Goodbye to cookies: Digital advertising’s leap in the dark

Can it be that it was all so simple then? Mozilla deprecated third-party cookies in its Firefox browser in 2018; Apple did the same for Safari in 2019.

In January 2020 Google announced it would deprecate cookies in the Chrome browser, and here we are, more than four years later. Deprecation has been postponed again and again. It’s now set to happen in the second half of this year — and indeed 1% of Chrome’s 2.65 billion default users have already been permitted to opt out.

It’s been one step forward, two steps back all the way for Google’s Privacy Sandbox, the initiative intended to devise new and privacy-compliant ways for digital advertising to operate on the open internet. Remember FLoC?

The latest steps back have featured an evaluation of the proposed Privacy Sandbox protocols by the IAB Tech Lab. It was not friendly. “(T)he changes mandated by Privacy Sandbox will require substantial development and infrastructure investment costs for both buy and sell-side technology companies. Additionally, operational, business, financial, and legal processes for brands, agencies, and media companies will need extensive reworking.”

Perhaps more threatening to Google’s roadmap, the U.K.’s Competition and Markets Authority (CMA) has said that Google must not deprecate third-party cookies until their concerns about competition have been resolved.

Where exactly are we with Privacy Sandbox? Can we take the looming deadline to find alternatives to third-party cookies seriously? And do we need to care anyway? We spoke with a number of interested parties, including the IAB Tech Lab, some of them on background, to figure out the lay of the land.

Why aren’t marketers prepared yet?

There’s a sense that brand marketers, still able to run cookie-based campaigns, are shrinking from the realization that the day will come when they just can’t do that anymore. Agencies too are likely to wait until their clients demand action. Generally, the agencies will entirely rely on tech companies doing something; but many say that’s not unexpected.

Marketers have other priorities — that’s perhaps an understatement. In some ways, it’s GDPR all over again, with a last-minute scramble once the regulation actually came into force. In comparison to managing the digital advertising ecosystem without cookies, however, GDPR seems to have been relatively straightforward.

There’s an argument to be made that people should already be managing without cookies, because they’ve already gone from other browsers. However, it appears that far less money is spent on Safari today because the CPMs are much less than Chrome’s. If all of the inventory became worth much less than it is now, many independent publishers will suffer.

With inventory from independent publishers becoming less valuable, where could budget be redirected? The answer is, perhaps, obvious: the walled gardens. That means money for Meta, of course, but also for Google. Google derives revenue from advertising on the open internet, of course, but they also own and operate two of the world’s foremost advertising properties in Google Search and YouTube — completely immune from any changes in how the browser works.

The opportunities with Google’s walled garden perhaps needs to be qualified. “While Google is obviously huge and gets a lot of the media spend,” said president and co-founder of analytics firm ChannelMix, Michelle Jacobs, “they’re not always the top performing. We see great click-through rates and conversion rates from Bing. As an advertiser, you don’t want to just be in the Google world, paying whatever premiums they are going to slap on things.”

“When I’ve heard people say this advantages Google,” mused Ken Weiner, CTO at contextual advertising platform GumGum, “I get the sense that what it means is, everybody else has to use this privacy sandbox but Google itself. With all its extensive reach and publisher properties, it hasn’t lost the ability to cookie people. You can still have first-party cookies, so a publisher can still target and build profiles against its own users.” (Weiner is an IAB Tech Lab board member but is not involved in the Privacy Sandbox evaluation process.)

For Bosko Milekic, co-founder and chief product officer at Optable, it’s better for independent advertising that there is an alternative to third-party cookies. “Google has access to more user data than the average independent advertising player, so in a world where there are no third-party cookies — and no alternatives, they’re actually better positioned than everybody else. The fact that there is an alternative being created, in spite of its utility imperfections, is certainly better than nothing.”

Some don’t care

There are operators in the advertising ecosystem who have already weaned themselves from third-party cookie reliance. GumGum, with its stake in contextual advertising, is one. Another is marketing analytics firm ChannelMix. “We have a solution that doesn’t rely on cookies,” said Jacobs, “so it doesn’t really matter to us what Google ends up doing.” Nevertheless, she views the Privacy Sandbox proposals as a step backwards. “Marketers aren’t going to be able to execute media like they’re doing today.”

