Google won't ditch third-party cookies in Chrome after all
In some ways, this is a loss—tracking cookies are undeniably terrible, and Google's proposed alternative is better for privacy, at least on paper. However, universal adoption of the Privacy Sandbox could also give Google more power than it already has, and the supposed privacy advantages may never have fully materialized as Google continues to seek higher revenue.
Cookies are much maligned these days, but to defend them a little bit - the alternatives are almost universally worse for user privacy. Persistent session storage? Browser fingerprinting? Locking everything behind a user account with mandatory sign-in? Blegh.
On the other hand, cookies are a pretty transparent interaction. It's a tiny file that sites in your browser. You can look at them. They expire on their own. You as a user can delete, modity, edit, hack them to your heart's content. They contain no PII on their own. They are old-fashioned and limited and that's a good thing.
The real problem here is not the cookie - it's the third party data networks. I would much rather focus our ire on the function rather than the form.
But third party cookies are a lot more insidious, because they get sent without any visibility to the user and have generally peripheral relevance to the application they are using. It's like if you go to the supermarket and they ask you if you want to sign up for a loyalty card and you say yes, vs you go to the supermarket and they secretly plant trackers on you so that when you go to other shops they can tell who you are. One is a lot worse than the other.
Any website can add Google Analytics by copy and pasting 1 line of code. To avoid this cookie, you need to have your own analytics web app. This makes sense for medium-size websites, but if you have a small website your host will probably bill it as a separate website.
First-party comments? Now you need your own comment system, which means you have a long list of responsibilities that you simply wouldn't have if you just used Disqus or Facebook comments. All those spam links to virulent sites will be on your servers now.
Honestly, the Internet would be a much more awesome place if 3P cookies were the norm and everyone was okay with embedding everything everywhere. In the past hotlinking was a problem due to bandwidth concerns, but nowadays most of the traffic is bots anyway so it would be a drop in the bucket.
First-party comments? Now you need your own comment system
This is incorrect. Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once.
Any website can add Google Analytics by copy and pasting 1 line of code.
Again incorrect. Google Analytics doesn't need 3P cookies to count the number of visitors. Without 3P cookies it is just harder to correlate visits across different websites, which is what website owners don't really need, why are you supposed to know what competitor sites your users visit? None of your business.
And for cross-site authoriation there are standards like OpenID. So we could disable 3P cookies right now and Internet will work just fine.
Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once.
I feel like I don't understand what a 3P cookie is, then. Isn't Disqus a third-party service? Doesn't it use a cookie to know you have signed in?
If you put a Disqus comment form or Google Analytics in your website, wouldn't you need a cookie popup to comply with GDPR and similar regulations that regulate sending user data to third-parties?
Is 3P cookie supposed to be about the domain of the cookie? But then can a script from one domain like GA set a cookie in a different domain like of a website that uses GA? That doesn't sound right, considering you can't do this server side.
Can you help me understand how would it work for it not to be a 3P cookie?
Isn't Disqus a third-party service? Doesn't it use a cookie to know you have signed in?
Let's say Disqus JS code is embedded on a site A. Then it can set cookies for that domain. So when you enter your Disqus login and password on site A, it can send a request to Disqus server, obtain authorization token and save it in cookies for domain A. This way you will be recognized every time you visit site A.
This means that operators of site A may access those cookies too, but I don't see any problem here - it's their site anyway.
If you put a Disqus comment form or Google Analytics in your website, wouldn't you need a cookie popup to comply with GDPR and similar regulations that regulate sending user data to third-parties?
Probably you need.
Is 3P cookie supposed to be about the domain of the cookie?
3P cookie means that when site A includes content from site B (image, iframes) then the browser will send domain B's cookies with the request for that content. This means that if content from site B is included on 100 different websites, site B can track the user across them using cookies.
So when you sign into Disqus, it can recognize (and track your actions) you on any site using Disqus widget.
When 3P cookies are disabled, requests for content embedded from other sites like B, will be anonymous and without cookies. You will have to log into Disqus for every site where you want to leave a comment.
I've always found the negative effects of 3P cookies, the creepiness of being logged in on every site and ads following you around, to be symptoms of other problems (using the same browser profile for everything you do, a culture of not paying for websites so they have to rely on ads for monetization), so I'm not sure if this is a great solution to the actual problems.
But I guess it does make the internet better for the average person.
You as a user can delete, modity, edit, hack them to your heart's content.
This is not true in practice though. Cryptography means they cannot be altered (or even read) if their creator doesn't want them to be altered. Of all the CRUD operations, users can only realiably delete the cookie.
One of the best authentication libraries at the time.
It's still hard to trust them today, for me at least.
You may need JWTs or their moral equivalents for 3rd party services but, especially for 1st party services, session identifiers are a fine enough scheme that are oftentimes implemented more securely and have the same amount of statelessness (at least from a REST perspective) as a JWT.
Not that cookies are allowable within the constraints of REST anyway due to violation of the uniform interface/stateless constraints, but pragmatically cookies have the most user agent support, and when used as just an session identifier, are relatively close to following the constraints and are much better supported than using the Authorization header or whatever[1].
Statelessness (the lack of "sessions") refers generally to the fact that the client and the server don't need to share state, i.e. the client has all it needs to make a request rather than, like, an "authorization context" or something (which is what a "user session" colloquially is). Unfortunately, the difference in the way the terms were used kinda led to this confusion which made people think that they weren't doing REST unless they were using JWTs or signed cookies.
