Apocalypse not now: Google’s cookie rug pull points to ‘deprecation by default’ but market has already moved on – and regulators are lining up
September 17, 2024
September 17, 2024
By Andrew Birmingham | 23 Jul 2024 | Apocalypse not now: Google’s cookie rug pull points to ‘deprecation by default’ but market has already moved on – and regulators are lining up | Mi3 (mi-3.com.au)
Four years in, Google has officially pulled the rug on cookie deprecation. Consensus is Google read the runes on the upcoming report from the UK Competition and Markets Authority (CMA) report in the UK and factored in the DOJ's anti-trust case that kicks off in September. Mi3 spoke to brand, media, agency, and regulatory leads to gauge the impact for marketers and the supply chain – and they see deprecation happening by default, and trouble brewing for Google either way. Meanwhile, the market has already moved on to first-party approaches because cookies were "leaving money on the table". But there are questions about how Google implements consent opt-ins or opt-outs, and risks of marketers getting caught out by ignorance of where cookies operate as local privacy laws change.
What you need to know:
I think it's very clear that this move is not independent of the fact that Google knows that this [DOJ antitrust] trial is starting and that minds and eyes are starting to turn to what real remedies might actually look like.
— Arielle Garcia, Director of Intelligence, Check My Ads
Google has clearly been taking negotiating lessons from my teenage kids: I’ll get around to it, I’ll get around to it, I’ll get around to it. Oops.
Yesterday’s announcement by the digital advertising leviathan that after creating four years of fear, uncertainty, and doubt it would abandon plans to deprecate cookies and instead move to a browser-based consent model was as shocking to some as it was inevitable to others. Google had previously delayed deprecation three times since it first announced the move in 2020.
The consensus view: Google is trapped between a regulatory hard place and the rock it has built its fortune upon – a huge fortress made of solid gold, built on mining its near monopoly control of search (AI incursions notwithstanding) along with its wider advertising ecosystem.
Contextual shifts
The context of the announcement's timing is important. The UK's Competition and Markets Authority (CMA) is due to release its quarterly update on this assessment of Google’s third-party cookies approach, and little that has come out of the CMA over the last year has been encouraging for Google.* If anything the regulator seemed to be hardening its views. The fact that Google has made this announcement ahead of the CMA's latest update is unlikely to be coincidental.
Meanwhile, the DOJ’s anti-trust case kicks off in September, and if it loses the case, Google faces the prospect of an enforced break-up of its adtech business. DOJ prosecutors claim the firm takes at least 30 cents on every digital dollar flowing through its pipes and wires – sometimes much more – with the market having little alternative and competitors squeezed out.
According to Arielle Garcia, director of intelligence at Check My Ads, “The next CMA quarterly report should be out any day now, and we might get some clarity there around the ‘why now’ of this announcement. But if I were to to guess at the other part of the driver here it's that they're about to head into an antitrust trial. There's all this buzz around spinning off the sell side of their ad tech business. There's folks saying ‘So you're going to move it all into the browser and then spin off the sell side of the ad tech business... that doesn't really solve anything.’
“I do think that it's very clear that this move is not independent of the fact that Google knows that this [DOJ Antitrust] trial is starting and that that minds and eyes are starting to turn to what real remedies might actually look like.”
Saw it coming
A majority of B2C marketers in APAC didn’t believe cookie deprecation was ever going to happen, according to research firm Forrester – and that number was steadily growing.
"It’s no surprise that Google eventually scrapped its cookie deprecation plans after three delays in four years," Forrester Principal Analyst Xiaofeng Wang told Mi3.
"Most marketers in APAC have seen this coming. According to Forrester's Marketing Survey 2024, 53 per cent of B2C marketing decision-makers in APAC did not believe that Google would deprecate the third-party cookie, which increased from 49 per cent in 2023. This would further dampen advertisers’ urgency to adopt Privacy Sandbox, Google’s initiative to replace third-party cookies with privacy-preserving technologies.”
Wang made the point that deprecation was happening with or without Google’s plans.
“Consumers in APAC are getting more privacy sensitive. For example, 42 per cent of Australian online adults already clear their browsing histories, 23 per cent put up ad blockers, and 21 per cent use private or incognito mode in their browser to protect their online privacy," she said, citing Forrester's 2023 Consumer Benchmark Survey.
