I think it’s fair to say most of us are happy to leave 2020 behind. We’re all hopeful that 2021 has better things to come, including the returning of freedom of circulation after harsh lockdowns across the globe. Following  privacy trends introduced in previous years, with GDPR, CCPA, ITP, 2021 also marks 1 year since Google announced they would stop supporting third party cookies in Chrome. The objective was to essentially kill third-party cookies in 2 years, so 2022 may be the year where users get some of their internet privacy back.

Even though I believe privacy for users is a good thing, is there a price to pay for internet privacy? Unfortunately the answer is yes.

What are 3rd party cookies and why do they impact privacy?

A cookie is a piece of data stored by a user’s browser. It was designed so websites could keep state information about their users. Cookies are what allow a site to store user settings, keep products on a shopping cart of an e-commerce site, or keeping a user logged in.

There’s 2 types of cookies first-party and third-party. The thing that distinguishes first-party from third-party cookies is who sets them. While first-party cookies are set by the website itself, under the website’s domain, third-party cookies are set by third-party code installed on an website, hosted by a third party domain.

From an availability POV, first party cookies are only available on the domain of the website who sets, whereas third party cookies are available on all websites on which the third party code is installed. This means the state information of a user can be persisted across the internet using third party cookies. Third party cookies can therefore be used for behaviour profiling across the web, Ad Targeting and Retargeting (i.e.: e-commerce ads from products browsed recently), display Social Buttons with information about a social media page and Ad frequency capping, to prevent the same as is shown multiple times across the web.

The overall tracking capabilities provided by third party cookies is the reason why most browsers, including Firefox, Safari and now Chrome, are limiting, or simply blocking them. Third party cookies can be a powerful tracking tool and therefore a privacy hazard.

Let’s summarise the above in a table:

	First Party	Third Party
Cookie Setting	Set by the website	Set by 3rd party code installed on the website
Availabilty	On the website’s domain	Across the web, wherever the 3rd party is installed
Browser Policy	Supported by all browsers. Can be blocked/deleted by users.	Blocked or limited by Safari and Firefox. To be blocked by Chrome
Applications	eCommerce Carts Site preferences Logins	Behaviour profiling Ad Targeting and Retargeting Social Buttons Ad frequency capping

How is (re)targeting and user profiling helping advertisers?

Advertising can be quite expensive. Especially if you’re a small business you want to make sure you get the best bang for your buck.

Over the years marketers have refined their conversion models to ensure they get positive returns on the investments they make on advertising. They project and measure conversion funnels that are based on different user segments that are likely to convert into buying a product, pay for a subscription, or simply join a service.

Advertisers often use their Data Side Platforms (DMP), which are currently mostly based on third-party cookies to segment users and build lookalike models. They then use Demand Side Platforms (DSPs) to upload their user segments and purchase advertising programmatically against chosen profiles (some DSPs, also have DMP capabilities).

If advertisers were to pay the same price to show advertising for users that aren’t remotely interested in their products, the investment would likely have negative returns. Given so, Advertisers are likely to limit their investments on environments where they can’t control the user segments that they target ads against.

So what’s the impact for Ad funded businesses?

There’s still some uncertainty, but Ad funded businesses are expected to have revenue impacts. However, it won’t be the same for all. Remember only third party cookies will be restricted, this means that websites leveraging data for ad targeting purposes, stored in a first party cookie won’t be affected.

So who has tremendous ad traffic, user data platforms, Ad servers and Demand side platforms? You probably guessed right, advertising powerhouses like Google and Facebook. These companies have been dominating the advertising scene for quite some time. The chart below shows their relative marketing share in 2019:

The gap is likely to increase, as these top companies are better positioned to continue to use data for Ad delivery in the future. The reason behind this is that nowadays most ads are delivered programmatically (see chart below) through some sort of demand side platform (Google, Facebook and Amazon, all have their versions). These platforms typically allow advertisers to either use baked in data, or upload extra data to improve ad delivery performance. The aforementioned cookie changes benefit ecosystem that control data gathering, advertising transactions and advertising delivery, ideally under the same domain.

Unfortunately most publishers won’t be in a similar position and therefore are likely to take a hit. Also, this may well mean that users will only enjoy extra privacy on parts of the internet.

Can publishers do something about this?

There’s a number of mitigation strategies that publishers can pursue, the obvious one being reducing the dependency on cookie for user identification to use more reliable methods like email registrations. This is actually quite a big topic, big enough to cover on a future dedicated post. Regardless, if you’re a publisher, here’s a list of ideas, to serve as an appetizer.

