Can Google’s Privacy Sandbox take the heat?
Google is facing a long and lonely road to bring the world into its sandbox.
By 2022, Google Chrome will have removed support for third-party cookies. And such is the hold of Google over the online experience, this means third-party cookies will effectively be phased out. But, much of the Internet economy, and specifically, digital publishing has run on third-party cookies for years.
The systems behind personalized ads, frequency capping, and attribution have all been built over the last 15 years with the assumption that third-party cookies would continue to exist.
Google's own study shows that with an alternative in place, the move would cut the revenue of the top 500 publishers by 52%. Unless whole sections of the publishing industry are going to be left to fall off a cliff, an alternative solution has to be found.
If you want to know more about the differences between first and third-party cookies, and why third-party cookies are viewed as problematic, you can check out our more detailed post here.
But here, we're going to look at Google's Privacy Sandbox proposal to replace third-party cookies when the phase-out happens.
What value are we losing with third-party cookies?
Third-party cookies effectively tell websites information about you, based on your activity on other sites. They make it possible for you to go on a brand new site and see something you've searched for before or something that person of your age, location, average income, race, gender, is likely to respond to.
This enables publishers and websites to command high prices for their audiences. Without third-party cookies, every new visitor is effectively anonymous. Removing them without a replacement threatens to take out a huge chunk of value and revenue for these sites that would force them to make drastic alterations to their business model.
So, a replacement has to give advertisers enough info to serve personalized ads, but still give users privacy by default and control over their information. It's a paradox.
The Privacy Sandbox is a set of many separate proposals that aim to return some anonymity to users while enabling the online economy to continue. These proposals are not yet finalized so we may eventually see a mix of some that gain the most support from the rest of the advertising ecosystem.
The main difference that Privacy Sandbox proposes compared to the current cookie-based system is - rather than each user dragging around a whole sled of personal information, wherever they go, Privacy Sandbox uses anonymized signals (that are not cookies) in the browser. The browser will then send information about this user's browsing habits to the advertiser, detached from any other personal information.
This is what Google calls its 'Privacy Model for the Web'. In Google's own words:
Let's look at some of the core elements of the Privacy Sandbox to see how it's possible to be both private and profitable.
The goals of the privacy sandbox fall into three key areas:
The proposals we are covering here are most relevant to publishers looking to replace the value of their product that will be removed by the phasing out of third-party cookies.
Using Federated Learning of Cohorts, the browser groups users with similar browsing histories together into a group (or "cohort"). Advertisers can select ads for this large group based on mass observations, but cannot pick out or recognize individuals.
This Federated Learning of Cohorts uses machine learning to understand patterns in how certain groups browse. It uses a system called PIGIN (Private Interest Groups, Including Noise), which lets each Chrome browser track a set of interest groups a user is thought to belong to. All data remains on the user's device.
An element of this proposal is to also enable sites to 'blind' themselves from seeing certain data, like a user's IP address, so they don't waste their privacy budget on data they don't need. By limiting collection, data can be used in the process but these information fragments can't be pieced together to identify a single user.
Through this, Google aims to streamline the data collection needed to serve ads without overriding any expectations that your personal data won't be passed around the entire ad tech ecosystem.
A curious element of Google's privacy proposals is that a lot of them are named after birds. There may be an ornithologist among the engineers but Turtledove is actually an acronym, standing for:
Snappy.
This means that rather than a single ad request to the ad server, as happens now, two separate chains of events would be sent. The decision on which ad to serve is then decided on by the browser, rather than the ad server.
These uncorrelated requests are a contextual ad request that can contain the page URL and a separate request, based on advertiser identified interests. This request can't be tied to any other browsing history and can be requested randomly throughout a user's session.
The ad network decides on the winner based on price or publisher rules and the code executes locally within the browser, which cannot send any info off-device.
Confused? Let's look at this in a more practical example.
Using Turtledove, advertisers place users into interest groups, storing this information on the browser, rather than in a third-party cookie. Interest can be registered many times throughout a session.
All this data, which would typically be stored in a third-party cookie as part of a richer profile on the ad server, can now no longer be linked to other information and is stored on the user's browser.
Let's imagine how this would work for a user browsing a publication after doing some research into a new squash racquet.
Rather than a cookie that identifies Joe Bloggs, 40-55 years old, who lives in Oakland, interested in squash racquets, and earns a medium to high income, this process would just register a session as being in an interest category for squash racquets.
