Storm Erupts Over Google’s Advice Against Blocking Cookies

Google’s recent announcement of Privacy Sandbox — an initiative to develop a set of open standards geared toward fundamental enhancements of privacy on the Web — has stirred up a controversy.

Blocking cookies is not a good idea for a number of reasons, and standardization of such efforts is needed, argued Justin Schuh, director, Chrome Engineering in an online post.

Google invited the Web community to comment on several ideas in its Privacy Sandbox proposal, including these three:

• Ad Selection — including the potential use of Federated Learning of Cohorts (FLoC) technology, which suggests changing the basis of interest-based online ads from observing individuals’ browsing behavior to observing the behavior of a cohort, or group, of similar people;
• Conversion Measurement — a potential new Web platform feature for measuring and reporting ad click conversions; and
• Fraud Prevention — including the potential use of Trust Token API, which would allow propagating trust across sites using the PrivacyPass protocol;

“Rather than presenting a coherent vision for user privacy, Google doubles down on its tracking business model and tries to defend it,” noted Bennett Cyphers, staff technologist at the Electronic Frontier Foundation.

That said, the Trust Token API “is a privacy-preserving way to help users avoid filling out crazy amounts of captchas,” he told the E-Commerce Times.

The proposal for privacy budgets “is also exciting,” Cyphers said. The conversion measurement API “is a decent form, but in its current form, it would allow advertisers to uniquely identify individual users and potentially learn about their browsing habits.”

FLoC “is nothing but a way to make behaviorally targeted advertising easier,” Cyphers pointed out.

However, without tracking of some kind, both the consumer and the advertiser lose value, observed Rob Enderle, principal analyst at the Enderle Group. “Google lives off that value so this is self-serving.”

That said, “what we have isn’t working, so there needs to be another path and this, at least, shows potential to become that alternative path,” he told the E-Commerce Times.

What Google Said

Large-scale blocking of cookies undermines people’s privacy by encouraging opaque techniques such as fingerprinting, Google’s Schuh wrote. Efforts by other browsers to block cookies resulted in unintended consequences due to the lack of standards.

Fingerprints subvert user choice because they cannot be cleared, unlike cookies, so consumers cannot control how their information is collected, Schuh pointed out.

“The idea that blocking cookies will somehow be bad for user privacy is completely absurd,” observed the EFF’s Cyphers.

“Third-party cookies are far and away the most common tracking method on the Web,” he said. “Even though Firefox and Safari have severely curtailed advertisers’ access to cookies, browser fingerprinting remains relatively rare.”

Other browsers, like Tor and Safari, “have already made great strides towards shutting down common fingerprinting techniques, and Google could do the same if it chose,” Cyphers pointed out.

Google “make money off advertising, and Apple and Mozilla largely don’t,” Enderle said. “It’s easy to give something up that doesn’t make you money.”

Criticisms of Google’s Proposal

Google’s arguments against blocking cookies are disingenuous, according to Arvind Narayanan and Jonathan Mayer, who deconstructed and criticized its Privacy Sandbox proposal.

In sum, these are their arguments:

• Cookie blocking does not undermine Web privacy, and Google’s claim to the contrary amounts to privacy gaslighting;
• There is little trustworthy evidence on the comparative value of tracking-based advertising;
• Google has not devised an innovative way to balance privacy and advertising. Instead it has latched onto prior approaches that it previously dismissed as impractical; and
• Google is attempting a punt to the Web standardization process, which will at best result in years of delay.

Safari’s Intelligent Tracking Prevention and Firefox’s Enhanced Tracking Protection, are “laudable privacy features,” according to Mayer and Narayanan.

Privacy-preserving ad targeting has been an active research area for more than a decade. Mayer repeatedly pushed Google to adopt these methods during the Do Not Track negotiations held between 2011 and 2013, but was turned down, Mayer and Narayanan contended.

The standards process requires “significant thought, debate, and input from many stakeholders,” and it generally takes multiple years, Google’s Schuh acknowledged.

It’s the Revenue, Stupid!

Blocking cookies “significantly reduces publishers’ primary means of funding,” Schuh argued. An in-house study on Google Ad Manager data found ads get 52 percent less revenue when cookies are removed.

However, publishers’ revenues increase by only about 4 percent when cookies are used, a university research paper suggests. That “corresponds to an average increment of just $0.00008 per advertisement.”

Further, some of the revenues associated with cookies could, in theory, originate from winning bids by merchants, who choose not to behaviorally target their ads, according to the researchers.

The Burning Question of Privacy

Browsers were supposed to block third-party cookies, as per the original tech specs for cookies — RFC 2109, Section 4.3.5.

However, “Google starts with the premise that advertising is necessary, which puts privacy at a disadvantage from the outset,” noted Steve Wilson, a principal analyst at Constellation Research.

Google “start from an inherently invasive and covert business model, and try to retrofit something they call ‘privacy,'” he told the E-Commerce Times.

If Google executes its plan properly, consumers will see better ad targeting, advertisers will see better returns on their ad dollars, and publishers could conceivably benefit somewhat, Enderle suggested, “but all this suggests Google executes, and I have severe doubts it can execute here, as it traditionally lacked the behavioral skills to make an effort like this successful.”