Hacker News Reader

Comment by Tepix | Hacker News Reader

The article says:

[Google] wants to replace [3rd party cookies] with new tools that give advertisers more limited, anonymised information such as how many users visited a promoted product's page after seeing a relevant ad - but not tie this information to individual users.

Here's the Chromium page about the "Privacy Sandbox":

https://www.chromium.org/Home/chromium-privacy/privacy-sandb...

Quote:

We believe ... the web’s users can access that information freely because the content creators can fund themselves through online advertising. That advertising is vastly more valuable to publishers and advertisers and more engaging and less annoying to users when it is relevant to the user.

In other words, they still want to know as much as possible about the users.

View on HN

It sounds like a good thing but I just can’t trust Google to not be evil and give themselves more of a monopoly.

They prob want to replace cookies with something that gives them the same functionality but not have to deal with cookie policies in the EU.

Google for some owns the full pipeline of websites, from where the website is being served from (Google AMP), scripts where the website does client side stuff (Tag Manager + Analytics), to the browser that reads it (Google Chrome / Chromium) and in some cases even the OS (Chrome OS).

Is not hard to imagine that they are getting rid of Cookies because they now have other ways of getting the data, and getting rid of Cookies would make things harder for competitors that don't own the full pipeline.

Even with that, I'm sure that the engineers working on Chromium/Google Chrome are being told that they are removing Cookies for the greater good and don't have insights into the longer pipeline that we're now seeing the middle off.

Don’t forget, they often control the domain registration, have had huge influence in the formation of the languages sites are written in, in some cases the languages the server is written in, even the backbone and last mile delivery of those bits to the user, etc.

Most of that can be leveraged by google to replace cookies.

Well, the cookie policies in the EU are sort of weird, but they're not from the GDPR, but from an older directive, 2009/136/EC, the "cookie law". And this directive only uses the word once, in the parenthetical "(such as certain types of cookies)".

Even if you replace cookies with something else (localstorage or whatever), you're still on the hook for all the rules both here and in the GDPR with regards to personal information and informed consent.

Remember that the 'cookie law' says

> Exceptions to the obligationto provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user.

So you don't need a cookie banner for a login session cookie, or a cookie that stores preferences the user actively selected. But you _do_ need a cookie banner, and a way to opt out, for all kinds of user tracking, both first- and third-party.

Of course, IANAL. Just angry at advertisers for muddying up this issue.

I often hear that but I don't think this is good at all. To be honest I am not subjected to a lot of ads today, but I don't want personalized ads because it always means the advertiser has incentive to collect info on me. Ads aren't worth that, not even close.

You might think otherwise, but for these cases I think there should be opt-in mechanisms instead of the assumption what people want. If they are that off with their ads...

There are no cookie policies in the EU. What we do have is a policy around personal data and identifying users, and cookies are mentioned in passing as a particular way this is achieved in practice.

There are cookie policies in the EU. GDPR covers personal data, of which cookies can be one particular way. The ePrivacy Directive is a separate law, modified but not repealed by GDPR, which addresses cookie data. The difference and interaction between those two laws ends up being extremely significant.

Every single instance of the word "cookie" in the ePrivacy Directive[1] is qualified with either a "for instance" or with "or similar devices".

1. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

My point is that cookies have additional regulations beyond just being personal data covered by GDPR. You are correct that cookie-equivalents are similarly regulated (including most fingerprinting techniques!). But they're not just a special case of GDPR.

Most importantly, the ePD applies to cookies even when they are not personal data. Your post made it sound like the only concern is identifying users via cookies. That is not the case. Non-identifying cookies would not incur obligations under GDPR, but they do incur obligations under the ePD.

This isn't exactly a mystery. Google is doing this. Several of the pieces are already in place.

If you log into a Google account in Chrome, you log into Chrome itself with that Google account. Then Google tools can use your account as an identity signal. This is already available as a feature in Google Ads and Google Analytics. The name of the feature is "Google Signals" - they've posted documentation on how it works and what it does.

This identity signal works cross-domain and cross-device. Google is working to kill off other identity signals with those capabilities that would be available to competitors, such as third-party cookies. (This is also why I believe them when they say they're actively working against browser fingerprinting.)

This is a very good reason in and of itself to stop using Chrome. What you're describing is a very real attack by Google through a kind of regulatory capture on any possible competitor.

Basically, the only tracking solution that becomes viable is their own.

If they become a monopoly by simply providing the best service available, who is harmed? To me it looks like "won't someone please think of the poor advertisers"

Anyone who wants to avoid their services. I don't care if they provide a better experience on the web. I don't wish to do business with them because I don't trust them. No matter how good their experience, I want to use someone else.

There are various proposals they are working under the umbrella of the Privacy Sandbox project, couple of key ones here:

https://github.com/google/ads-privacy/tree/master/proposals/...

https://github.com/WICG/turtledove

Reply on news.ycombinator.com