As the session continues, the browser builds a set of interest groups and Chrome will call the ad servers at sporadic intervals to return ads that relate to these interest groups and store them. They don't serve them immediately. It also only uses a small section of the interest groups you register, so the ad exchanges can't build too-detailed a profile on you. These requests are also scorched of all other information, including first-party cookies, referrer, and user agents.
The second uncorrelated request from our 'Two uncorrelated requests - (TUR ) is a request for a contextual auction that relies only on contextual or publisher first-party data. This could be a page on a site like 'The ten best squash racquets ever'. Publishers can choose to only use this auction if they wish. But now we have both requests and it is time to serve an ad.
As the browser has been requesting ads sporadically there is a bank of 'interest group' ads that can be used for this placement. We also have the ad that has bid on the contextual data to choose from.
In our scenario, we are offering advertisers access to a browser that is part of a group 'Interested in squash racquets,' or we offer space on a browser that is reading 'The ten best squash racquets ever.'.
The Turtledove API finds which is more valuable. Publishers also can create rules or bidding logic to choose how much value should be given by each to trump the other. Some publishers may find context far more valuable so will only serve an interest group ad if the value is say 3X the contextual.
With the choice made, if an interest group ad is shown, it is shown in what's known as a 'fenced frame', a sandbox that prevents the publisher from seeing what's inside, and stops the ad from seeing what is on the page it renders on.
This prevents companies from meshing interest groups with the site and using this cross-data to make profiles that again erode our privacy. Any brand safety preferences are sent along with the ad so the page is appropriate for the advertiser.
Here you can see a basic description of how Turtledove selects ads:
Google's privacy sandbox suggests it can be done without a stable, global, per-user identifier. Segmenting users into trusted and untrusted groups is an elegant solution that solves the issue and preserves privacy.
Google's proposed solution will ask Chrome users to complete a CAPTCHA-like program that will then produce anonymous “trust tokens” that act as a signifier that, yes, this is a real user.
But, using common identifiers across advertiser and publisher sites to track conversions, opens users up to other forms of cross-site tracking. This is a big no-no in the Privacy sandbox.
Google's conversion measurement API alternative to cookies will let an advertiser know if a user saw the ad if they eventually bought the product or clicked through to the destination page. As the data is anonymized, it would not be possible to back-track a specific user.
This is a bit more simplistic simple click-based attribution than what we're currently able to do so it suggests advertisers will alter their strategy if they're forced to adopt it. Speaking in Digiday, Matt McIntyre, head of programmatic advertising for EMEA for Essence suggested that this would lead to a greater focus on direct-response ad campaigns because of this proposal.
Despite this goal of a unified system, publishers and browsers are still searching out alternatives of their own as this process rumbles on. As well as hoping for a more lucrative solution, publishers don't want to rely on a single solution, especially one entirely under Google's control again. Publishers have already expressed concerns at the idea of relying on a 'black-box' solution that depends on trusting Google.
While any Google solution is likely to gain significant traction, diversification between a handful of strategies will be a key part of the cookie-less future.
We will be covering the other front-running options for the alternative to third-party cookies in upcoming posts.
In the meantime, if you want to know why Google made this move you can check out the leading theories here.
By 2022, Google Chrome will have removed support for third-party cookies. And such is the hold of Google over the online experience, this means third-party cookies will effectively be phased out. But, much of the Internet economy, and specifically, digital publishing has run on third-party cookies for years.
The systems behind personalized ads, frequency capping, and attribution have all been built over the last 15 years with the assumption that third-party cookies would continue to exist.
Google's own study shows that with an alternative in place, the move would cut the revenue of the top 500 publishers by 52%. Unless whole sections of the publishing industry are going to be left to fall off a cliff, an alternative solution has to be found.
If you want to know more about the differences between first and third-party cookies, and why third-party cookies are viewed as problematic, you can check out our more detailed post here.
But here, we're going to look at Google's Privacy Sandbox proposal to replace third-party cookies when the phase-out happens.
What value are we losing with third-party cookies?
Third-party cookies effectively tell websites information about you, based on your activity on other sites. They make it possible for you to go on a brand new site and see something you've searched for before or something that person of your age, location, average income, race, gender, is likely to respond to. This enables publishers and websites to command high prices for their audiences. Without third-party cookies, every new visitor is effectively anonymous. Removing them without a replacement threatens to take out a huge chunk of value and revenue for these sites that would force them to make drastic alterations to their business model.
