Google plans to scrap third-party cookies by 2022 — here’s why it’s problematic

Google has announced plans to stop using tracking cookies on its Chrome browser by 2022, replacing them with a group profiling system in a move the company says will plot “a course towards a more privacy-friendly web.”

The change is significant. Chrome commands some two-thirds of the web browser market. Third-party tracking cookies, meanwhile, underpin much of the targeted advertising industry. And, while Mozilla’s Firefox and Apple’s Safari have already stopped supporting third-party cookies, Google is the first firm to produce replacement advertising support.

Rather than tracking and targeting you on an individual basis, Google’s alternative groups you instead into a crowd of people with similar generalized interests. Google argues this grants users more privacy. This sits oddly with the reassurance to advertisers that the new technique is at least 95% as effective as individual targeting.

But beneath the gloss of Google’s press releases, the shift from tracking to profiling raises a number of new privacy and discrimination concerns. Ostensibly a move to boost individual privacy, Chrome’s new system ultimately looks set to benefit Google, handing the company yet another advantage over its beleaguered AdTech competitors.

Cookies to cohorts

The traditional web tracking and targeting method uses so-called cookies: small files stored by web browsers such as Chrome. Their original purpose was to retain information – such as the items you’ve added to online shopping carts, for example – between browsing sessions. This was seen as useful for consumers.

Nowadays, cookies mostly serve advertising interests. On Chrome, third parties use cookies to track you across the web, amassing enough data on your browsing habits to target you with highly specific adverts.

In recognition of how invasive this tracking has become, the EU’s data protection laws class cookies as “online identifiers,” subject to regulations that require websites to gain your consent before issuing cookies to your browser.

Google’s new system for Chrome will abandon that. The browser will instead use your recent browsing history to generate your “cohort identity.” That’s currently achieved by using a “simhash,” which in simple terms generates “magic numbers” to represent your interests before grouping you with those in possession of similar numbers.

Hidden within a cohort of a few thousand individuals, you’ll then have adverts targeted at your cohort, rather than you as an individual. This is presented as a boost for privacy, as it moves away from the individualized tracking and targeting that made third-party cookies particularly invasive.

Towards Facebook’s model

Conceptually, Google’s proposed system isn’t new – it is a form of profiling, which enables an advertising model that Facebook has been using for some time. Targeting someone’s cohort identity is just like creating a “Lookalike Audience” based on one individual, which is a service Facebook currently offers advertisers.

We should expect profiling to also create a number of different named cohorts, from which advertisers can create Custom Audiences with mixed interests – something that Facebook also offers.

This is where profiling becomes problematic. In 2016, it was revealed that Facebook allowed housing advertisers to exclude users based on race. Even after Facebook made changes to its audience groupings, it was still possible for advertisers to discriminate based on sensitive interests held predominantly by minorities.

Profiling involves machine-learning algorithms and AI technologies which have repeatedly been shown to reinforce real-world bias. As such, Google’s decision to sack key members of its AI ethics team just as Chrome is adopting a profiling advertising model appears particularly alarming.

Aside from the known harms and risks of profiling, it’s unclear how Google’s new model enhances individual privacy. For the system to work, Chrome must freely volunteer your cohort identity to any website you visit, whereas a third-party cookie doesn’t reveal that volume of data to all websites.

The smaller cohorts get, meanwhile, the easier you’ll be to spot within them. And you’d expect Google to favor smaller cohorts, seeing as larger cohorts naturally reduce the accuracy of targeted advertising. Overall, the change will introduce a number of new risks for privacy and discrimination. So why else might Google have chosen to scrap third-party cookies on Chrome?

Google’s mixed motivations

One reason is regulation. The EU’s new ePrivacy directive may well move to abolish the traditional use of tracking cookies within the EU anyway, with far-reaching consequences for other jurisdictions. So Google may simply be jumping before being pushed.

By restricting how third-party advertising services can use Chrome, Google may be set to benefit by stifling competition, too. An interest group for online advertisers has already asked the UK’s competition watchdog to account for the Chrome change as part of its existing probe into Google’s advertising practices. Google itself will retain ample tracking possibilities after the change, particularly when Chrome users are logged in to their Google accounts.

Google is the biggest beneficiary of Chrome’s move from cookies to cohorts. Framed as a privacy boon, Google’s new system only mildly restricts its traditional targeted advertising reach, while adding Facebook’s profiling-based mode of advertising to its repertoire.

End users like you and I, meanwhile, are unlikely to notice any difference whatsoever. We’ll still be watched and targeted based on our online activity – only now as part of a group, rather than an individual.

This article by Eerke Boiten, Professor of Cybersecurity, School of Computer Science and Informatics, De Montfort University is republished from The Conversation under a Creative Commons license. Read the original article.