Jacobs’ co-founder and ChannelMix CEO Matt Hertig believes that “straight-line attribution” based on cookie-tracking has actually been dead for years. “We’re excited because this is forcing the industry to adopt practical measurement strategies based around first-party data.”

Another agnostic player is Optable, the data collaboration and clean room vendor that was created in conscious anticipation of the deprecation of third-party cookies on Chrome. “We created Optable specifically to make it possible to do relevant advertising effectively without third-party cookies,” said Milekic.

The inadequacy of the testing period

The protocols in the Privacy Sandbox became available for testing in January this year. The problem that some experts see is that it requires large-scale adoption within the ad ecosystem for the results of the testing to be reliable. While it may be possible to test whether something technically works on this scale, it’s hard to evaluate the effects it would have when adopted across the ecosystem.

Said Weiner, “Some people have prototyped it and what I’ve heard is, it’s kind of working but the CPMs are lower. But when more people adopt it, we might get back up to normal levels.”

Milekic’s Optable has a direct integration with Privacy Sandbox and is one of the organizations involved in testing its capabilities. “We have some sense that it works for audience targeting; it’s designed to enable that kind of campaign to continue to run once cookies are gone. It’s still difficult to draw conclusions on performance, the reason being that the amount of inventory currently available to bidders such as Optable through the Privacy Sandbox mechanisms is quite limited.”

Optable is finding that the targeting and measurement mechanisms work. “But it’s still to early to draw definitive conclusions as to broad performance,” said Milekic.

By Q3, the 1% testing period will be over and Google will be able (CMA permitting) to roll out cookie deprecation everywhere without a clear idea of what will happen when it goes from 1% to 100%.

Policing by the CMA

Mozilla and Apple didn’t seem to have much trouble with regulators when they decided to deprecate third-party cookies. Maybe Google, and in particular Chrome, are just too big to avoid scrutiny. It was at the beginning of 2021 that the CMA began to take an interest in FLoC, the now discarded Privacy Sandbox alternative to cookie-tracking.

“The CMA was concerned that, without regulatory oversight and scrutiny, Google’s alternatives could be developed and implemented in ways that impede competition in digital advertising markets.”

CMA website

By summer of that year, Google had agreed to work with the CMA to develop a series of commitments that would guide Privacy Sandbox developments. How did that pan out? In February, the CMA published a report detailing its ongoing competition concerns regarding Google’s Privacy Sandbox, including:

• Google may continue to benefit from user activity data while limiting competitors’ access to the same data.
• Google’s ability to control the inclusion of adtech rivals on this list could advantage its adtech services.
• Publishers and advertisers may be less able to effectively identify fraudulent activity.

There will be an update on this at the end of April. The good news for Google is that at least the optics would be better if the CMA were responsible for moving the deprecation deadline back again.

ChannelMix’s Jacobs sees positive aspects to CMA oversight. “The fact that Google is being held to a standard and there is oversight there; the CMA is saying, what you’ve done so far puts you at a competitive advantage and we can’t have that. I think we’re going to see a trend of big media companies being held to higher standards, and that will lead to a better experience for users.”

Of course, it’s also not too late for other regulators to step in, of course. It may be that the European Union is in wait-and-see mode.

Criticism from the IAB Tech Lab

Most discussion around cookie deprecation has focused on advertisers losing the ability to track and target individuals (and publishers’ inventory, as a result, becoming less valuable). There is a dawning realization, spurred by the Tech Lab’s critique, that there are deeper problems. Measurement, for example, is likely to be upended by these changes.

It seems clear from the Tech Lab’s report that some of the features and protocols are not working as intended. It may be that some of them haven’t been adopted at a level that would be necessary for them to work as intended. The Tech Lab is focused on the need for solutions that allow funds to continue to flow effectively and measurement to be possible.

The nuts and bolts

We spoke with Shailley Singh, EVP Product and COO at IAB Tech Lab, to get a better feel for what had happened.

