Cookies are one of the many questionable pacts we have made online, where privacy is exchanged for convenience without being entirely sure about the consequences. As with so many arrangements involving our data, this deal is being rewritten under the gaze of regulators. Last week Google issued an update on how it is replacing cookies on its Chrome browser, which is important because two-thirds of web browsing around the world is on Chrome. Put simply, a cookie is a text file that is dropped into your browser by a website when you visit it. In the UK and EU, you are asked to consent to multiple cookies when you click on a site (and yes it’s worth checking just how many cookies you agree to take on when you give your consent). The new head of the UK’s data watchdog, John Edwards, told BBC Radio 4’s Today programme last week – on international data privacy day – that he is no fan of the consent-clicking process. “That’s not a very effective way of rebalancing the power relationship between consumers and companies that profit from consumers’ data,” he said. Cookie monsters Cookies identify individual users so the website can record all kinds of things about your activity. Some of this info is helpful, like whether you have logged in to the site before, so you don’t have to constantly enter your user name and password every time you visit in the future. This sort of thing is known as a first party cookie. However, there are types of this technology known as third party cookies that facilitate the storing of information (like your browsing history and your location) by commercial partners – often marketing or advertising businesses – that might make you slightly more uncomfortable. If you check the cookie consent box on any website, you will be surprised at the number of advertising and marketing-related cookies. Third party cookies, through agreements with multiple publishers and websites, are able to create a profile of individual users and serve targeted adverts to you while you browse across multiple websites. Like other news publishers, the Guardian asks readers if it can use cookies, for purposes such as measuring how often readers visit and use our site, and showing readers personalised ads. In what appears to be a win for privacy advocates and a blow to publishers, advertisers and the intermediaries that facilitate personalised ads across the web, third party cookies are being phased out across the board. This is in part due to pressure from regulators and pro-privacy laws like GDPR. Apple and Mozilla have blocked third party cookies on their Safari and Firefox browsers and Google is doing the same on Chrome by 2023. Leaving the FLoC behind Google is replacing third party cookies with a set of technologies called a privacy sandbox and last week it announced it was changing one of the key proposals. The initial plan was to bundle people into groups (cohorts) with similar interests based on their browsing habits and allow advertisers to serve ads to those groups. This was called FLoC, for Federated Learning of Cohorts. After feedback from the industry, which included warnings that individuals could still be identified as they browsed across the web under the FLoC system, Google is now proposing a different system. It is called Topics, in which the Chrome browser notes your top interests for that week based on your browsing history and registers them in the browser (like a cookie would) under broad categories like “fitness” or “travel”, which are limited in number. Advertisers and publishers are able to access this data via a browser API, which is a feed of information that they can tap into. Then when users visit a site that has signed up to the system, three of the user’s “topics” of interest are shared with the site and its advertisers, allowing the site to serve ads that reflect the user’s interest in, for instance, rock music or cars. Google said the topics will not include sensitive categories such as gender or race and the system will allow users to see the topics, remove any they don’t like or disable the feature completely. The topics are deleted every three weeks. In the UK the Competition and Markets Authority and the Information Commissioner’s Office are looking at the proposals, from a competition and privacy perspective (ie are there disadvantages for Google’s rivals in provision of online adverts and will users’ data be abused). Rivals are also concerned that Google, which has said other parts of its business like YouTube will adhere to these changes, still has a basic advantage through the sheer amount of existing data it has on users. Vinay Goel, the Google product director in charge of the sandbox project, says: “We have developed these new proposals in the open, seeking feedback at every step to ensure that they work for everyone, without preferential treatment or advantage to Google’s advertising products or to Google’s own sites.” According to the Open Rights Group, which campaigns for people’s digital rights, Google’s new proposals signal an end to the data gold rush under third party cookies. “Conducting behavioural profiling in the browser could constitute an alternative to the existing data-free-for-all model, where your browsing activities are broadcasted to thousands of unknown intermediaries,” says Mariano delli Santi, legal and policy officer at ORG. However, the ORG remains concerned over several issues including the lack of a default opt-in stance, which would see a browser omitted from the scheme unless they chose to be included. This is still behavioural profiling, says the ORG. Goel adds: “We started the Privacy Sandbox initiative to improve web privacy for users, and Topics will allow for users to have greater control over relevant ads without sharing sensitive details such as gender or race.” Nobody’s happy – so everybody wins It is a big change for the digital advertising industry. Farhad Divecha, managing director of UK digital marketing agency Accuracast, wonders if the shift will satisfy anyone. “Privacy advocates are going to feel that this is still not quite enough, because there’s reasons why this is still tracking behaviour. And on the flip side, advertisers are going to say you’re taking away stuff from me. And you’re taking away my ability to target specifically whom I want to be reaching.” Paul Banister, chief strategy officer at US digital ad management firm Cafe Media, says the momentum nonetheless is with privacy. “I think the pendulum has swung pretty far towards privacy here.” But he adds: “because it’s easier to understand the topics system, hopefully it will be more something that users feel good about. And if users are happier with the outcome that is better for advertisers, because it makes people more supportive of what their data is being used for.” This could be just the beginning – as internet users become more aware of that trade off between privacy and convenience, and regulators continue to challenge the marketing industry upon which much of big tech profits rely, the pendulum could swing further.