Google's Trail of Crumbs

Google is too big to get rid of cookies. Even when it wants to protect users, it can't.

This essay is by David Evans, a Professor of Computer Science at the University of Virginia.

Google recently announced that it has abandoned its four-year long effort to protect user privacy by changing the way ad auctions work on websites. The reason to give up on this effort to protect users is because of pressure from the United Kingdom’s Competition and Markets Authority, since the planned privacy protections were deemed to be incompatible with fair market competition.

Since Google controls so much of the Internet advertising ecosystem, an attempt to improve user privacy by limiting opportunities to track users across the web would violate fair competition. Google decided that avoiding punishment for anti-competitive behavior was more important than mitigating risks to user privacy, leaving Google’s Privacy Sandbox initiative in a trail of crumbs.

The decision is about whether to allow “third-party cookies”, a euphemistic name for the files a tracker can store inside your computer and retrieve whenever you visit a website containing a script known as a tracking pixel. These cookies are what enable individuals to be tracked, profiled, and targeted as they visit pages across the web. For the advertising industry, they allow advertisements for that hideous sweater, incontinence treatment, or fringe political candidate you looked at once to follow you around the web.

Every other significant browser vendor has already blocked third-party cookies by default—Mozilla started removing third-party cookies in Firefox back in 2018 and Apple’s Safari has been blocking tracking cookies by default since 2020. But most web users are not protected by these browsers. Google’s Chrome is the dominant web browser used by nearly two thirds of users and a position entrenched by Google’s control over the Android operating system that is used by over 70% of mobile phones worldwide.

Google acknowledged the privacy risks of third-party cookies over four years ago and initiated the Privacy Sandbox Initiative to protect users. The plan included blocking third-party cookies while moving ad auctions into the user’s web browser to still support targeted advertising. Instead of the current system that relies on extensive user tracking, the proposed design would record user’s interests securely in their browser and limit the information that would go back to advertisers, running the auction to select the displayed advertisement directly inside the user’s browser.  

The effort to block tracking cookies in Chrome, though, was ultimately doomed by its anticompetitive impacts on advertising services. Since Google has other ways to acquire detailed information on users, taking away competing advertising services’ ability to track users using third-party cookies would give Google an insurmountable advantage in on-line advertising. Because Google controls so much of the Internet advertising ecosystem, including the dominant browser, ad selling platform, mobile operating system, and search engine, it is impossible to protect user privacy without jeopardizing competitive markets.

We are left with three options: give up on fair markets, give up on protecting user privacy, or use antitrust remedies to prevent a company from being so big that it cannot take the measures that every other major browser vendor has taken to protect its users.