“Mainstream consumer data privacy regulations, such as GDPR and CCPA, and APAC-specific regulations like Singapore's PDPA and India's DPDPA 2023, impose rules on third-party cookie use, requiring transparency and user consent,” she said.
Also noteworthy from Forrester’s Marketing Survey 2024, “64 per cent of B2C marketing decision-makers in APAC have invested in more zero- and first-party data collection, and 62 per cent are testing more context-based advertising.” This shows brands have already moved beyond the cookie – at least partially.
“We’ve done a lot of good work planning for the post-third-party cookie world. We’ve made the most of this opportunity to improve our targeting and measuring by improving our first-party data and audience strategy, and we’ll continue to focus on this,” said Louise Laing, General Manager of Marketing ANZ at Intrepid Travel.
She acknowledged that third-party audiences will continue to be an important part of our toolkit, but told Mi3 that relying too much on them would be risky.
“We want to get to know our customers better and deliver an experience they enjoy. First and zero-party data collection through our owned channels still remain the best way for us to develop that one-to-one relationship. And we can do that while giving customers control over how their data is used.”
User choice?
As to the specifics of the announcement, Chris Brinkworth managing partner at consultancy Civic Data said Google's plan to introduce more choices around privacy and cookie choices could end up significantly reducing cookie usage – but overlap between cookies and Privacy Sandbox APIs in Chrome could end up creating more confusion.
Brinkworth said brands need to prepare for these changes but also question why Google “might not fully educate them on impacts already seen in other browsers, or why they push the industry towards their preferred advertising methods versus those complementary to a truly open web".
It’s important to think beyond Chrome, he said.
"Consider that Google's own GA4 analytics tool as a first-party cookie generally can only track unique visitor information for a maximum of seven days within Safari as a first-party cookie, yet much much longer in Chrome. Understanding these basic limitations outside of Chrome is crucial for businesses in today's digital ecosystem, but somehow Google does not feel it relevant to educate or warn businesses against such complacency in announcements like this.”
No backsliding
The message from industry associations, agencies, and service providers was uniform; brands need to avoid the temptation to back-pedal and continue to build out first-party data capabilities.
As Mi3’s Fast News reported yesterday, in a written statement issued shortly after the news broke ADMA CEO Andrea Martens welcomed Google’s reversal but stressed the need for brands to plough on with their own initiatives regardless.
“For marketers, the proposals put forward in the Privacy Sandbox to date have been concerning due to the negative impact they would have on advertising effectiveness and campaign performance, whilst still not meeting privacy laws," said Martins "ADMA is encouraged to see that Google has taken a different approach, rather than dogmatically pursuing a solution that would not benefit either the consumer or the marketer. We look forward to Google engaging with the industry as it rolls this out."
Media companies have already invested significantly in first-party data architectures, and say they are able to demonstrate the benefit to brands.
News Corp’s Paul Blackburn, Director of Commercial Data & eCommerce, cited 150 per cent increases in click-through rates for travel business Beyond Journey via News' first-party data stack.
It's a similar story at Nine, where chief data officer Suzie Cardwell pointed out the publisher-broadcaster has been developing first-party data infrastructure since well before cookie deprecation kicked off with Apple's Safari in 2017 – and cited data matching boosting online visits for Coles by 32 per cent.
Free hit
Google’s ad tech competitors expressed skepticism at its intent.
“The advertising industry has moved on, realising that the digital world extends beyond Chrome," per The Trade Desk ANZ VP James Bayes, who claimed The Trade Desk-led cookie alternative initiative, Unified ID 2.0, which creates an identifier by hashing email addresses or phone numbers, is one of a number of "far superior identity solutions that aren't controlled by Big Tech" and which represent "a significant upgrade to the internet".
He questioned whether Google would give consumers a genuine choice on tracking or effectively choose for them by opting Chrome users in and then making it hard to opt-out.
Others raised similar questions about Google's broader use of consumer data – and whether internet users would have a genuine choice about being tracked.
My question is will people have the ability to make that same type of informed choice when it comes to Google's own use of data across its own and operated properties in Chrome where there appear to be secret identifiers that the purpose for which they're collected or used is not disclosed. If you don't know an identifier exists, how can one opt out of it or exert any control?
— Arielle Garcia, Director of Intelligence, Check My Ads
Secret identifiers?
"What Google basically said in their announcement is that instead of getting rid of third-party cookies altogether, they're going to roll out a new informed choice experience to give people more control over the data that is collected and used about them," per Arielle Garcia, Director of Intelligence at US ad watchdog, Check My Ads.