It's the difference between storing the shopping cart in a cookie or what have you vs. creating a shopping cart resource. In the former scenario, the server has to track where in the (often implicit) state machine the current client is[2], whereas in the latter, the client has all it needs (a URI, authz token, etc) to make the request and all the state is stored server-side.
[1] If browsers had better support for setting the Authorization header somehow, this would almost certainly just be a "best practice" that we take for granted. Automated clients with API keys tend to be better in this regard.
[2] And there are significant disadvantages to doing it this way, if you've ever lost your cart or got those weird "session expired" errors after hitting the back button, you've ran into the pitfalls of doing it this way.
Likewise "autoplay blocking" isn't too hard to overcome. It's more out of politeness that it's ever honored.
This should be the central argument the DOJ uses to separate Chrome from Google: The entire web for a monopoly-size portion of users is massively less secure because the web browser is owned by a company which is very vested in it being less secure.
From TFA: "Until today, Google was still planning to roll out a dialog in Chrome that would prompt users to turn off third-party cookies in favor of Google's updated solution. […] …Google won't be pushing that cookie dialog to users. You can still choose to disable third-party cookies in Chrome, though."
Google is saying they’re fine with no third party cookies. The rest of the industry needs them.
How do you protect user privacy while also not killing googles competitors? Which need is more important?
I'm guessing the reason google doesn't use third party cookies is because they get higher quality data from people being signed in to Google services, and that is independent of whether they are using Chrome or not.
I do disagree with your cause and effect though, they have gotten blocked from replacing third party cookies with privacy sandbox because it replaces a standard everyone can use equally with a Google-controlled system. They could have cited the industry standard to block third party cookies in other browsers and done so without a replacement, the reason they are being prohibited from doing so is because they are motivated to maintain data access for themselves via privacy sandbox.
You can read countless statements from the Chrome team about Privacy Sandbox where they state how vital spying on users for ad targeting is, they've never "wanted" to remove doing so.
Those statements about tracking you're referencing are legal shielding against antitrust suits from adtech competitors.
Google was attacked on both sides, on the one hand by adtech who objected to being forced by Google to use something less powerful than third party cookies, and on the other hand by other browser vendors who objected to adding adtech features and certainly didn't have any interest in helping Google avoid their antitrust problem, regardless of the fact that enabling Google to turn off third party cookies would be the better privacy outcome for users of Chrome. They had no interest in helping Chrome users; they preferred to promote alternatives instead.
They could have cited the industry standard to block third party cookies in other browsers and done so without a replacement, the reason they are being prohibited from doing so is because they are motivated to maintain data access for themselves via privacy sandbox.
This is ignoring the facts. Last summer it was made clear that no privacy-increasing replacement for 3p cookies was going to be acceptable to the CMA.
So Google's announced plan was to make 3p cookies an opt-in feature, with a dialog forcing users to make the choice. That plan was not conditional on any of the privacy sandbox replacement mechanisms. (Your guess is as good as mine for what option the average user would choose when forced to.)
But clearly even informing the users and having them make a choice was unacceptable to the CMA.
And no, they cannot just act unilaterally citing precedence in other browsers like you study. Regulators aren't going around threatening to break up Apple or Mozilla, so they get to do whatever they want. Google does not have that luxury.
(And none of the privacy sandbox projects for ad targeting without 3p cookies was giving Google some additional data source denied from other advertisers, like you claim.)
Google has wanted to block third-party cookies for a long time and they can't because they're not allowed to, legally.
There's no reason they couldn't allow add-ons to do it: but instead with manifest v3 I think it is impossible to do it in a general way isn't it? Like with the other ad-blocking you have to have a hardcoded number of rules you can define for blocking cookies in the requests as well, at least through the declarativeNetRequest API.
Maybe it is possible for through one of the cookies APIs, but the cookie's API has race conditions where the site can still sometimes see them from what I understand and redirects can activate before your extension gets a chance to respond.
And then of course extensions don't even run on mobile and that isn't an accident.
Honestly I’m surprised Google hasn’t offered to buy Truth Social for a few hundred million just to make this little antitrust problem go away.
I guess that was going to be too insane to actually manage.
https://blogs.windows.com/msedgedev/2024/03/05/new-privacy-p...
Google has been heartened to see the advertising industry taking privacy more seriously. As a result, Google won't be pushing that cookie dialog to users.
The advertising industry never ever cared about anyone’s privacy. Quite the opposite.
Same for Google, Google is a company. It cares about money income, that’s all. This change gave them even more control on the web.
They just had too much pushback from the advertising industry and a wrong timeline with the DOJ and the antitrust lawsuit. That’s the reason they canceled their plan, anything else is PR BULLCRAP.
I think that independent from Google browser vendors should 1) stop adopting any APIs that extend fingerprinting surface and 2) gradually lock down APIs that allow fingerprinting by putting them behind permissions.
Aren't all cookies trivially "any-party" cookies? Can't any form of persistence be used to track a user? 3rd-party cookies as they exist today just give a path of least resistance so that most of that behavior is implemented the same way. Consistent implementation allows the user a simple way to block that behavior.
Google scraps plan to remove third-party cookies from Chrome (26 points, 9 months ago, 3 comments) https://news.ycombinator.com/item?id=41046637
Chrome is entrenching third-party cookies that will mislead users (511 points, 8 months ago, 311 comments) https://news.ycombinator.com/item?id=41391412
What Google's U-Turn on Third-Party Cookies Means for Chrome Privacy (3 points, 7 months ago) https://news.ycombinator.com/item?id=41788239