So, a replacement has to give advertisers enough info to serve personalized ads, but still give users privacy by default and control over their information. It's a paradox.
The Privacy Sandbox
Google's current primary alternative is known as the Privacy Sandbox. The project's mission is to "Create a thriving web ecosystem that is respectful of users and private by default."The Privacy Sandbox is a set of many separate proposals that aim to return some anonymity to users while enabling the online economy to continue. These proposals are not yet finalized so we may eventually see a mix of some that gain the most support from the rest of the advertising ecosystem.
The main difference that Privacy Sandbox proposes compared to the current cookie-based system is - rather than each user dragging around a whole sled of personal information, wherever they go, Privacy Sandbox uses anonymized signals (that are not cookies) in the browser. The browser will then send information about this user's browsing habits to the advertiser, detached from any other personal information.
This is what Google calls its 'Privacy Model for the Web'. In Google's own words:
'Potential use cases must respect the invariant that it remains hard to join identity across first parties, but subject to that limit, there is room to allow sufficiently useful information to flow in a privacy-respecting way. Both "sufficiently useful" and "privacy-respecting" must be evaluated on a case-by-case basis. 'This is where it gets difficult. "Privacy-respecting" and "sufficiently useful" have so far been mutually exclusive states.
Let's look at some of the core elements of the Privacy Sandbox to see how it's possible to be both private and profitable.
The goals of the privacy sandbox fall into three key areas:
- Replacing functionality served by cross-site tracking
- Turning Down Third-Party Cookies
- Mitigating workarounds
The proposals we are covering here are most relevant to publishers looking to replace the value of their product that will be removed by the phasing out of third-party cookies.
Federated Learning of Cohorts
The next revolution in the sandbox is a shift from marking single 'users' - with a cookie - to marking behavior into 'cohorts' based on interests.Using Federated Learning of Cohorts, the browser groups users with similar browsing histories together into a group (or "cohort"). Advertisers can select ads for this large group based on mass observations, but cannot pick out or recognize individuals.
This Federated Learning of Cohorts uses machine learning to understand patterns in how certain groups browse. It uses a system called PIGIN (Private Interest Groups, Including Noise), which lets each Chrome browser track a set of interest groups a user is thought to belong to. All data remains on the user's device.
Implementing a privacy budget
Even without third-party cookies, Google knows that people will find a way to combine different strands of data to build up more detailed user profiles. One of the ways the Privacy Sandbox intends to prevent this is by limiting the total amount of potentially identifiable data that sites can access. The privacy budget API limits the amount of data that websites can absorb from Chrome users by setting a definite data budget. Access to any identifiable data would be measurable and budgeted out to find a balance between user privacy and utility for the advertiser.An element of this proposal is to also enable sites to 'blind' themselves from seeing certain data, like a user's IP address, so they don't waste their privacy budget on data they don't need. By limiting collection, data can be used in the process but these information fragments can't be pieced together to identify a single user.
Through this, Google aims to streamline the data collection needed to serve ads without overriding any expectations that your personal data won't be passed around the entire ad tech ecosystem.
The TURTLEDOVE API
The big question for publishers will always be how programmatic auctions can exist in this world. Without user data to spice up ad spaces, the demand between advertisers would fall flat. The proposed answer to that is the Turtledove API.A curious element of Google's privacy proposals is that a lot of them are named after birds. There may be an ornithologist among the engineers but Turtledove is actually an acronym, standing for:
Snappy.
This means that rather than a single ad request to the ad server, as happens now, two separate chains of events would be sent. The decision on which ad to serve is then decided on by the browser, rather than the ad server.
These uncorrelated requests are a contextual ad request that can contain the page URL and a separate request, based on advertiser identified interests. This request can't be tied to any other browsing history and can be requested randomly throughout a user's session.
The ad network decides on the winner based on price or publisher rules and the code executes locally within the browser, which cannot send any info off-device.
Confused? Let's look at this in a more practical example.
Using Turtledove, advertisers place users into interest groups, storing this information on the browser, rather than in a third-party cookie. Interest can be registered many times throughout a session.
