“Cookieless future” is just a buzzword – Here is all you need to know about the end of third-party cookies

Cookies have been a vital part of web browsing for years. While some cookies provide essential functionalities like maintaining visitor sessions, third-party cookies have been controversial due to their ability to track users across the web without their knowledge or consent. People have grown more conscious about using and sharing their data, and many feel uneasy about the vast amount of personal data amassed through cookies.

Apprehensions surrounding third-party cookies have come to the forefront, spurring legislative changes. This has motivated tech giants like Google, Apple, and Mozilla to transition their browsers away from third-party cookies. Google is planning to fully phase out third-party cookies by the end of 2024.

However, while other types of cookies face different restrictions, such as a limited lifespan, they are not going away. Although alternatives to cookies have been popping up, they have yet to be widely adopted. Thus, we don’t know what the future of marketing and advertising will look like. 

Today, we will explore the challenges of the demise of third-party cookies for marketers, businesses, site owners, and consumers. We will look into new methods of tracking users and collecting analytics data and show you how to navigate a future that will not be so cookieless after all.

What are cookies

Cookies are small pieces of data stored on a user’s device that contain information about their interactions with websites.

Cookies are used for various purposes, such as:

Types of cookies and their differences

There are two main types of cookies: first-party and third-party cookies.

First-party cookies

First-party cookies are set by the website the user is currently visiting.

They are usually used to enhance user interactions with websites. For one, they help maintain sessions and remember login credentials, preferences, and shopping cart items. They also enable the personalization of content and advertising based on browsing history and interests and collect analytics data for website improvement. 

Some first-party cookies provide essential functionalities on a website and aren’t considered invasive.

Third-party cookies

Third-party cookies are created by domains other than the one that the user is visiting.

Third-party cookies gain access to your visitors’ browsers through external services embedded in your site, such as:

Third-party cookies are used for cross-site tracking, retargeting, and serving curated ads to users via ad platforms or social media based on browsing history and other online behavior across different websites. 

These cookies enable brands and vendors to gather a significant amount of personal information about a user, making it possible to create detailed user profiles. They can also be used for malicious purposes, such as tracking users to steal their personal information or deliver malware. 

On the other hand, they let websites provide certain functionalities, such as live chats. However, the absence of third-party cookies does not typically affect a website’s core functionality.

Why are third-party cookies being phased out

When cookies were first created in 1994, sites gained the ability to track information across pages, which enabled many useful functionalities, such as running online shops. At the same time, the vast potential for abusing the technology and violating user privacy and security became clear. 

These concerns were so apparent that in February 1996, the Financial Times published the first article about the dangers of cookies.

Third-party cookies allow advertisers and trackers to follow users across the web and collect sensitive information without explicit consent, which can breach trust between all parties. Because of the widespread use of cookies, data is scattered across various apps, websites, and services, making it difficult to control what happens with it.

Consequently, cybercriminals can use cookies to impersonate users, gather financial data, steal passwords, and engage in other nefarious online activities.

Internet users have been sensitive to the unauthorized collection and use of their personal data, viewing it as an invasion of their privacy. For example, users have been turning to ad block extensions to protect themselves from intrusive ads and trackers online. As of 2022, 37% of internet users worldwide had adopted ad blockers.

Concerns about third-party cookies have led to increased scrutiny and regulatory efforts to respect user privacy. Regulations like the CCPA & CPRA and GDPR view cookies containing identifiers as personal data. These privacy laws specify the requirements for gathering consent to track and collect user data online.

Under the jurisdiction of these laws, websites must, among others:

These regulations impose severe fines and penalties on data collectors who don’t adhere to their requirements.

For years, cookies have been integral to the online experience. However, as major browsers withdraw support for third-party cookies, they’re paving the way for marketing and advertising that don’t rely on them.