"Today you can already opt out of tracking. It's not the easiest setting to find, but it can be done. Reading between the lines there are two potential options. One is that they make it easier for people to opt out, and the other is that they eventually make it so that people need to opt in."
That second option would be analogous to App Tracking Transparency with Apple, where the amount of people that actually opted in to allow tracking was low, she said.
"So if you were to imagine a world where tracking is subject to an opt-in, that's effectively the same as killing third-party cookies. It's just that they're killing it by virtue of letting the low opt-in rates render third-party cookies obsolete, versus blocking third-party cookies altogether, which basically circumvents a lot of the antitrust scrutiny."
She told Mi3, "My question is will people have the ability to make that same type of informed choice when it comes to Google's own use of data across its own and operated properties in Chrome where there appear to be secret identifiers that the purpose for which they're collected or used is not disclosed. If you don't know an identifier exists, how can one opt out of it or exert any control?"
Garcia said she believed it was likely that there would be a different standard for Google's own use of data and tracking of users across its properties in Chrome, versus third-party cookies, which "whenever it suits them, they can move to an opt-in and effectively kill it without any antitrust troubles."
In terms of the announcement she said, "I don't think that the regulators are going to be thrilled about it. I do think that the [UK's] CMA is listening to the feedback that it is receiving from the industry, and the minute that Google indicates that it might turn off that spigot, the barrage of industry concern will follow."
For that reason Garcia said she doesn't expect it to be a particularly successful strategy in avoiding regulatory scrutiny or even fuelling innovation, "But this is very typical of the types of games we've come to expect."
If Australians had to actively manage their privacy settings on websites it would take them 30 minutes on average a day.
— Chandni Gupta, Deputy CEO and Digital Policy Director, Consumer Policy Research Centre
Opt out burden
According to Chandni Gupta, deputy CEO and digital policy director of the Consumer Policy Research Centre, there is a clear mismatch between what Australians expect from their privacy protections and what is actually being offered to them.
"We found that 71 per cent of Australians believe that they have very little to no control over businesses sharing their personal information with other businesses. We've also found that when it comes to managing privacy settings, which is what Google is suggesting, they believe it's a complex, difficult process at the moment."
As evidence, she points to research released two weeks ago which calculated that if Australians had to actively manage their privacy settings on websites and apps, it would take them 30 minutes every day. "That's not a position that Australians should have to be in at any point in time. Basically, we would like to see businesses treat people's data with care and respect."
Among the other findings of the CPRC study;
She said that by default, Australians expect that they should be opting in when they need to, as opposed to having to navigate every single website and app and opt out. "It's not a process that's fair for Australia to have to navigate."
Gupta said, "Unfortunately, there's a real power imbalance between businesses and individuals. They know so much about us and we know so little about how they know what they know."
"At the moment, protections are based on notification and consent. However, it is very much a take-it-or-leave-it approach," she said, emphasising for need for the proposed update to Australia's privacy regime.
The general view is that Tech has been able to do whatever Tech wants to do for the last 25 years, and now when they try and do things, regulators are looking at every single thing they do and saying, 'How about no or how about you tell us what that actually means', or 'Maybe that doesn't do what we want. Can you have another look at it and come back to us, please?'
— Ricky Sutton, founder, Future Media
Ricky Sutton, founder of Future Media, says he believes Google's move reflects the extra scrutiny and action regulators are bringing to bear on the digital giants.
"The general view is that Tech has been able to do whatever Tech wants to do for the last 25 years, and now when they try and do things, regulators are looking at every single thing they do and saying, 'How about no or how about you tell us what that actually means', or 'Maybe that doesn't do what we want. Can you have another look at it and come back to us, please?' And I don't think the big tech likes having its homework marked."
According to Sutton, "This is a classic case. This whole derailing effectively of cookie deprecation, came out of the UK where the CMA that did the investigation said 'This is just going to further cement your monopoly. You say it's to solve privacy, but it solves privacy for you and nobody else. That doesn't really work for us, so please come back to us and let us know."
And after Google came back with an answer? "Thanks for giving us your responses, but all you're doing is confirming your monopoly."
This is an instance he says where you can draw a direct distinction that Google's efforts were halted by the regulator.
