What's the next course for marketers now cookies are off the menu?

For every second over the past two decades, third-party cookies have helped marketers do their job. A staple of online advertising, the small blocks of data that help compile a record of users' browsing histories have allowed for the growth of a $478bn global digital advertising market and underpin the free internet as we know it.

Yet as the public grows increasingly weary of being tracked online – a sentiment now backed by privacy legislation – the third-party cookie is to be formally deprecated.

Aside from the fact that cookies were never designed with advertisers in mind, further seeds of change came when browsers such as Firefox started blocking third-party cookies by default. It is a policy last year adopted by Apple’s Safari before more recent moves to give iOS users the option to opt out of app tracking too. Now, the world’s most popular browser, Google Chrome, is also to succumb to the inevitable.

In response, adtech suppliers, tech giants, publishers, agencies and advertisers are racing to build workable alternatives, with the winning technologies having the potential to define the future of online marketing for years to come.

But to demonstrate the scale of the issue, the cookie phase-out has been delayed, and last month Google, claiming not everyone was fully prepared for such a fundamental change, announced Chrome would maintain the use of tracking cookies for another year beyond its original deadline. Adland, no doubt, breathed a sigh of relief.

This move, from early 2022 until late 2023, will give the industry more time to prepare for alternative ways of working, many of which require more experimentation to test ad effectiveness as much as legislative, competitive and ethical compliance.

The question now is: what more should be done with the gift of extra time? After all, one thing is clear, no-one yet has all the answers.

Rethinking the commercial internet

Although the pressure to change comes largely from outside the ad and tech industries, there is little question that the scale and influence of Google, Facebook and Apple means much of what is now happening is being driven by them.

Google is currently testing its new Privacy Sandbox, which includes dozens of proposals. So far it has tested five of these as it seeks to replace tracking cookies, while ensuring advertisers can still aggregate data about attribution and conversions.

The most prominent proposal is the Federated Learning of Cohorts (FLoC), a machine-learning technique that places non-identifiable users into cohorts linked by interests and behaviours. It is controversial and has raised eyebrows among publishers, adtech providers and ethicists – as well as the UK’s competition watchdog, which is concerned that removing tracking cookies from Chrome and replacing them with alternatives could impede competition if they overly favour Google.

Google has agreed to a set of binding commitments with the CMA. However, the development – which comes after its plans to test FLoC were prevented by GDPR – reveals the balancing act that platforms must walk as the web recalibrates the way it works.

As Google continues to test and consult with industry, Claire Norburn, its UK ads privacy lead, says advertisers should prepare by considering whether they are “sufficiently nurturing” their first-party and direct-to-consumer relationships, as associated strategies should now be a priority.

“Maintaining clean and connected first-party data within your internal systems will put you in good stead for potential future changes,” she says, adding that an accurate measurement ecosystem is also key.

“Managing future shifts and leveraging insights around customer actions and online conversion measurements via Google’s global site tag will help optimise digital marketing campaigns.”

Meanwhile, Facebook has revealed more of its own roadmap, which will be led by privacy enhancing technologies (PETs). PETs, according to Nick Baughan, director of agencies UK & Ireland, will effectively make it “impossible” for the platform to learn about what users are doing outside its products.

These include some wildly complex cryptographic techniques. One example is secure multi-party computation, which will allow Facebook and advertisers to work together without having to share each others’ data. Another is on-device learning, which means a user can still receive personalised ads, but no personally identifiable user data is held by Facebook’s servers.

Over the next few years, Facebook’s product innovation is also set to lean towards contextual advertising and will rely more on behaviour than on personal data.

But communications around the balance between privacy and personalisation need to be simplified more generally online, Baughan says. He worries that the variety of different frameworks, individual pieces of legislation and approaches taken by different platforms make things confusing. In turn, this risks muddying the message about the “value exchange” between users and an ad-funded, free internet.

“The degree to which we’re able to get to a useful consensus will depend on the degree of collaboration across the full ecosystem,” Baughan says. He adds that the industry is only in “the foothills” of what will be years-long efforts to “recreate the commercial internet” with a focus on privacy.

“Preparation today is not about reacting to big seismic changes, because those aren’t quite here yet,” he says. “Preparation is about building the necessary skill sets to be able to adapt in the future, that don’t necessarily exist in all advertisers, or all agencies.”

Apple: has made a virtue of its privacy protections including in this ad by TBWA\Media Arts Lab

The time to test and learn

Amid the uncertainty, there are some advertisers, particularly in the ecommerce space, that appear well positioned to deal with the changes and are keen to experiment. However, others think of the changes only as “tomorrow’s problem”, as one agency boss puts it.

Yet whatever the level of understanding and preparedness, it is clear that the uncertainty has provided endorsement for the role of agencies more broadly. After years of disintermediation and headlines about advertisers in-housing, the level of guiding expertise required to tackle the cookie issue has given agencies a sense of renewed value.

