Google is in a tough spot. The company says it is committed to protecting the privacy of its users, but it also built one of the most profitable businesses in the world around the idea that if you track what users do online, you can show them personalized ads based on their interests and activity.
The real problem for Google is that not only is it the world’s most popular search engine, it makes the world’s most widely-used browser, Chrome. That gives the company an extraordinary amount of influence over how billions of people use the internet.
Over the past few years, other browser-makers have started to take steps to better protect user privacy. Both Safari and Firefox now block third-party cookies, the pieces of software used to track users across different websites or apps. Both also offer protection against device fingerprinting, which uses other types of data like browser, screen resolution, IP address, and browser extensions, in order to track them.
As the pressure to eliminate cookies continued to rise, Google said in a 2019 blog post that it would start exploring ways to make the web respect user privacy:
We are confident that with continued iteration and feedback, privacy-preserving and open-standard mechanisms like the Privacy Sandbox can sustain a healthy, ad-supported web in a way that will render third-party cookies obsolete. Once these approaches have addressed the needs of users, publishers, and advertisers, and we have developed the tools to mitigate workarounds, we plan to phase out support for third-party cookies in Chrome. Our intention is to do this within two years.
Privacy Sandbox is what Google describes as “a secure environment for personalization that also protects user privacy.” It seems like Google agreed at the time that cookies were bad, but said it wasn’t prepared to block cookies because it would lead to bigger privacy concerns like device fingerprinting.
Then, Google published a blog post in January of 2020 that said the company was working on “a path towards making third party cookies obsolete,” within two years. It’s been a very long way. In fact, the path has only gotten longer.
Now, Google has extended that deadline even further. It now says it won’t phase out third-party cookies until the second-half of 2024. If you’re doing the math at home, it’s already been more than two years. Google now says it will be at least two more.
Part of that is because Google can’t just block cookies without coming up with something to replace them, even if it wanted to. Tracking, after all, is the lifeblood of the digital advertising economy.
Ironically, Google would be better off if it simply blocked third-party cookies wholesale. It doesn’t really need that kind of data considering it already has so much information about you based on the Google websites you use.
Take search ads, for example. You don’t have to do any tracking to figure out what might be a relevant ad to show someone when they literally tell Google what they’re looking for. There has never been a more personalized advertising opportunity, ever.
At the same time, every other advertising platform depends on third-party cookies to track user information across websites, and to provide important data like ad conversions. Shutting off those cookies in Chrome would put them at a massive disadvantage against Google.
In theory, blocking cookies would be good for Google, except it would be seen as highly uncompetitive. It might be better for privacy, but it would be devastating for advertising.
And, so, Google has been trying to figure out a way to get rid of cookies, but also to provide a replacement that balances privacy and advertising. So far, it hasn’t gone well. Its first effort, known as FLoC was widely panned and rejected by both digital advertisers and privacy advocates. It has since moved on to what it calls Topics, which effectively uses Chrome to do all the tracking, which I guess is more privacy protective because advertisers don’t actually know anything about the individual users they target.
Still, tracking is tracking and privacy is privacy. With this latest delay, Google has made it clear that it could make the web respect the latter, but it won’t because it can’t let go of the former.