Google put out a blog post this week that's been making the rounds in the ad-tech corners of the internet, and I've got Opinions about it. Short version: once third-party cookies actually go away in Chrome (still allegedly happening sometime in 2022, I'll believe that when I see it), Google says it will NOT build some new tracking ID to quietly slide in behind them. No alternate identifiers, no fingerprinting workaround, no PII-based ID that follows you around the web once the cookie is gone. David Temkin, who runs ads privacy and trust over there, posted it Wednesday under the title "Charting a course towards a more privacy-first web."
My first reaction, and I'll own that it's an uncharitable one, was: sure, Google.
Not because I think Temkin is lying, exactly. The actual plan is more interesting than a straight lie would be, and honestly kind of impressive in a "I see what you did there" way. Google isn't swearing off tracking. It's swearing off the kind of tracking that everyone else can also do. The thing they're building instead is called FLoC (Federated Learning of Cohorts, if you want the full acronym), and the idea is your browser sorts you into a group based on your browsing history and hands advertisers the group ID instead of a cookie tied to just you. You are still being profiled. You're just being profiled in a way that happens inside Chrome itself, on Google's terms, instead of via some third-party ad exchange dropping its own tag on your machine. The businesses that lose in this arrangement are the smaller ad-tech shops that spent the last decade building entire companies on top of third-party cookie tracking. The business that does not lose, near as I can tell, is the one that owns the browser, the search engine, the ad exchange, and now also the cohort math that decides which bucket you land in.
I run a little AdSense on this blog, so let's be honest that I'm not exactly a disinterested observer here (four dollars and change last month, if you're curious how the empire is doing). But I've been online long enough to remember when "protecting your privacy" from a company that makes its money on ads usually means "protecting the parts of the ad business that only we can run." This is that, dressed up nice.
This is also, incidentally, the same week Microsoft's Exchange Server mess kept getting worse and worse. Krebs had a piece out today putting the number at over 30,000 US organizations hit through those holes Microsoft patched Tuesday, and from what I can tell that number is stale within hours of anyone posting it. I'm not going to try to cover that properly here, partly because I don't run Exchange (thank god, a decision I made about six years ago for reasons that had nothing to do with security and everything to do with not wanting to manage a mail server, and which is looking better every day right now), and partly because by the time I hit publish on this, three other blogs will have written the definitive rundown and mine would just be noise.
Anyway. Back to cookies. What actually annoys me about the Google announcement isn't the substance, it's the framing — "privacy-first" doing a lot of work in that headline for a company whose entire business model is knowing things about you. I'd have more patience for it if the cookie consent banners that GDPR forced on every site in 2018 had made anything better instead of just adding a click you do without reading. Half the reason cookies became the villain of this story is that they were the visible, easy-to-point-at mechanism. The invisible stuff, the fingerprinting, the account-linked tracking when you're logged into Google on three different devices, none of that needed a cookie to begin with and none of it is going anywhere.
I still remember being maybe twelve and finding the "clear cookies" button in whatever browser we had and clearing it obsessively, convinced I was doing something clever. Twenty years later the tracking has just moved somewhere I can't click a button to clear it. That's the trade, more or less. Not worse necessarily. Just quieter.