“This set of changes, more than ever, validates an agency model,” according to Richard Dance, chief digital officer at Publicis Media, whose clients include Samsung, Disney and Procter & Gamble. “There are going to be a hell of a lot of people saying they have cracked this, and you will need a certain amount of neutrality to cut through that and a certain breadth of expertise that is hard to get in an in-house operation.”

On a practical level, this has led Publicis to build a privacy impact assessment tool with which it has now audited every one of its clients to understand their approaches to data. The findings have allowed the agency to work out how integral different types of data are to a client’s marketing efforts, and then, by comparing the results to industry averages, the level of dependence on high-risk areas.

With this information, Publicis has been busy delivering workshops and setting out bespoke plans for each client.

Other agencies report similar approaches, and although different clients have varying levels of interest and awareness, workshops have thus far been sold-out affairs.

There are also reports of wider, inter-agency collaboration within holding companies. For Publicis, that principally means working with Epsilon, which it acquired in 2019, as it ramps up use of consented, first-party data approaches.

Meanwhile, WPP’s Wavemaker says it has seen “unprecedented” network collaboration, particularly with its Choreograph operation, which unites the data units of Group M and Wunderman Thompson into a single company for all WPP clients and agencies. Taking an “ethical” approach, Choreograph, like Epsilon, was built to help clients get more out of their first-party data and apply privacy-first approaches to marketing.

“This has been the most collaborative I’ve ever worked with other agencies,” Tarik Windle, head of precision at Wavemaker UK, says. He adds that preparing for a post-cookie world is not only about tech and data, but using the power of a networked group to deal with the scale of the challenge.

In tandem with these approaches, Windle also notes that new skills will be required and agencies will be elevating the roles linked to data science to sit alongside more traditional disciplines such as media and creative strategy.

“With less data potentially available, or by bringing in different types of data or approaches, this will be integral,” he says. “Data science skills will certainly become more important and will help bring insights we can use with our media strategies.”

Independent digital media agency Brainlabs notes a similar trend, and wants to use data science to unlock what it views as much more powerful technologies and techniques that move beyond the third-party cookie.

“New machine-learning modelling techniques will really come to the fore,” Mark Syal, global SVP, product and tech, says. “It’s certainly where I start to feel much more comfortable about using data.”

Crucially, modelling is an approach that can “fill in the data gaps,” he adds. Syal, whose agency works with clients including TUI, the AA and Boots, says that it can also offer increased scale and accuracy as it makes “informed guesses” about what state of mind a user is in without using personal identifiers.

“It’s starting to feel like more of a craft than an invasion of privacy,” he adds.

"New machine-learning modelling techniques will really come to the fore"

Although many agencies have used data science for some time and effectively integrated it with media and creative strategy, there is a sense across adland this is a trend only set to increase, as the alternatives to tracking cookies require doing more with less data, or working with different types of data to mine for insights.

What is also clear, is that, over the next 18 months, adland will need to operate in a test-and-learn mode.

“The move to a more privacy-centric advertising ecosystem is good for customers, advertisers and publishers alike,” Nic Travis, head of paid digital marketing at Lloyds Banking Group, says.

But it requires partnerships and experimentation, he warns. “There is no single product that can solve all potential needs, in an increasingly fragmented landscape.”

Tina Lakhani, head of ad tech at IAB UK, agrees. “We really don’t see there being just one solution that will replace all the functions of the third-party cookie.”

This is where things can become complicated, and advertisers will need to speak to their agencies to understand what is being developed. From “cohorts” and “clean rooms”, to “universal IDs” or “contextual adtech”, they will need to understand which new partnerships to foster and which solutions will fit different needs.

“We need everyone to be speaking to the whole supply chain,” Lakhani says. “Everyone needs to be having a conversation together for this to work.”

An adtech gold rush

The marketing toolbox of the future will, therefore, look quite different. Of the myriad vendors preparing solutions for a post-cookie world on the open web, The Trade Desk is the first to have contributed to the Partnership for Responsible Addressable Media working group, run by IAB Tech Lab.

An identity-based tracking solution, Unified ID 2.0 has consequently surfaced as something of a forerunner, although analogous solutions from Liveramp and ID5 also exist.

The technology uses a central authority to assign web users an advertising ID, such as an email address, but encrypts the data, so advertisers would see only code from their side.

Unified IDs would allow for much of the industry to carry on with little disruption, although advertisers would not be able to collect the same amount of information as in the past.

However, as Joel Livesey, senior director, inventory partnerships, EMEA, at The Trade Desk, notes, cookies, a technology long ago overburdened by advertising, are good for identifying devices more than they are users, and universal IDs work consistently across mobile, desktop and beyond.

“This makes things like frequency capping, or sequential advertising much improved,” he says.

Universal IDs are not without their critics, though, many of whom do not believe they are sufficiently different enough from tracking cookies.

