Google plans to scrap third-party cookies by 2022 — here’s why it’s problematic
Cookies to cohorts
The traditional web tracking and targeting method uses so-calledcookies: small files stored by web browsers such as Chrome. Their original purpose was to retain information – such as the items you’ve added to online shopping carts, for example – between browsing sessions. This was seen as useful for consumers.
Nowadays, cookies mostly serve advertising interests. On Chrome, third parties use cookies to track you across the web, amassing enough data on your browsing habits to target you with highly specific adverts.
In recognition of how invasive this tracking has become, theEU’s data protection lawsclass cookies as “online identifiers,” subject to regulations that require websites to gain your consent before issuing cookies to your browser.
Google’s new system for Chrome will abandon that. The browser will instead use your recent browsing history to generate your “cohort identity.” That’scurrently achievedby using a “simhash,” which in simple terms generates “magic numbers” to represent your interests before grouping you with those in possession of similar numbers.
Hidden within a cohort of a few thousand individuals, you’ll then have adverts targeted at your cohort, rather than you as an individual. This is presented as aboost for privacy, as it moves away from the individualized tracking and targeting that made third-party cookies particularly invasive.
Towards Facebook’s model
Conceptually, Google’s proposed system isn’t new – it is a form of profiling, which enables an advertising model that Facebook has been using for some time. Targeting someone’s cohort identity is just like creating a “Lookalike Audience” based on one individual, which is a service Facebook currently offers advertisers.
We should expect profiling to also create a number of different named cohorts, from which advertisers can createCustom Audienceswith mixed interests – something that Facebook also offers.
This is where profiling becomes problematic. In 2016, it was revealed thatFacebook allowed housing advertisersto exclude users based on race. Even after Facebook made changes to its audience groupings, it was still possible for advertisers to discriminate based onsensitive interestsheld predominantly by minorities.
Profiling involves machine-learning algorithms and AI technologies which have repeatedly been shown toreinforce real-world bias. As such, Google’s decision tosack key members of its AI ethics teamjust as Chrome is adopting a profiling advertising model appears particularly alarming.
Aside from the known harms and risks of profiling, it’s unclear how Google’s new model enhances individual privacy. For the system to work, Chrome must freely volunteer your cohort identity to any website you visit, whereas a third-party cookie doesn’t reveal that volume of data to all websites.
The smaller cohorts get, meanwhile, the easier you’ll be to spot within them. And you’d expect Google to favor smaller cohorts, seeing as larger cohorts naturally reduce the accuracy of targeted advertising. Overall, the change will introducea number of new risksfor privacy and discrimination. So why else might Google have chosen to scrap third-party cookies on Chrome?
Google’s mixed motivations
One reason is regulation.The EU’s new ePrivacy directivemay well move to abolish the traditional use of tracking cookies within the EU anyway, with far-reaching consequences for other jurisdictions. So Google may simply be jumping before being pushed.
By restricting howthird-partyadvertising services can use Chrome, Google may be set to benefit by stifling competition, too. An interest group for online advertisers has already asked the UK’s competition watchdog to account for the Chrome change as part of its existingprobe into Google’s advertising practices. Google itself will retain ample tracking possibilities after the change, particularly when Chrome users are logged in to their Google accounts.
Google is the biggest beneficiary of Chrome’s move from cookies to cohorts. Framed as a privacy boon, Google’s new system only mildly restricts its traditional targeted advertising reach, while adding Facebook’s profiling-based mode of advertising to its repertoire.
End users like you and I, meanwhile, are unlikely to notice any difference whatsoever. We’ll still be watched and targeted based on our online activity – only now as part of a group, rather than an individual.
This article byEerke Boiten, Professor of Cybersecurity, School of Computer Science and Informatics,De Montfort Universityis republished fromThe Conversationunder a Creative Commons license. Read theoriginal article.
Story byThe Conversation
An independent news and commentary website produced by academics and journalists.An independent news and commentary website produced by academics and journalists.
Get the TNW newsletter
Get the most important tech news in your inbox each week.