It's not the only digital giant to fall afoul of European sensibilities. Meta's consent-or-pay model – it has launched a subscription service for Facebook and Instagram in Europe arguing that those who don't pay for a subscription are effectively choosing to hand over their data – is now also on the rack. Regulators, per Sutton, aren't buying it.
"I really do think that this is about the fact that regulators now have this in their crosshairs where they haven't prior."
Ignoring the need to understand which tools utilise third-party cookies, due to complacency, will lead to serious compliance issues under Australian privacy law. Brands must diligently understand where and why these elements are used, ensure their use is fair and reasonable, and navigate the inconsistencies in technology.
— Chris Brinkworth, Managing Partner, Civic Data
Gaslighting, complacency
Civic Data Chris Brinkworth said while Google's move towards a consent-based approach "may be viewed favourably by regulators as it puts more control in the hands of users", it raises questions about how consent will be implemented and whether it genuinely addresses privacy concerns.
"Regulators like the UK's CMA and ICO will likely scrutinise the details of this new approach, given the core blocker to Sandbox has been related to UK oversight. However, as we’ve seen with Meta’s “Pay or Consent” model, Google may come up against hurdles related to the newly formed DMA [Digital Markets Act] if they continue to be seen to be gaslighting or playing a shell game."
Part of the problem with Google's announcement today is that a lot of the detail is missing. Brinkworth believes on first reading that Google's "Informed Choice" approach appears to involve giving users more control over settings that already exist but are "buried within ads preferences."
Either way, he urged marketers locally to get a handle on which tools utilise third-party cookies ahead of changes to Australian privacy laws. Complacency, he said "will lead to serious compliance issues ... Brands must diligently understand where and why these elements are used, ensure their use is fair and reasonable, and navigate the inconsistencies in technology."
Further complicating matters, the varied behaviour and mismatch of cookies and API across different browsers, devices, and operating systems will make orchestrating consent significantly more challenging, he said.
"Long story short - it’s not just about performance and compliance; it’s about safeguarding the brand’s future in a tightening regulatory landscape."
You're still going to have the requirement of utilising the privacy sandbox APIs for management and measurement. That's not going to go away, but you just wonder what the volumes will look like.
— Jonas Jaanimagi, IAB Australia Tech Lead
Genuine consent?
ADMA, representing brands, and IAB representing the wider ad tech ecosystem, are both of the view that the world needs to move forward, despite Google's reversal. However, each focused on some specific detail – or lack thereof.
Sarla Fernando, director of regulatory and advocacy at ADMA highlighted the lack of specific detail from Google to still provide more detail on the exact way in which its “new experience" will be when it comes to the issue of giving the said control to users.
"In theory, the concept seems to align with Australian Privacy reform as far as requirements around transparency... However, what needs to be seen is if that consent comes with the necessary upfront transparent notice and is easily [given]. Also important is that there are no dark patterns around it the way in which consent is provided."
"If that criteria is met, then a business should be able to rely on you'd assume that people are providing the required consent. However under the proposed Australian law, the use of personal information would We'd assume that hopefully it would also need to meet the new overarching fair and reasonable test because only then can a business assume that consumers are saying up front 'We are comfortable with you doing it," she told Mi3.
"A lot of companies have done a lot of work to create post-cookie deprecation strategies. We'd recommend they continue to do that ... because at the end of the day that is best practice, the new world is about giving consumers control and meeting the expectations about how their data is used with consent, and [the use of their data] being fair and reasonable."
IAB Australia's Tech Lead, Jonas Jaanimagi, described Google's announcement as, "almost a too obvious resolution to some of the pressure they getting from both the CMA in the UK".
"That's because once you've got an explicit choice from a consumer to go one way or another, you can then deal with them depending upon the choice that the consumer has made."
"You're still going to have the requirement of utilising the privacy sandbox APIs for management and measurement. That's not going to go away, but you just wonder what the volumes will look like."
If those volumes fall low enough it starts to look like deprecation by default. "We have to look at precedents elsewhere. Apple’s App Tracking Transparency feature (ATT) in Australia fluctuated from less than 20% initially in 2021, up to an average nearer to 40% in 2024," he said.
"The questions that do remain are very much the need to understand further from Google, just what does the execution look like? Is this an opt-in signal, or is it an opt-out signal?"
With Google finally taking the deprecation of third-party cookies off the table, publishers and brands reliant on cookie enrichments may celebrate, as marketers can continue tracking 'interested' audiences across the web, and publishers can continue to sell ‘interested’ audiences. However, with data and privacy reforms looming, this celebration may be short-lived.
