Cookie Fight

Back in the May 2021 issue, I reported on Google’s effort to replace third-party tracking cookies with a new alternative they call Federated Learning of Cohorts (FLoC). New developments have added new folds of interest to this story.

Dear Reader,

Back in the May 2021 issue, I reported on Google’s effort to replace third-party tracking cookies with a new alternative they call Federated Learning of Cohorts (FLoC). The company’s FLoC initiative replaces tracking cookies with an alternative technology that removes the power of third-party vendors while still sustaining, and perhaps enhancing, Google’s own ability to target ads for ad buyers. New developments have added new folds of interest to this story. Time will tell whether these events will actually make a difference to the browser industry, but they are certainly worthy of attention.

First of all, Google announced a delay in their planned deployment of FLoC. Several major websites and ad vendors have denounced FLoC as a bad idea and a naked power grab by Google, and some commentators have speculated that the negative response is one of the reasons for the delay. It is unclear what they think one year would do to improve this negative response, unless Google is actually redesigning the system to appease its critics, which doesn’t sound like Google. The other reason for the delay is that the EU has launched an antitrust investigation into Google’s plan. The regulators’ argument is that Google is an ad vendor, and Google the ad vendor should not be able to use the market power of the Google Chrome browser to enhance its position and eliminate rivals. (If you think this sounds a lot like the antitrust claims against Microsoft back in the 1990s, you are correct.)

Google is quite capable of pulling the plug on projects they don’t think have a future – who remembers Google Latitude, Google Spaces, Google Wave? – but in this case, they just announced a delay, which means they still have an intention to proceed with it.

Meanwhile, as Google pauses and waits for the unfolding of its grand plan, Firefox is pressing ahead with its own, very different vision of cookie control. On August 10, Mozilla announced a new feature for Firefox 91 known as Enhanced Cookie Clearing. This new feature is part of a larger initiative called Total Cookie Protection, which was unveiled earlier this year. Total Cookie Protection confines all cookies from a single website into a separate cookie jar associated with the site. According to Mozilla, “In combination with the Supercookie Protections we announced [recently], Total Cookie Protection provides comprehensive partitioning of cookies and other site data between websites in Firefox. Together these features prevent websites from being able to ‘tag’ your browser, thereby eliminating the most pervasive cross-site tracking technique.”

The new Enhanced Cookie Clearing option allows the user to zap everything in the cookie jar, clearing all cookies associated with a website all at once. It seems that trackers have started to store identifiers in increasingly obscure places to avoid cookie protections, including “Flash storage, Etags, and HSTS flags.” Total Cookie Protection and Enhanced Cookie Clearing help to prevent these kinds of detection avoidance techniques that other cookie management systems might miss.

In the Firefox solution, third-party cookies still exist, but they can only be accessed from the site where they were placed, so they can’t be used for tracking. On the other hand, the Google solution claims to eliminate third-party cookies, but it is far messier and more complicated than the Firefox method, and Google still gets to watch everything you do – they just store the data differently.

It will be interesting to see how a year’s delay in Google’s grand vision will play out against the rapid advance of Mozilla’s grand vision. Keep in mind, also, that Apple has already blocked third-party cookies in the Safari browser and might be working on similar refinements to ensure a tighter seal. It is possible that, by the time the smoke clears from Google’s antitrust review, the industry might have already moved on, and Google might have missed its opportunity to dictate the future of cookie protection. That’s a big if, or course, because Google is still the biggest player in the eternal food fight for browser dominance, but we’ll see how the cookie crumbles.

Joe Casad, Editor in Chief

Posted by Contributor