Google is halting its 4-plus-year plan to turn off tracking cookies by default in Chrome

Google has an announcement today: it’s not going to do something it’s been thinking about and tinkering with for quite some time.

Most people who just use the Chrome browser, instead of developing for it or trying to serve ads to it, won’t know what “A new path for Privacy Sandbox on the web” could possibly mean. The very short version is that Google had a “path”, first announced in January 2020, to turn off third-party cookies (ie tracking) in the most used browser on earth, bringing it in line with Safari, Firefox and many other browsers. Google has proposed several alternatives to cookies that follow you from page to page, constantly putting you on that heater you were looking at three days ago. Each of these options has faced varying degrees of opposition from privacy and open web advocates, trade regulators and the advertising industry.

So instead of turning off third-party cookies by default and implementing new solutions in the Privacy Sandbox, Chrome will “introduce a new experience” that lets users choose their tracking preferences when they update or use Chrome for the first time. Google will also continue to work on its privacy sandbox APIs, but in a way that recognizes “the impact on publishers, advertisers and everyone involved in online advertising.” Google also didn’t fail to mention that it was “discussing this new path with regulators.”

Why today? What does that really mean? Let’s review more than four and a half years of Google’s efforts to replace third-party cookies, without deeply jeopardizing its position as the world’s largest advertising provider.

2017-2022: FLoC or “What if machines tracked you, not cookies?”

Google’s big move toward stagnation likely began at Apple’s headquarters. Its operating system updates in the fall of 2017 implemented a 24-hour time limit for ad targeting cookies in Safari, the default browser on Mac and iOS devices. A “coalition of major advertising associations” issued a sternly worded letter opposes this change, saying it would “drive a wedge between brands and their customers” and make advertising “more generic and less relevant and useful.”

In the summer of 2019, Firefox was ready to simply block tracking cookies by default. Google, which does the vast majority of their money through online advertising, done another, broader argument against losing cookies from third parties. To paraphrase: Trackers will track, and if we don’t give them a proper way to do it, they’ll do it the dirty way by fingerprinting browsers based on version numbers, fonts, screen size, and other identifiers. Google said it had some machine learning that could figure out when it was Good to share your browsing habits. For example:

New technology that Federated learning show that it is possible for your browser to avoid revealing that you are a member of a group that likes Beyoncé and sweater vests until it can be sure that the group contains thousands of other people.

In January 2020, Google changed its argument from “together with” to “instead of” third-party cookies. Chrome Engineering Director Justin Schuh wrote, “Building a more private web: A path toward making third-party cookies obsolete“, suggesting that broad support for Chrome’s privacy sandbox tool would make it possible to completely remove third-party cookies. Privacy advocate Ben Adida described the move as “giving teeth” and “a big deal.” Feedback from W3C and others parties, Schuh wrote at the time, “gives us confidence that solutions in this space can work.”

As Google developed its replacement for third-party cookies, the road became more difficult and the space more dangerous. The Electronic Frontier Foundation described Google’s FLoC, or “Federated Learning of Cohorts” that would let Chrome machine learn your profile for websites and ads, as “A terrible idea.” The EFF was joined by Mozilla, Apple, WordPress, DuckDuckGo and many browsers based on Chrome’s core Chromium code by being either opposes or is non-binding to FLoC. Google pushed back testing FLOC until the end of 2022 and removal of third-party cookies (and thus FLoC implementation) until mid-2023.

In early 2022, FLoC had no way forward. Google pivoted to a Topics APIwhich would give users a bit more control over what subjects (“Rock Music”, “Auto & Vehicles”) would be transferred to potential advertisers. It would certainly improve over third-party cookies, which are largely inscrutable in naming and offer the user only one privacy policy: block them or delete them all and lose tons of logins.