It's a common sight: Ads from that time you Googled flights to Cancun, or visited Nike to look for new running shoes, following you around the Internet.
Much of that tracking is made possible by cookies - little bits of code that jump off websites and lodge themselves in your browser, allowing new sites you visit to see where you've been before. Facebook and Google, the two most profitable advertising companies in history, use cookies to show ads across the Web based on info gathered on their own sites and social media networks.
But that's all changing. Google has vowed to block cookies completely on its Chrome browser, which is used by around 70% of the world's desktop computer owners, by the beginning of 2022. The decision, announced last year, sent shock waves through the advertising world, which has maintained revenue from tracking is necessary to fund a largely free Web.
Google says it has solutions to allow advertisers to keep showing relevant ads, but in privacy-protecting ways. Taken together, the company's proposals are meant to let Web publishers, e-commerce companies and advertising agencies continue using targeted ads to make money, while assuring regular Internet users their data isn't being stockpiled by an ever-growing list of companies and websites.
But privacy activists have already started poking holes in Google's ideas.
And it may not matter. Advertising technology companies such as the Trade Desk have already taken the matter into their own hands, banding together to create new tracking tools that use email addresses. Other major companies have shown signs of pushing back against Google's proposals, such as Amazon, which is currently blocking Chrome from collecting data on which users go to its websites. (Amazon chief executive Jeff Bezos also owns The Washington Post.)
Meanwhile, politicians and antitrust investigators in multiple countries have raised alarms that Google's move could hurt competitors and further cement its power. And for regular Internet users, this largely behind-the-scenes change could have major implications for how private companies hoover up our data and make decisions about what we see online.
Here's what you need to know.
How did we get here?
Cookies were written into early browsers to cut down on some of the inconveniences of surfing the Web. They allowed passwords to auto-fill, or websites to remember payment information so users didn't have to type theirs in every time they came back. They also created a trail of breadcrumbs that the burgeoning online ad industry eagerly ate up, helping free websites make money.
But as the technology advanced, social media took off and consumers' lives were lived increasingly online, it got creepy. Privacy advocates have always criticized the model, and more and more regular people have become aware of the issue, some expressing their displeasure by downloading ad blockers.
Google isn't the first to make this change. Apple in 2017 started limiting and eventually blocking third-party cookies completely from its Safari browser. Mozilla's Firefox followed soon after. But those two browsers make up less than 20 percent of the market, according to research firm eMarketer.
Despite Google's own reliance on advertising and tracking for roughly $180 billion a year in revenue, chief executive Sundar Pichai admitted during a 2019 congressional hearing that people don't like to feel they're being tracked around the Internet. And in January 2020, Google said it too would block third-party cookies on Chrome within the next two years.
The changes come as politicians in the United States and elsewhere step up their attempts to regulate privacy. The European Union's General Data Protection Regulation has forced companies to ask permission before tracking people online since 2018. In 2020, America's most populous state instituted the California Consumer Privacy Act, which gives California residents the right to ask companies to delete whatever data has been gathered on them. As is the case with other consumer-focused regulation, the California law has essentially become the default nationwide.
Google was facing pressure from its competitors, too. Apple has been marketing its own privacy features aggressively, trying to paint itself as a privacy champion that doesn't need to gather data to feed an advertising business like Google. It even threw up a giant billboard that loomed over Google's exhibit at the 2019 CES tech conference in Las Vegas. Apple does gather some of its users data and uses it to sell targeted ads in its app store, though its ad business is much smaller than Google's.
Some of Google's advertising technology competitors say the move isn't about privacy at all, but a way to hurt its rivals and push advertisers toward Google's YouTube and search ads, which don't need cookies to effectively target people.
"You can fix your public perception while at the same time cementing your own dominance and growing your own market share," said Ratko Vidakovic, founder of AdProfs, an independent advertising technology consulting firm. "It seems like a no-brainer."
A Google spokeswoman pointed to a company blog from March, where Marshall Vale, a product manager, said the company's goal with FLOC and its other projects is to make cookies obsolete while also helping web publishers grow their businesses. Finding that balance is "critical to keep the web open, accessible and thriving for everyone," Vale said.
How exactly does Google's solution for the post-cookie world work?
Google can block cookies in Chrome relatively easily because it designs and controls the browser's underlying code. Once it decides to make the change, it can update the browser and poof - no more cookies. To replace that functionality, Google's engineers have marched out a menagerie of bird-themed acronyms like FLOC, FLEDGE and TURTLEDOVE to describe their proposals for advertising without cookies.
The ideas are working their way through the World Wide Web Consortium, or W3C, an international group of tech companies that debates and sets rules for how the Web works. However, Google doesn't actually need to get approval from the rest of the W3C's membership. Since its browser is the biggest in the world, it can simply make new rules and Web developers will have to follow them or risk seeing their websites stop working on Chrome.
"Google using the W3C letterhead to do this stuff makes it seem less like a Google power play," said Peter Snyder, senior privacy researcher at Brave, a browser that competes with Google's Chrome.
The most fleshed-out idea so far is FLOC, which stands for Federated Learning of Cohorts. Under FLOC, instead of letting websites drop cookies into an individual's browser, the browser itself watches what they do online. It then uses artificial intelligence to assign them to a cohort of several thousand people that the AI determines are interested in the same kinds of products. Then, instead of buying access to individual people, advertisers pay for ads to show up for users in a specific cohort.