• Brush-up your first party data strategy – Rethink the relationship with you user and ensure if you have a first-party identifier for i.e.: email registration. In nowadays world users are privacy aware, so make sure your service justifies the need of a login and it provides added value for the user;
• Look for Partnerships – while alone publishers may find it hard to do a big first party data play, if they can partner with other publishers, or even local telcos or e-commerce websites, maybe they can collectively think about good propositions that benefit both the companies and the users in an effort of driving email registrations.
• Offer Context Targeting as a Proxy for Segmented Audiences – If you’re looking for sports fans, targeting someone reading an depth analysis of a football game is probably going to get you your target. Targeting someone accessing content in real time doesn’t require user identification, it just requires good content categorization and agile ways of getting those categorized traffic buckets to ad buyers
• Invest on Learning and Shaping Chrome’s Privacy Sandbox – As Chrome will be stopping the support of third-party cookies, the company is pitching its Privacy Sandbox as the alternative initiative. It’s mission is to “Create a thriving web ecosystem that is respectful of users and private by default.”. Google is welcoming the community to give feedback by filing issues on explainers hosted on Github. Learn more on how to do it here
• Join a global ID initiative – there are a number of working groups and companies working on global shared id initiatives, with different technical implementations. Here’s a shortlist: iAB’s Digitrust ID Working Group, ID5,  Universal ID 2.0
• Diversify your revenue streams – Every time the advertising industry introduces a new change (which is every other day), we hear someone saying Publishers need to diversify their revenue streams, to be less dependent on advertising. Well, people keep repeating because it’s a wise advice. The most successful examples of this diversifications were probably subscriptions, e-commerce and branded content.

Anyway privacy for users sounds good… What’s the catch?

Potentially, the publishers best bets from the list above are the diversification of revenue streams. Although this makes sense from a business point of view, most the alternative revenue streams found by publishers have the risk of damaging their editorial/ideological independence in the mid/long term.

Let’s look into branded content. Branded content, often referred to as advertorial, is sponsored content that portraits a service, a product, or simply an idea. Branded content does not involve traditional advertising. It can be supported by articles, videos, podcasts, live elements, or by any other media used by the publisher. Branded content can often be mistaken to be regular content, the key is to grab the attention of the user/consumer and drive real engagement. 

Even though most respected publishers have been careful on their branded content executions and typically clearly state when a piece of content has been paid for and by whom, the branded content space is largely unregulated! In it’s nature, branded content is a piece of information (truthful or not) that has been paid for and can be transmitted through media sources previously trusted by an audience. In a world of fake news and social media “mind washing” that doesn’t sound that well, it actually poses a real risk to media’s independence.

Let’s now look at the subscription model. When a media outlet moves from free to access to be paid, either through a full subscription, pay to read, pay to view, or micro pay to access, it converts itself into a transactional b2c product. It’s only fair that users have to pay to consume media, in fact, people have been paying for newspapers since the beginning of press. However, with nowadays progresses in marketing and martech, media execs more then ever know who their users are and what they believe in.

Depending on a finite group of users that share similar ideas may act as an incentive, for editorial teams to create content to meet users believes, in order to keep their interest and investment. When you generalize this idea to all media outlets, you end up in a world that consumes media that depicts those believes (and potential biases), making it hard to establish shared truths.

Finally, let’s touch on e-commerce. From a content independence perspective, selling products on media outlets directly may have similar risks as branded content, as there may be an incentive to use content to push a product sell. Nevertheless, there have been some successful implementations that were able to clearly distinguish content from product. Given that the product could be directly sold from the media website, that provides some level of transparency in terms of who is getting paid and the interests involved. The e-commerce model is perhaps hardest to get right and there are not a lot of success stories out there of media building big e-commerce businesses.

Like it or not, advertising with or without user data, is clearly separated from content. A user can clearly state where the ad is, for example, it could be displayed before content, like pre-roll ads before a video, or is showing on the side, like medium rectangles ads showing on the side of an article. Especially if the ad is traded programmatically, there is little to no relationship between the media outlet and the advertising brand for an ad to get to its placement. This grants a level of independence for media, as it limits the influence of the revenue stream over content creation.

Like any other business, media needs to be able to fund itself and if their main revenue source is impacted, other revenue sources will inevitably have to be found to compensate, otherwise they’ll die. As we’ve seen above, the diversification of revenue streams for media is necessary, but represents a risk on their independence and a risk to our ability to agree on shared truths.

Even though there’s progress to be made in the world of privacy and initiatives like GDPR, CCPA and the death of third-party cookies are important for users’ internet freedom, there’s a lot of work to be done to ensure media independence.

Well funded, independent media is key for democracies to function. When media revenue is threatened, society faces risks which could ultimately damage basic rights. In perspective, are targeted programmatic ads such a bad thing?