All this data, which would typically be stored in a third-party cookie as part of a richer profile on the ad server, can now no longer be linked to other information and is stored on the user's browser.
Let's imagine how this would work for a user browsing a publication after doing some research into a new squash racquet.
Rather than a cookie that identifies Joe Bloggs, 40-55 years old, who lives in Oakland, interested in squash racquets, and earns a medium to high income, this process would just register a session as being in an interest category for squash racquets.
As the session continues, the browser builds a set of interest groups and Chrome will call the ad servers at sporadic intervals to return ads that relate to these interest groups and store them. They don't serve them immediately. It also only uses a small section of the interest groups you register, so the ad exchanges can't build too-detailed a profile on you. These requests are also scorched of all other information, including first-party cookies, referrer, and user agents.
The second uncorrelated request from our 'Two uncorrelated requests - (TUR ) is a request for a contextual auction that relies only on contextual or publisher first-party data. This could be a page on a site like 'The ten best squash racquets ever'. Publishers can choose to only use this auction if they wish. But now we have both requests and it is time to serve an ad.
As the browser has been requesting ads sporadically there is a bank of 'interest group' ads that can be used for this placement. We also have the ad that has bid on the contextual data to choose from.
In our scenario, we are offering advertisers access to a browser that is part of a group 'Interested in squash racquets,' or we offer space on a browser that is reading 'The ten best squash racquets ever.'.
The Turtledove API finds which is more valuable. Publishers also can create rules or bidding logic to choose how much value should be given by each to trump the other. Some publishers may find context far more valuable so will only serve an interest group ad if the value is say 3X the contextual.
With the choice made, if an interest group ad is shown, it is shown in what's known as a 'fenced frame', a sandbox that prevents the publisher from seeing what's inside, and stops the ad from seeing what is on the page it renders on.
This prevents companies from meshing interest groups with the site and using this cross-data to make profiles that again erode our privacy. Any brand safety preferences are sent along with the ad so the page is appropriate for the advertiser.
Here you can see a basic description of how Turtledove selects ads:
User or bot? Say hello to Trust Tokens
Third-party cookies have had a positive use case in that they help prevent fraud by identifying the real users from false click bots. But, in terms of user privacy, having a third-party cookie to do this is like using a sledgehammer to crack a walnut.Google's privacy sandbox suggests it can be done without a stable, global, per-user identifier. Segmenting users into trusted and untrusted groups is an elegant solution that solves the issue and preserves privacy.
Google's proposed solution will ask Chrome users to complete a CAPTCHA-like program that will then produce anonymous “trust tokens” that act as a signifier that, yes, this is a real user.
Click-Through Conversion Measurement
The web ad industry measures conversions via identifiers that can be associated across sites. These cookies entwine information about the ads that were clicked with information about activity on the advertiser's site. This allows advertisers to measure ROI and helps paint a detailed picture of exactly what action an ad has influenced.But, using common identifiers across advertiser and publisher sites to track conversions, opens users up to other forms of cross-site tracking. This is a big no-no in the Privacy sandbox.
Google's conversion measurement API alternative to cookies will let an advertiser know if a user saw the ad if they eventually bought the product or clicked through to the destination page. As the data is anonymized, it would not be possible to back-track a specific user.
This is a bit more simplistic simple click-based attribution than what we're currently able to do so it suggests advertisers will alter their strategy if they're forced to adopt it. Speaking in Digiday, Matt McIntyre, head of programmatic advertising for EMEA for Essence suggested that this would lead to a greater focus on direct-response ad campaigns because of this proposal.
Privacy Sandbox: Endgame
There are more elements to the sandbox that you can learn more about here. Google is currently testing, refining, and gauging the general reaction before anything is actively rolled out. But, the final goal for this entire process is to make these APIs into open web standards that get adopted by other browsers like Safari and Mozilla.Despite this goal of a unified system, publishers and browsers are still searching out alternatives of their own as this process rumbles on. As well as hoping for a more lucrative solution, publishers don't want to rely on a single solution, especially one entirely under Google's control again. Publishers have already expressed concerns at the idea of relying on a 'black-box' solution that depends on trusting Google.
While any Google solution is likely to gain significant traction, diversification between a handful of strategies will be a key part of the cookie-less future.
We will be covering the other front-running options for the alternative to third-party cookies in upcoming posts.
In the meantime, if you want to know why Google made this move you can check out the leading theories here.
