The Vice President of Google overseeing the Privacy Sandbox project announced the decision to maintain the current approach to blocking third-party cookies in Chrome — cookies set by domains different from the current page's domain will only be blocked by default in 'incognito' mode. The use of Privacy Sandbox technologies in the ecosystem will also be reviewed, with plans for further advancement to be prepared in the coming months.
It is noted that the decision was made because much has changed since the launch of the Privacy Sandbox initiative in 2019, for instance, the advancement of privacy protection technologies has accelerated, AI-based methods for ensuring user security have been implemented, and the global regulatory framework for industry regulation has changed.
Last summer, Google abandoned the idea of completely discontinuing support for third-party cookies in Chrome, but intended to introduce a dialog for user consent regarding enabling blocking. Now this plan has been scrapped, and blocking will only occur if the corresponding settings are enabled in the 'Privacy and Security' section, meaning that instead of introducing the concept of 'block by default, but the user can opt out', the scheme of 'third-party cookies allowed by default, but the user can choose to enable blocking' will be retained.
Third-party cookies are understood to be cookies set by domains different from the current page's domain. For example, when third-party cookies are blocked, code from site 'C', embedded via iframe on sites 'A' and 'B', will not be able to access the cookies shared between those sites, and the cookies set by site 'C' will be unavailable when loading code while accessing sites 'A' and 'B'. Third-party cookies are typically used for tracking user movements across sites within ad networks, social media widgets, and web analytics systems. In Firefox, third-party cookies have been blocked by default since 2019, and in Safari since 2020.
Instead of third-party cookies, Google has promoted a range of specialized APIs that address users' privacy needs, such as FedCM (Federated Credential Management, which allows for the creation of consolidated identification services), Private State Tokens (which enable user segmentation without using cross-site identifiers), Topics (which rank users by interest groups), Protected Audience (targeting and audience research), and Attribution Reporting (measuring advertising effectiveness).
Despite Google's years of efforts to promote Privacy Sandbox technologies, the online advertising industry was unprepared to abandon the use of tracking cookies. This change also raised concerns among regulators that the blocking of third-party cookies could be used by Google to suppress competition and abuse its dominant position in the browser market with Chrome to advantage its advertising services.
Furthermore, Google's initiative faced resistance in the community and criticism related to the fact that the alternatives to tracking cookies do not address all issues and create new risks, such as conditions for user discrimination and an additional factor for covert identification and tracking of user movements.
The announcement also mentions the intention to activate the IP Protection mechanism in incognito mode. This is slated for activation in the third quarter of this year. IP Protection will hide the user's IP address from website owners by routing traffic not directly but through a proxy.servers. When IP Protection is enabled, the target server will only see the proxy address as the incoming IP address, similar to the use of VPN. To anonymize the request, there is a mention of the possibility of passing the request sequentially through several proxies. In this case, information about the client's IP address will only be known to the first proxy, while the second proxy in the chain will see the address of the first proxy.
Source: opennet.ru