The deprecation of third-party cookies in Chrome

Compared to other browsers, Chrome has been slower in imposing restrictions on third-party tracking. Third-party cookies power digital advertising, which is a vital component of Google’s business. Also, given Chrome’s 67% market share, Google’s approach to cookies impacts the entire industry.

This setback gives the online advertising industry more time to adopt new ways of targeting users. For one, in August 2019, Google introduced the Privacy Sandbox, an initiative to develop privacy-facing standards on the web.

However, while other browsers aim to transition away from third-party cookies, Google’s “cookieless” alternatives don’t necessarily focus on privacy. Google wants to preserve control over the majority of online advertising and the revenue generated from it. As the world’s largest ad platform, Google is strongly interested in maintaining its ad-targeting capabilities.

What will replace the third-party cookie in Chrome?

Google’s decision to remove Chrome’s third-party cookie support is part of Privacy Sandbox, which includes measures to support advertising functionalities without relying on tracking users across websites. 

The Privacy Sandbox has been an iterative process, with different APIs developed and deployed for testing. This process reached a breakthrough when the Privacy Sandbox initiative announced the release of six new APIs for Chrome in July 2023. 

These APIs include:

Here are their specifics:

Topics

Topics allow the browser to infer a selection of recognizable interest categories based on recent browsing history to enable sites to serve relevant ads. Unlike third-party cookies, Topics will only share users’ general interests, rather than granular behavior, across multiple sites.

Protected Audience

Protected Audience enables advertisers to run ad auctions using JavaScript code within the browser. Advertisers can also run targeted remarketing campaigns to custom audiences or groups of people with a common interest.

Attribution Reporting

Attribution Reporting allows measuring conversions from ad clicks and views, and ads on other platforms without tracking user activity across websites. It employs two types of reporting:

Private Aggregation

Private Aggregation makes it possible to generate aggregate data reports using data from Protected Audience and cross-site data from Shared Storage.

Shared Storage

Shared Storage allows sites to store and access unpartitioned cross-site data. This data must be read in a secure environment to prevent leakage.

Fenced Frames

Fenced Frames enable securely embedding content onto a page without sharing cross-site data.

Privacy Sandbox and the ad industry

There are mixed opinions about the Privacy Sandbox. Although it’s a viable alternative to third-party cookies, it will only operate in Chrome. While Chrome has a majority of market share, other browsers are still responsible for large chunks of traffic. Chrome is also not representative of traffic from other browsers and devices, where users may behave differently. 

The identifiers created with Privacy Sandbox aren’t owned and stored by the advertisers, so they can’t be passed and activated in other systems.

According to a report by IAB Tech Lab:

“In its current form, the Privacy Sandbox may limit the industry’s ability to deliver relevant, effective advertising, placing smaller media companies and brands at a significant competitive disadvantage.”

In the end, Privacy Sandbox will not be the only solution to the deprecation of third-party cookies, but it is one of the alternatives that advertisers can consider. You can monitor the Privacy Sandbox timeline, as various proposals are currently in different development and testing stages.

The phase-out of third-party cookies by other vendors

Many browser vendors have been employing restrictions on user tracking for years.

Apple

Apple has implemented Intelligent Tracking Prevention (ITP) in Safari. ITP blocks third-party cookies by default and restricts first-party cookies and other browser storage options. 

Additionally, Apple has introduced App Tracking Transparency (ATT). This user privacy framework requires all iOS apps to request permission via a pop-up to access the Identifier for Advertisers (IDFA) or device ID and track users across apps and websites.

Firefox

Firefox offers Enhanced Tracking Protection, which lets users block cookies and storage access from third-party trackers. Thus, users can decide what level of privacy they want to set up in their browsers.

Brave

Brave has been a privacy-focused browser from the start, blocking third-party cookies by default. It also enables many additional privacy and security features, allowing users to customize their privacy settings more granularly.

What does the demise of third-party cookies mean

Organizations that rely on third-party cookies will face challenges as certain functionalities won’t be available. 

