Tracking cookies are small text files that a website uses to collect and store data from its users, such as their browsing history, geographical location, purchase trends and more. A third-party cookie can follow a user across multiple websites and services to gather information and therefore, enable websites to target and personalise user experience and advertising.

Various regulations across the world (e.g. the GDPR, Privacy and Electronic Communications Regulations (“PECR”) and the California Consumer Privacy Act (“CCPA”) to name a few) require website owners to inform their users of what data is being collected by tracking cookies, how that data is being processed and provide the right to easily opt-out. In the UK and EU, users must give their prior consent before tracking cookies can be applied.

An expensive year for Google

As we predicted in our January 2022 article: Paying the Price for Cookie Indulgence, we have seen huge fines being issued by regulators to companies who fail to comply with cookie legislation, specifically user tracking practices.

French data protection regulator, CNIL, kicked off 2022 with a €150million fine to Google for failing to make it as easy for French users to reject all cookies as it was to accept them, and therefore in CNIL’s view, invalidating the “consent” on which Google relied upon.

In November 2022, a remarkable $391.5million settlement was reached with 40 US States over Google’s use of tracking cookies which trace users’ location, without their consent, and pass it on to advertisers. This was the largest multistate consumer privacy settlement ever. The Attorney-Generals of Washington DC and Indiana separately brought lawsuits against Google for similar allegations, and last month settled for $9.5 million and $20 million, respectively.

The top revenue source for Google’s parent company, Alphabet, is reportedly Google search ads and so even though 2022 has been a very expensive year for Google with multimillion-dollar fines, it is somewhat dwarfed by its annual revenue of $282 billion[1]. However, the surge of privacy lawsuits and regulatory fines is growing in number and size across the tech industry. The reputational damage following high-profile enforcement action will put pressure on the industry to take a look at their user tracking and targeted advertising practices.

Cookie phase out for 2023

Following CNIL’s fine, Google introduced a “reject all” cookie pop-up in March 2022[2]. The ICO, commented that “we expect to see the [online advertising] industry following Google’s lead to provide clearer choices for consumers.”

However, ensuring consumers are adequately safeguarded appears to be more technical than simply enhancing cookie consent mechanisms. Google has presented ambitious plans to remove third-party cookies from Chrome altogether by 2024 and instead rely on in-house tracking technologies (first-party cookies). Google’s Privacy Sandbox, Topics API, is a Google-led project under development, which intends to test out less intrusive advertising technologies using first-party cookies. The algorithm works within a user’s browser and classifies them within a set of broad interest groups (for example, sport or travel). It is thought that this high-level grouping can then be used for targeted advertising without compromising user privacy, nor breaching data protection legislation.

However, smaller companies may struggle to develop effective algorithms without the resources and requisite access to large volumes of first-party data that large tech companies, such as Google, have. It will therefore be harder for small companies to segment users to interest groups and create targeted ads. If companies are to survive the phase out, they will need to think of new ways for collecting more first-party data and become less reliant on third party cookies.  As suggested in a Bidnamic article[3], suggested tactics could include; producing newsletters which collect user data, or creating high-quality content for users to interact with on their websites.

It should be noted that Google’s phase out of third-party cookies in Chrome is not the end of user tracking. There are other persistent tracking technologies in play and user consent will continue to remain a vital requirement for tracking now, and in the future.

[1] Alphabet’s revenue for the twelve months ending 30 September 2022 was $282.113billion