For example, if you spent the past few days reading articles on ESPN, browsing New York Knicks jerseys and Googling NBA stats, you might be lumped into a package of several thousand basketball fans who would see similar ads. Cohort IDs refresh every week, so they're based on the most recent browsing behavior.
In the old world, websites would constantly be pulling up information about you based on the cookies trailing behind you. Now, the only identifying information your browser would present is which cohort you're in. Google says this system is 95 percent as effective at getting clicks as old-school cookie ads are for advertisers.
If that's true, consumers would see pretty much the same kind of ads they do now and will probably still have the feeling of being followed around the Web by ads for sites they recently visited.
Generally, yes, but that doesn't mean privacy advocates are celebrating the change. For one, Google's Chrome browser is still monitoring every website you visit and feeding that into its algorithm. The information stays on your device, but it's still being gathered. For those who want less surveillance from tech companies, it might feel like a step in the wrong direction.
"The technology will avoid the privacy risks of third-party cookies, but it will create new ones in the process," Bennett Cyphers, a researcher with the Electronic Frontier Foundation, wrote in a March report on Google's cookie replacements. "It hasn't learned the right lessons from the ongoing backlash to the surveillance business model."
It also isn't clear yet which websites will have access to a person's cohort ID. If it's freely available, sites you visit repeatedly could collect them as they change week to week, tie it to other pieces of information about you such as your email or IP address, and build a dossier on your interests, circumventing the stated purpose of FLOC, Cyphers argues. Google acknowledges this issue and says it is one of the long-term problems it is working on. The system also raises the possibility of profiling based on race, allowing advertisers to discriminate against some people. Advertising jobs or housing selectively by race is illegal in the United States.
Still, compared to other proposals from the rest of the ad-tech industry, Google's is arguably the best one for privacy, Vidakovic said.
"They're trying to balance commercial needs with user privacy needs at the same time," he said. "Despite their flaws, I think the concept behind FLOC and anonymous cohorts are a good balance."
What does Google's move mean for competition?
Unlike FLOC, cookies aren't owned and controlled by a specific company. They are a generic technology that any Web publisher or ad-tech seller can use to track people and show them ads. The world of cookie advertising resembles a capitalist Wild West, where anyone can hang a shingle and try building a fortune in Web ads.
Google's new FLOC system is more controlled, laying out strict rules for how exactly advertisers can interact with the people who use Chrome.
Cookies have also been used extensively to check how effective digital ads are. With FLOC, advertisers would have to trust Google that the ads they're paying for are being shown to the right people.
Competitors to Google argue the company is pulling the ladder up behind it. Google used cookies to help it build a massive advertising business, but because YouTube and Google Search - which don't need cookies - are its biggest moneymakers, it can afford to live in a cookie-free Web. Advertisers who can't use cookies to find people on the open ocean of the Web will give more of their money to Google and Facebook who can pinpoint the right targets on their own sites, which industry insiders call "walled gardens."
In January, the UK's competition authority said it would investigate FLOC and Google's other ideas to "assess whether the proposals could cause advertising spend to become even more concentrated on Google's ecosystem at the expense of its competitors."
On the flip side, if Google were to simply shut down third-party cookies without building an alternative like FLOC, small companies, and the consumers who look to them for innovative new products, could pay the price. Big brands who already have contact information for their customers can use email marketing to reach them, while start-up retailers use targeted ads to find new people. Without targeted ads, companies such as glasses seller Warby Parker or makeup start-up Glossier might never have survived long enough to compete and bring down the prices that older companies were charging consumers.
The same dynamic applies to publishing. Big news organizations who have paying subscribers don't rely as much on targeted ads as small, local news providers. If those small news providers have even fewer ways to make money, the communities they serve will suffer. (The Washington Post is working with the Trade Desk and other companies to use an email-based identifier for targeted ads).
Google argues that, unlike Apple and Mozilla, it actually had small publishers, advertisers and the consumers they serve in mind when it said it would build FLOC to account for the loss of targeting ability when cookies go away.
Either way, Google is set up for success. If FLOC does work effectively, it gains more control over the advertising ecosystem and can tell its users it has scored a win for their privacy. If it fails, advertisers will likely invest even more in the "walled gardens" - which conveniently include Google's search ads and YouTube.
So what does all this mean for me?
The debate over cookies is a major reminder of just how much our online behavior is being tracked and recorded by dozens of private companies. It also shows how many companies have a stake in that reality.
Targeted advertising has grown up alongside the Internet, and helped create giants such as Facebook and Google, but also fostered an ecosystem of thousands of companies employing hundreds of thousands of people. When companies such as Google make changes to how products used by billions of people work, there are consequences. Getting rid of cookies completely could hurt news publishers and e-commerce start-ups, decreasing the number of voices online and pushing up prices for consumer products. It could also increase privacy and move the Internet in the direction of less surveillance overall.
None of this has been fully decided, and keeping track of the big changes made by companies such as Google, Facebook and Apple over the next several years will be key to understanding how our online lives are recorded, packaged and sold.
