Why is Google no longer deprecating cookies?

As most of you probably already know, Google announced that they no longer plan to deprecate third-party cookies in Chrome. The brief blog post was scant in detail but did provide a couple of nuggets of information:

We have two sentences to predict the future of advertising technology on the web as we know it. We now know that Google is not deprecating cookies but will instead allow users to opt-in to allow cookies through some yet-to-be-determined consent workflow in Chrome.

What about the countless hours and capital poured into supporting the Privacy Sandbox? Will all the companies who rushed to support Google's overly complex and possibly disingenuous endeavor have to throw out years of product development? Fortunately for them, the answer is no for now.

Google is not giving up on the Privacy Sandbox:

The companies attempting to leap ahead of the competition by supporting the Sandbox in its infantile state can all take a collective breath. If Chrome implements an opt-in workflow for cookies, then the assumption is that the Sandbox will be one of the best options for effectively monetizing opted-out users.

Why isn't Google eliminating Cookies?

For anti-competition reasons, Google has faced pushback from regulators and the ad tech industry on the Privacy Sandbox. Testing has revealed that the Privacy Sandbox will negatively impact web advertising, with some tests showing up to 60% revenue loss.

If open web advertising becomes less effective, advertiser spend will flow straight into more effective locations like Google search and Google-owned YouTube. So Google is leveraging its ownership of the world's most popular web browser to enrich its other business lines at the expense of its competition.

Google is even setting fire to web advertising while they watch their network business burn. Google's cookie-dependent network business (which happens to be their lowest-margin advertising business) continues to decline as higher-margin search and YouTube revenue continue to grow.

Since Google is forcing everybody into a worse advertising solution, it is catching flak for deprecating cookies entirely.

So, how does Google avoid anti-competition concerns while still achieving its goal of deprecating cookies? Let the users deprecate them!

Some genius at Google came up with the idea of giving users the choice of deprecating cookies, which will undoubtedly lead to most users opting out of cookies anyway while simultaneously placating regulators and privacy advocates.

If the majority of users opt out of cookies, Google can cripple open web advertising (driving revenue to Google Search and YouTube) and posture itself as a glorious purveyor of privacy for users — all while skirting anticompetitive concerns — "we didn't deprecate cookies, users did!"

So Google is no longer deprecating cookies in Chrome — but they may become effectively deprecated depending on how Google implements its new cookie consent workflow (more on that below).

The Future of the Privacy Sandbox

The Privacy Sandbox is alive and well, for now.

However, two burning questions will dictate how ad tech companies and publishers should act now and direct investments into the Privacy Sandbox.

1. What will the Chrome cookie consent experience look like?

2. When will Chrome implement this new consent workflow?

How Chrome implements the consent experience will directly affect the percentage of users who allow third-party cookies.

We don't yet know if Chrome will have a universal opt-in experience for all websites or will take a more Apple App Tracking Transparency (ATT) approach and ask users for each website (and save those preferences indefinitely).

My money is on a blended approach. I think Chrome will give users the option to:

1. Universally opt out of cookies (default)

2. Pick and choose by website (ATT-style)

3. Universally opt-in to cookies

I believe a universal opt-out will be the default choice (or at least the first choice in an options list) since it is best for Google's business and the most privacy-conscious "user-friendly" option.

If Chrome offers an ATT-style website-by-website approach, opt-in rates will highly depend on the UX and language used.

Apple infamously uses harsh language in a mandatory system dialog to gather user consent to access the equivalent of a cookie on iOS devices (IDFA).

The word "track" immediately evokes negative connotations, which consequently led to 76% of users in the United States opting out in 2023.

However, it is worth mentioning that opt-in rates vary widely by app category and have climbed globally Year over Year.

• April 2021: 5%

• May 2021: 16%

• EOY 2021: 25%

• 2022: 29%

• 2023: 34%

And we are continuing to see this trend quarter over quarter:

This rise in opt-in rate is because developers are getting more thoughtful about how they implement iOS consent workflows. They have the opportunity to plead their case to users before the dreaded tracking dialog pops up, and clearly, they are figuring out what gets users to fork over their precious IDFA.

But the main driver of opt-in rates will be the language Google uses in the workflow, as Terence Kawaja points out on X:

Jokes aside, everybody will be putting whatever language Google uses in their consent experience under a microscope, as the use of a single word like "tracking" could have significant repercussions on the opt-in rate.

So, will web publishers have to begin begging users to allow cookies? Will they even have the opportunity? Will websites start denying users access if they don't accept cookies?

Apart from pissing off users, denying access to websites based on the acceptance of non-essential (advertising) cookies in the EU may be a violation of the GDPR. But who knows what this Chrome workflow could open the door to in the US — so Google's decisions could have further knock-on effects on standard web UX.

Any site-by-site approach will most likely lead to a consolidation of publishers, with users more likely to opt in to more frequently used and known "premium" large publishers and brands rather than smaller pubs. Google would relegate long-tail pubs to using the objectively worse Privacy Sandbox APIs instead of cookies to monetize anonymous users.

We have no idea when this will go down, further complicating how companies will approach the Privacy Sandbox from here.

Will Google apply its previous early 2025 cookie phaseout timeline to this new consented approach? Nobody knows, but business leaders will need to decide if throwing potentially millions of dollars at an unclear problem and even more nebulous solutions are worth it at this current point in time.

A Better Solution

This new announcement will delay the adoption of Privacy Sandbox APIs without further guidance on a rollout date.

The extreme complexity and investment required to integrate the Privacy Sandbox into the ad stacks, reporting workflows, and operations are already monumental efforts, and this announcement introduces more uncertainty to a notoriously delayed and haphazard project.

I will relent that using cookies to facilitate advertising is as user-hostile as using an IP address. Developers of these features never intended for ad tech companies to use them as advertising identifiers, and they remain surreptitiously used by ad tech companies to facilitate data-driven audience targeting.

But, the Privacy Sandbox + cookies is not the correct solution. Rather than forcing the entire digital advertising industry to adopt a needlessly complex menagerie of new APIs, why not take a page from a simple feature leveraged across mobile and CTV? Use a device ID, or in this case, a browser ID.

I tweeted this back in April:

If Google embraces a consented-style approach anyway, why not create an ID tied to the Chrome browser?

Ask users on each site if they want to allow the website to access their browser ID to facilitate personalized advertising and support the free and open web. You can also allow the user to reset the ID at any point, forcing all websites to universally "forget" the user and make them anonymous again.

Ad tech vendors will barely have to lift a finger as they can easily retrofit this approach into existing ad-serving systems that support user identifiers. We could also once and for all eliminate the ridiculous and latency-inducing process of cookie syncing and unify how base-level identity works across all platforms.

This approach will still achieve Google's goal of stymieing competition while establishing Google as a paragon of privacy on an equal footing with Apple. They can then implement a similar ATT-style strategy on Android, putting to bed any speculation on what they will do with device IDs on Android (GAID).

They could also continue to dilly-dally with the Privacy Sandbox on the web and Android to help the plebians monetize opted-out users, which would be seen as a sign of goodwill toward the ad industry and further cool anticompetitive concerns.

But for now, it seems Google has masterfully figured out how to deprecate cookies without actually deprecating cookies themselves while inflicting maximum pain on publishers and vendors. I believe their goal remains to eliminate cookies for as many users as possible, but continued regulatory pressure may dictate how far they can push users to opt-out.

So here we are again, four years after Google first announced the Privacy Sandbox, and we are yet again floating through a liminal space of uncertainty. The fate of a $225 billion industry remains subject to the capricious whims of a few decision-makers at a single company, and all we can do now is wait for their next move.