Activities that will be impacted include:

The phase-out of third-party cookies signifies a massive transformation in digital advertising, making it more challenging for advertisers to track users across different websites. 

As cookies become a thing of the past, the focus is on developing new technologies and methodologies that align with the evolving digital advertising ecosystem and enable marketers to deliver relevant and personalized content.

How to navigate the future without third-party cookies

The “cookieless future” refers to an impending reality in which third-party cookies are no longer part of marketers’ toolkit. It’s a landscape without access to user data collected through third-party cookies, impacting how we perform user tracking, generate leads, retarget ads, and understand user behavior. 

This future, although challenging, presents an opportunity for innovation and growth in the digital marketing sector.

Focusing on first-party cookies

If your company uses first-party cookies as its primary marketing fuel, your activities won’t be affected much. These cookies will continue to work and remain an option, delivering measurable benefits even in the face of the changes concerning third-party cookies.

There are many first-party cookie-based methods you can still use in your marketing, such as:

Creating a first-party and zero-party data strategy

If you want your company to prioritize customers’ privacy and trust, you should focus on first-party data collection, supplemented by zero-party data.

First-party data is collected through direct interactions between the audience and the brand. It includes personal details, contact information, behavioral data from different channels, social media activity, purchase history, consent records, and more. Companies can enhance their first-party data approach by integrating analytics with data from other tools, such as CRM, marketing automation tools, email software, and many more.

Another valuable type of data is zero-party data, which refers to information intentionally and proactively shared by individuals with a company or organization. Zero-party data can be collected from customer reviews or comments, product-related preferences, newsletter opt-ins, or notification settings. 

First-party and zero-party data are valuable because their collection relies on transparent, consent-based data practices and help establish trust between the company and its customers. These types of data are also accurate and reflect your customers’ behavior, making them relevant and practical when applied to initiatives like marketing or advertising campaigns.

“Cookieless future” and advertising

The ad tech industry stands to lose from the demise of the third-party cookie.

Ad tech vendors and digital advertisers have been using third-party cookies for features like:

The advertising industry needs to adopt effective methods that don’t raise privacy and transparency concerns like third-party cookies did. Striking that balance is often challenging as new industry standards must be created. 

Some alternatives for digital advertisers include:

Contextual targeting

Contextual targeting is a form of targeted advertising that focuses on aligning ads with the content of a particular page. For example, it may involve placing an ad for kitchen utensils on a recipe site or an ad for a tour operator on a travel site. 

Ads are segmented based on keywords, site topics, language, and location, and then matched with relevant content. By making ads reliant on a page’s context, brands can reach audiences with ad placements that are likely to resonate with visitors. Research from Sapio Research and DV shows that 69% of consumers are more likely to look at an ad if it’s relevant to the content they are reading.

Contextual targeting is a more privacy-friendly alternative to behavioral targeting, which is based on personal browsing data. Previously, contextual targeting faced issues with the quality and efficiency of classifying content. However, thanks to AI, modern contextual targeting can understand the nuances of content, thereby increasing engagement and effectiveness. 

Contextual targeting offers numerous benefits in the “cookieless” world, such as:

Data clean rooms

A data clean room is a collaborative environment where two or more participants upload their first-party data and compare it to the aggregate data added by other companies.

Data clean rooms allow brands and advertisers to glean insights from each other’s first-party data under strict controls. They can use data clean rooms to:

All the data stays within the data clean room. Even though user-level data is added to a data clean room, it is not exposed to other companies. 

There are different types of data clean rooms:

By securely aggregating and connecting customer data sets in a clean room environment, marketing teams can draw insights from a wide range of sources to better understand their customers while meeting data privacy requirements halfway.

Cookieless identifiers

Ad tech vendors and the ad tech ecosystem are developing alternative universal IDs to replace third-party cookies. Without third-party cookies, ad tech and data companies can’t perform cookie syncing like they used to.

The advertising industry needs to find alternative ways to create IDs, such as turning a person’s login details (e.g., email address) into an ID.