The task force to evaluate Privacy Sandbox convened some time last summer, the APIs and definitions having reached what Singh viewed as a fairly stable state. “The first objective was to evaluate the Privacy Sandbox capabilities against day-to-day business use cases. We filtered out the use cases we knew would not be possible under the new privacy paradigm — like cross-site tracking. We also decided we would not hold Privacy Sandbox to a higher standard than what programmatic currently allows you to do.”

Google has a long track record of IAB Tech Lab board membership and working group participation. Singh said that some of the task force’s work took place without Google’s participation as it was important that members be able to speak freely, but that Google will participate going forward.

Google pushed back firmly against the Tech Lab’s initial assessment. “We have just started reviewing [the response],” Singh said. “We gave this report to Google two weeks before we released it; we thought they could give us clarification before we published, but it’s a big report. We wanted to keep to our timeline, given the timeline that’s laid out for cookie deprecation by Google and the CMA. They responded pretty quickly afterward because they already had it before.” The task force will now review feedback from various sources, including Google.

Singh described the Protected Audience feature in Privacy Sandbox as a challenge. “You can’t just shoehorn or plug in your current audiences. You will be required to do a lot of rethink on how you build those audiences, what kind of data is going to be available and how you measure performance. These aren’t simple things you can figure out in two weeks; it’s going to take some time.” And yet he views Topics as one of the simpler APIs.

Could marketers just run away from these challenges and look at opportunities with alternative identifiers or contextual advertising? “That is already happening,” said Singh. “A lot of companies have come up with innovations like these ID solutions and data clean room solutions where you can activate matched audiences. Contextual advertising has always been there, but now there’s a need to use it. Publishers of a critical size can use their own audience segmentation.” The latter approach would leverage first-party data.

“The cookieless world will bring a portfolio of solutions,” Singh said. “There’s going to be some degradation,” said Singh, initially at least. “ID solutions may not have the same scale third-party cookies have. But we’ll have to see what happens.”

The IAB Tech Lab is also cognizant of the regulatory issues raised by the CMA. “With Sandbox, there’s an ad seller and an exchange built into the browser which means that you’re not just getting a simple feature, you’re actually getting into the layer of the application itself, especially with the exchange which will control the financial transactions and make decisions on winning an auction. These things are typically governed by contracts with sequential liability, so what is the alternative to that? Even reporting is now going to be done through the browser.”

From the perspective of Optable’s Milekic, the Tech Lab sought to test whether the Privacy Sandbox protocols could achieve the same outcomes as third-party cookies; and that was unfair. “It’s a radically different mechanism by design. If you’re trying to protect users privacy through technical means, part of doing that requires you to limit the purpose for which data is used. What’s really important for the industry is whether the Sandbox mechanisms enable fair play and fair competition.”

Dig deeper: What can identity resolution platforms do for marketers?

Should we put it into context?

Recently we asked Tara DeZao, product marketing director for adtech and martech at Pega, where she would place her dollar if asked to bet on the most promising alternative to third-party cookies.  “Contextuality and real-time data — like, the freshest possible data,” she said. Of course, real-time behavioral data to prompt next-best-actions is Pega’s stock-in-trade. Similarly, GumGum is precisely a contextual advertising platform, so no question what they would favor.

“We’ve been promoting this idea of ‘mindset,’ which is a little bit synonymous with contextual advertising,” said Weiner. “Essentially the approach is to focus on what somebody is thinking about, what mindset they’re in as they’re consuming content as a way of targeting, and not so much what do we know about you and what have you done in the past.”

That makes GumGum something of a detached observer when it comes to the deprecation of third-party cookies. In fact, it could surely only benefit if Privacy Sandbox is not the answer to a cookieless world.

“Maybe I am rooting for them to fail a little bit,” Weiner said, smiling.

What happens next?

Perhaps the most anxiety-inducing aspect of the state of play is that nobody really knows what happens next.

The IAB Tech Lab will issue a final version of its evaluation, taking into account feedback from Google and other parties. The CMA will make some determination about whether Google is permitted to deprecate cookies on Chrome. The Tech Lab has no power to prevent Google from making the leap. Let’s say the CMA withdraws its objections. As observed above, we then go from one percent to 100% deprecation overnight.

Digital advertising on the open internet steps out of the plane and the smartest people in the ecosystem, likely including the Privacy Sandbox team, is not sure if the parachute will open.