— Andrew Brain, Seven West Media Director of Audience Development and Growth
Good riddance
Andrew Brain, Seven West Media Director of Audience Development and Growth, said almost 80 per cent of ad impressions it delivers across connected TV, mobile and web use its first part data. Those using legacy approaches, he suggested, will have to face reality sooner rather than later.
“With Google finally taking the deprecation of third-party cookies off the table, publishers and brands reliant on cookie enrichments may celebrate, as marketers can continue tracking 'interested' audiences across the web, and publishers can continue to sell ‘interested’ audiences," said Brain. "However, with data and privacy reforms looming, this celebration may be short-lived."
He said it is important for publishers to continue to find ways to create a true value exchange with audiences and speed up the creation of a first party data device graph through registration. "If that's not feasible, engage with first-party cookie tech partners." He rates AdFixus.
"In the past six weeks, deploying AdFixus has allowed us to gain insights on nearly 600,000 unique 7News.com.au browsers, with many coming from Safari, or social referrals which [previously] meant little to zero insight – simply put, a blind cookie we knew nothing about. Now we can drop them into cohorts."
In the long run, he said brands and advertisers "will only find greater value in partnering with media organisations that are powered by deeper and more robust data-driven insights delivering high-value audiences delivering better campaign outcomes.”
News Corp's Paul Blackburn likewise stressed the ongoing issue of signal loss and said there are now far better solutions available, claiming tests with advertisers are showing "four times the return on ad spend when we go up against current third party cookies."
As such, Google's reversal "doesn't really change anything for us. You need a first-party, trusted audience and you need privacy-compliant methods to get a better outcome for the client."
Nine's Suzie Cardwell said that the media majors had long recognised the need to create direct relationships with audiences - hence the likes of Nine getting people to log-in seven years ago and subsequently amassing email addresses for most Australians – circa 22 million.
"That was a recognition of the fact even back then, that first-party data gives us the ability to deeply understand what the audience likes and it gives our advertisers a really clear understanding of who those audiences are, who to target, and how to target them."
With brands likewise investing in their first-party data efforts, the effect is multiplied - delivering efficiency through matching data so that, for example, new customers can be sought and existing ones suppressed, making budgets go further and improving returns.
Google will no longer be the executioner, but third-party Cookies are dying regardless – and their utility as the foundation of digital advertising’s targeting and attribution capabilities will not return (if it was ever truly there to begin with).
— Ben Combe, Senior Director of Data, Optimisation & Personalisation, Monks
Sparro by Brainlabs product director, Dan Baker, told Mi3: “Brands still need to focus on monetisation and attribution of these audiences without third-party cookies. Brands that have invested in tech alternatives to third-party cookies have not wasted their effort. Using first-party data for advanced audience modelling and enhanced conversions is incredibly powerful, future-proofed, and remains important for the future of marketing measurement.”
Paul Sinkinson, managing Director of Analytic Partners, agreed: “Consistent testing has shown that relying on cookie-based measurement for planning your media leaves a load of money on the table – and you could already be missing more than half the clicks and views anyway due to issues with third-party data."
Rory Heffernan, national managing director of Atomic 212, told Mi3 that planning for a cookieless future always involved a balance between providing better privacy controls for users and improving the efficacy of data used for advertising (i.e. targeting and reporting). And all this was happening in the context of Google protecting its revenue.
He said the announcement won't change the industry's broader trajectory, as so much outside of Chrome has already changed in the past 10 years – which means brands and the ad supply chain need to use a blend of approaches to deliver the best outcomes. "The complexities that marketers are grappling with around adtech, martech, privacy, and measurement will continue to be a moving target, and there's no single approach or technology that can replace all functionalities that cookies used to play in a more fragmented and privacy-conscious ecosystem."
Ben Combe, senior director of data, optimisation & personalisation at Monks (formerly Media.Monks) acknowledged that brands that have not advanced far with mitigation efforts to date might be tempted to treat the announcement as a lifeline.
"But in reality, it merely reflects a more gradual end to a long-running, multi-factored trend. Google will no longer be the executioner, but third-party Cookies are dying regardless – and their utility as the foundation of digital advertising’s targeting and attribution capabilities will not return (if it was ever truly there to begin with).”
*Post publication the CMA announced it was delaying the release of its report after learning of Google's announcement.
.png)