The selected ID alternatives must:

Balancing these aspects is challenging; hence, no solutions have been widely adopted yet. At the same time, this could mean that Big Tech companies will manage to increase their market share with their solutions at the expense of independent ad tech. 

Here are some potential identifiers that have been introduced:

Universal IDs

A universal ID is a unique user ID that allows ad tech companies to identify users across different websites and devices. Universal IDs can operate within one environment, such as browsers, or identify users across various environments, such as browsers and mobile devices.

While universal IDs perform the same functions as third-party cookies, the difference is in how they are composed. Universal IDs are created using probabilistic data (e.g., IP address, browser type and model, and user-agent string), deterministic data (e.g., email address or phone number), or both. They help solve issues with cookie syncing and user identity.

Some notable universal ID solutions include:

Unified ID 2.0

Unified ID 2.0 is an identity framework that operates through a single sign-on to capture a user’s email address and consent once they visit a publisher’s page that supports UID 2.0. This consent is applied to targeted advertising across all publishers within the UID 2.0 network. Once the user logs in and consents, a hashed and encrypted identifier is created.

ID5

ID5 provides the advertising ecosystem with a stable encrypted user ID that replaces cookies and Mobile Ad IDs (MAIDs). Publishers, advertisers, and ad tech platforms can use these IDs to recognize users and deliver campaign objectives across different types of devices.

ID and device graphs

ID resolution services like ID and device graphs rely on taking and merging first-party IDs. 

These IDs are taken from online and offline channels, such as websites, mobile apps, and customer and data platforms (such as CRMs, CDPs, and DMPs), and sent to the ID graph. Next, they are matched with other IDs in the graph using a combination of deterministic and probabilistic methods. 

The main goal of ID and device graphs is to piece together IDs to create a centralized view of consumers rather than use these IDs for online media buying. Thus, companies can identify customers across different devices and channels and run various cross-device activities, such as ad targeting, personalization, and attribution. 

For ID and device graphs to be lawful, users sharing their data must provide valid consent.

Piwik PRO and the demise of third-party cookies

The phase-out of cookies won’t impact the web analytics capabilities in Piwik PRO, but it may affect your use of third-party tracking scripts. 

Here are the specifics of how cookies work in Piwik PRO:

First-party cookies

Piwik PRO exclusively utilizes first-party cookies for data collection. Users can continue to rely on our analytics platform without concerns about the removal of third-party cookies. Once Google makes the change, you won’t see any difference in collecting analytics data from Chrome users.

Third-party scripts

Tag Manager allows you to implement third-party scripts like Meta Pixel or LinkedIn Insight Tag. Third-party scripts on your website can set both first- and third-party cookies. As a result, some scripts may not work as before after Chrome deprecates third-party cookies. This could lead to issues like incorrect campaign displays and difficulties in collecting campaign data. 

Handling these issues depends on how ad tech companies like Facebook or Google Ads approach the transformation and what alternative solutions they provide for their pixels and other tracking tags. At Piwik PRO, we will do our best to adapt to any changes the vendors make. 

For now, the consensus on the new ad tracking methods is not there yet. There are already things you can do to prepare for restrictions on third-party cookies:

Cookieless tracking

Piwik PRO also offers cookieless tracking, which involves alternative user tracking mechanisms, such as with a session hash.

Since cookies play a pivotal role in recognizing and tracking returning visitors along with their browsing sessions, cookieless tracking has certain limitations and can impact the precision of data.

However, cookieless tracking helps you align with strict cookie requirements. It still lets you collect valuable analytics data, such as events and traffic sources. This makes it a great option if you can’t use cookies for tracking purposes due to privacy laws.

Getting ready for the end of third-party cookies

To make your company well-prepared for the future, make sure to:

Even without third-party cookies, you can benefit from a range of Piwik PRO’s features to collect, draw, and use valuable insights from your data. Reach out to us if you want to know more: