‘Cookies’ track your every move online. Now there’s a fight over what should replace them

For decades, “cookies” have been tracking you around the web. They’re the snippets of code that uniquely identify your browser and allow those shoe ads to follow you from site to site after you visit an online storefront. Soon, their time may be up.

Third-party cookies have increasingly fallen by the wayside as the public has become more protective of privacy rights in an age of algorithms and data. Some major browsers including Firefox and Safari now block third-party cookies by default, further reducing their usefulness to advertisers. And Google has already said it’s planning to do the same in its browser, Chrome.

But last week Google went further, announcing it will soon stop tracking individual people’s web browsing altogether for advertising purposes when Chrome finally drops third-party cookies.

If that sounds like a big deal, that’s because it is. In a blog post explaining the change, Google said that once tracking cookies are eventually blocked by default on Chrome, the company won’t build or support browser technology designed to perpetuate individual-level data tracking. The announcement laid out Google’s intentions for what comes after the death of the third-party cookie, something it and many others in the industry had been anticipating for years.

The future of tracking-based web advertising, Google argued, will be more abstract, relying less on an individual’s browser history and more on what groups of internet users may be viewing at any given time.

Given Google’s enormous role in the advertising world and its control of the world’s most popular web browser, the company has the potential to determine how the next generation of ad technology works. But Google’s vision is not the only one. Sensing that change may soon be on the horizon, privacy advocates and others in the industry have put forth different ideas about how the future should unfold. At the same time, policymakers are erecting new regulations and questioning Google’s dominance in ways that could have a significant impact on the company’s ability to carry out its plan.

A more anonymous way of tracking?

To understand what Google’s pitching, it helps to think about Facebook.

Facebook also makes its money by serving ads. It doesn’t directly sell user information to advertisers; instead, it offers advertisers the opportunity to target ads to certain categories of Facebook users based on that data. Slicing and dicing people’s identities by their relationship status, the pages they’ve liked and even the content they click lets Facebook sell access to highly specific groups.

The system being developed by Google and others in standards-setting forums is based on the same principle, according to policy experts. Brands would be able to advertise to “cohorts” of internet users who share similar traits as defined by an algorithm. But unlike today, the marketers wouldn’t have access to specific data about individual members of the cohort.

The approach being championed by Google would theoretically give users more power than Facebook’s model. Rather than centralizing all user data under one roof, internet users’ web history would remain stored in their own browsers or on their own devices. Depending on which version of this idea is implemented — there are many — users could have settings that let them control what information their browser shares with the world. Ads for shoes and camping gear might still follow you around the internet this way, but advertisers would now be blasting those ads to you and thousands of others as a group, not as an individual.

That concept, which Google is currently testing, is designed to take the place of third-party tracking cookies, which can track you from site to site and develop a highly detailed picture of your browsing history for advertising purposes.

“It fundamentally creeps people out,” said David Chavern, president and CEO of the News Media Alliance, a trade association representing news publishers. So if you’re a tech giant like Google whose business depends on user tracking, Chavern said, “you want to be ahead of these curves.”

Privacy advocates are wary

Google says its vision of the future helps improve user privacy while still offering advertisers the same ability to target audiences.

“Advertisers don’t need to track individual consumers across the web to get the performance benefits of digital advertising,” the company argued in its blog post. “Advances in aggregation, anonymization, on-device processing and other privacy-preserving technologies offer a clear path to replacing individual identifiers.”

Some privacy experts agree that the Google-backed proposal would be an improvement over the status quo — at least in theory.

“For me, it’s a good step and a good signal, but I’d want to see the final package of solutions,” said Ashkan Soltani, an independent privacy and security researcher and a former chief technologist at the Federal Trade Commission.

One of the most important factors to watch, Soltani said, is how the user controls are designed. Do they offer a one-click mechanism for users to opt out of all data sharing? Can users pick and choose what types of data to share with advertisers? Are the controls easy for an average person to find and use?

Others are more skeptical, arguing that the proposal just trades one form of invasive monitoring for another.

“Google, please don’t do this,” wrote the Electronic Frontier Foundation, a digital rights group, in a blog post. In the post, EFF technologist Bennett Cyphers argued that, depending on how small each cohort is and the ability for clever companies to cross-reference that data with other available information — such as your email address — it may well be possible for third parties to figure out who you are, anyway.

“We should imagine a better world without the myriad problems of targeted ads,” Cyphers wrote.

What the ad industry wants

Some in the advertising industry are working on an alternative to Google’s approach.

A competing standard being developed under the Partnership for Responsible Addressable Media — a group comprised of the Interactive Advertising Bureau Tech Lab, many ad-tech companies, Unilever, Ford, IBM and others — would replace cookie-based tracking with tracking that’s tied to individual email addresses. Whenever you log into a participating site with your email address, that address would then be used to keep tabs on you as you navigate to other participating sites. The email addresses would be scrambled, so in theory internet users would remain anonymous to advertisers while still being trackable for advertising on an individualized basis.

“The Google announcement has not changed our plans to provide a new portfolio of approaches to addressability, with privacy and with auditable accountability,” said Bill Tucker, the executive director of PRAM, in a statement responding to Google’s blog post.

Without naming PRAM, Google has called the email-based approach impractical.

“We don’t believe these solutions will meet rising consumer expectations for privacy,” it said in its blog post, “nor will they stand up to rapidly evolving regulatory restrictions, and therefore aren’t a sustainable long term investment.”

Privacy and policy experts have also criticized the email-based approach. As with other forms of purportedly “anonymized” data, they said, it’s trivial to reverse-engineer a person’s identity by combining scrambled information with other publicly available data.

In some ways, they added, using scrambled email addresses is even worse from a privacy perspective than using cookies, which can at least be easily cleared from a browser.

“I have the same personal email address from the late ’90s,” said Jason Kint, the CEO of Digital Content Next, a trade group representing digital publishers. “It’s nearly impossible to purge. So it’s a fallacy that some hashed email is going to be more private than a cookie.”

Google’s new solution could make it more powerful

Even though it’s moving away from the third-party cookie, that doesn’t mean Google has become consumers’ knight in shining armor. As the company faces multiple antitrust lawsuits by state and federal officials over its dominance of search and advertising, the Google-backed tracking proposal is being scrutinized for the way it could further entrench the company.

Even if Google’s proposed standard takes off, the company could seek to maintain its own access to the data that’s become inaccessible to websites and advertisers, privacy critics worry, because Google makes smartphones, the Android operating system and the Chrome browser. Android phones account for over 70% of the global smartphone market and Chrome captures 66% of the market for browsers, according to Statcounter.

“Google’s the biggest tracker of any company on the internet,” said Kint. “They’re competing in the same marketplace where they’re designing the rules.”

Google’s control over major technology products and its ability to crunch data at scale give it immense advantages — and an incentive to abuse them, Soltani agreed. If Google moves to keep a home-court advantage of sorts, that could bolster the outcry from Google’s antitrust critics, he added.

Still, he said, “what the defaults are, what the controls are, I think, will ultimately dictate how actually sincere Google’s push is.”

Google told CNN Business that under its proposal, the advertising giant would not enjoy any special access to browsing data. Google will only be able to see the same aggregated information as the rest of the market, the company said. But the company did not rule out matching browsing cohorts with the enormous amounts of data that Google collects on the individual users of its many products and services.