Much has been made about Google doing away with third party (3P) cookies in an upcoming release of their Chrome browser (estimated in 2022) which represents 2/3rd share of the browser market. Apple’s Safari browser and Mozilla’s Firefox browser already block third party tracking cookies. Third party cookies are typically the ones set by “third party” ad tech companies whose tracking code is found on millions of sites. This differs from first party (1P) cookies, which are set typically by the sites themselves. Consumers visiting nytimes.com know they are interacting with the New York Times; but most are unaware of the dozens, if not hundreds, of ad tech trackers that are collecting their information, without their knowledge, and certainly without their consent. The ad tech companies sell their data for profit or make money by using it to help marketers improve the targeting of ads — i.e. behavioral targeting.
Third Party Adtech Tracking is Out of Control
Note the following example of a celebrity news website. The FouAnalytics Page X-ray ( https://pagexray.fouanalytics.com/q/hollywoodlife.com ) shows all of the ads and trackers loaded by a single webpage, in a tree graph. It shows “what called what.” Some third party trackers are loaded on the page directly while others are called in by the ads and trackers themselves, leading to over a thousand calls for ads and trackers from a single webpage - no wonder user experience suffers (long page load times) and users’ privacy is compromised.
FouAnalytics Page X-Ray
Adtech Companies Harvest User Data Without Their Knowledge or Consent
When hundreds of adtech companies are harvesting data on users from millions of sites, consumers’ privacy is practically non-existent. Over the years, consumers have started to protect themselves by using ad blockers, that not only block ads but also block the trackers that come along with those ads. Further, because of the Facebook/Cambridge Analytica scandal, more consumers are now aware that their data is not only being collected by social media networks, but they are actively selling their data or allowing others to collect and sell it. After years of outcry, some regulations like GDPR (General Data Protection Regulations) and CCPA (California Consumer Privacy Act) have been passed to help protect users’ privacy. But it remains to be seen how strictly and aggressively regulators enforce these rules and how ad tech companies respond.
Doing away with third party cookies has been touted as “privacy enhancing” for consumers. However, years of research have shown that doing away with cookies, both 1P and 3P, does not necessarily increase privacy. This is because ad tech companies have found “work arounds” to continue to uniquely identify users, even without using any cookies.
Adtech Companies Can Still Uniquely Identify Users Without Cookies
Browser Parameters - Since 2010, when the Electronic Frontier Foundation (EFF) published the first version of Panoptoclick, privacy advocates and researchers have shown that consumers could be uniquely identified without using cookies, simply by gathering javascript parameters about their browsers. This is called “fingerprinting.” Just like fingerprints are unique to each individual, digital fingerprints can be made from combinations of browser variables. For example, by gathering variables like the browser name and version, screen resolution, list of fonts and plugins, and IP address and location, companies can identify unique users with 99% accuracy. Even though ad tech companies have promised the data used for these fingerprints don’t contain any PII (personally identifiable information like name, email address, or phone numbers), the fingerprints remain privacy-invasive nonetheless.
Demographic Attributes - Adtech companies also claim that users’ privacy is already protected because no PII is collected or used. However, privacy researchers spotlight the lie of ‘anonymous’ data. “Researchers from two universities in Europe have published a method they say is able to correctly re-identify 99.98% of individuals in anonymized data sets with just 15 demographic attributes.” Even if no personally identifiable information is collected, ad tech companies can re-identify users using data from other data sets, collected or purchased. “Even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization set forth by GDPR [Europe’s General Data Protection Regulation] and seriously challenge the technical and legal adequacy of the de-identification release-and-forget model.” In a related study, “[with] smartphone location data, researchers were able to uniquely identify 95% of the individuals in a data set with just four spatio-temporal (geolocation) points.”
Browsing Histories - In addition to being able to uniquely identify or re-identify users with browser variables or demographic attributes, new research from Mozilla [PDF] shows that browsing histories can also be used to uniquely identify individual users. “This work replicates and extends the 2012 paper ‘Why Johnny Can’t Browse in Peace: On the Uniqueness of Web Browsing History Patterns.’ Browsing profiles are highly distinctive and stable. Our dataset consists of two weeks of browsing data from ~52,000 Firefox users. Our work replicates the original paper’s core findings by identifying 48,919 distinct browsing profiles, of which 99% are unique. High uniqueness holds even when histories are truncated to just 100 top sites.” This means that ad tech tracking code on millions of websites can easily re-identify unique users with high accuracy.
Doing Away with Third Party Cookies Won’t Improve Consumers’ Privacy
Because adtech companies can identify or re-identify users with high accuracy, using browser parameters, demographic attributes, and even browsing histories, doing away with third party cookies will not increase consumers’ privacy. As long as ad tech companies are allowed to track users with their third party tracking code across millions of sites, users’ privacy will remain compromised, even if those ad tech companies cannot set 3P cookies. Many companies, like Criteo, have been preparing for years for the upcoming “cookie-pocalypse” by turning to fingerprinting. These fingerprints are stored on the ad tech companies’ servers, instead of in consumers’ browsers, so they cannot be seen, controlled or deleted by the users, or privacy researchers.
Doing Away with Third Party Cookies Won’t Hurt Marketers’ Outcomes
Consumers’ privacy is not increased; and ad tech companies can carry on their data collection and monetization without consumers’ consent or recourse. But is all this privacy-invasive data collection even worth it? Studies have shown that it is not. Having hundreds of additional data points to use for targeting ads did not yield a measurable increase in business outcomes. Combined with supply chain costs, data quality issues, ad fraud, and viewability issues, dollars spent in programmatic ad tech channels often yield negative ROI. In other words, the incremental business outcomes do not even offset the additional costs of using behavioral targeting in programmatic ad tech channels.
See: The Cost-Performance Paradox Of Modern Digital Marketing
So when 3P cookies are finally outlawed by the largest browser, marketers may not experience any decrease in business outcomes. This is because the use of privacy-invasive 3P cookies, and the adtech tracking that came along with it, was not driving any incremental business outcomes anyway. What will happen, instead, is many of the adtech companies whose entire business models rely on 3P cookies and tracking will die and go away. This would actually be better for consumer privacy overall; the corresponding reduction of adtech middlemen in the programmatic supply chain will be better for marketers too.
The Link LonkAugust 31, 2020 at 06:37PM
https://ift.tt/3lynviy
No More Third Party Cookies—Good Or Bad News? - Forbes
https://ift.tt/2CmfU4u
Cookies
No comments:
Post a Comment