"ISBA is looking closely at lots of emerging technologies but is not promoting or endorsing any one solution at this stage"

However, IAB Tech Lab wants to launch a Global Privacy Platform, which would allow companies that use Unified ID 2.0 and other
methods of addressability to offer consumers a way to opt out of ad tracking.

ISBA, the trade body representing UK advertisers, says there is a lot of activity in this area as adtech suppliers eye yet another gold rush – but it is not currently backing one horse.

“ISBA is looking closely at lots of emerging technologies but is not promoting or endorsing any one solution at this stage,” Clare O’Brien, head of media effectiveness and performance, says.

“The next two years are critical and advertisers will need to research and experiment and most importantly really interrogate what is coming on to the market to replace third-party cookies.”

It means adland will need to do its homework, ISBA says. That includes looking at the new entrants – such as InfoSum and Permutive – which use different technologies from those of the more established players; the former offering a “decentralised” approach to data sharing that protects privacy, and the latter “edge processing”, where data is generated on devices rather than the cloud.

Permutive, as a data platform, is also designed exclusively for publishers, which also have a crucial role to play in the phase out of tracking cookies.

The real life blood of the internet

The Association for Online Publishers, which has a membership that includes Guardian Media Group, News UK and Hearst, recently surveyed its board members. Eighty-five per cent said they have processes that rely on third-party cookies, but there are “varying degrees” of how prepared they feel about cookies’ demise.

“What’s consistent is that all publishers are feeling the same pressures, often driven by agencies, to adopt future solutions that will most closely mirror the status quo,” AOP managing director Richard Reeves says.

“However, premium publishers recognise they own the most valuable currency here – their relationship with readers that subsequently informs first-party data – and are therefore resistant to being dictated to by the buy side.”

Publishers say they recognise the “massive” importance that third-party cookies have held, up to this point. They have been investing in alternative ID solutions and experimented with Google’s FLoC. There has also been a shift for publishers to create and monetise their own audience segments and build proprietary tech that leverages first-party data.

Reeves says the continued enrichment of their first-party data will not only have a greater influence on advertising, it will help drive lead generation, ecommerce revenue and editorial strategy.

The picture being presented by many publishers – those large enough not to have to rely on Google – suggests they are aiming to be truly data-driven businesses, as independent of big tech as possible.

“If publishers can get this right, control will effectively be back in their hands,” Reeves says. “So there’s a general consensus they will continue to resist external pressures that are not in their best interests, or those of their readers.”

The power of logged-in, fully consented data is therefore deemed essential for most publishers and, in some instances, has led them to make strategic acquisitions to capitalise on the changes. Future, for example, purchased price-comparison site GoCompare last year for $794m, giving it access both to first-party logged-in and personally identifiable information.

“All publishers are investing more in their reader-first strategies, such as registrations and subscriptions, to limit the effect of any advertising decline and to bolster their first-party data capabilities,” Damon Reeve, chief executive of The Ozone Project, the joint digital ad sales house set up by publishers in 2018, says.

"Data doesn’t drive the internet from a consumer point of view, content does"

As this shift has taken place, Reeve says his team has been working to develop new methods and techniques for targeting, optimising and inter-operating with platforms without the use of third-party cookies, while reducing the use of user-level data in “most” activities.

This means experimenting with some of the technologies developed by the adtech market, and Ozone is now testing different approaches with several partners, although it is leaning towards segment-based or group-based data sharing, rather than universal IDs. It is also, with positive results, experimenting with predictive modelling AI.

Whatever route publishers take, their role will remain central, and media planners say they are watching closely.

“Data doesn’t drive the internet from a consumer point of view, content does,” Andrew Mason, chief media officer at Digitas UK, says. “Content is the lifeblood of the internet and without it I have no audience. I’m a media planner; it’s vitally important.”

Although publisher revenues could be disrupted following the immediate deprecation of third-party cookies, Reeve believes the brand push for privacy compliance and greater transparency and context, means premium publishers should benefit.

“But this won’t happen by default,” he says. “Publishers need to find the right ways to monetise their first-party data to capture its value.”

The path for smaller publishers is less clear, however, and Reeve suspects it is most likely that they will end up relying more heavily on Google.

An end to lazy marketing?

“The open internet has become such a valuable tool for society,” Lakhani says. “Especially so during lockdown; we’ve been able to get through the last year and a half because of free news information and by linking with family and friends through the internet. And so much of that is ad-funded.”

Being able to find a solution that works for the sustainability of the open web is something that is not just important for the industry, but all of society, Lakhani says.

And while change is never easy, others see only opportunities to do better. “I genuinely see this as a net positive,” Dance says. “There has been quite a lot of lazy, habitual thinking in digital marketing and it’s good to clear that out and take a fresh look at the assumptions we have made.”

Sorting the cookie issue could even usher in better creative, particularly if it forces brands to build better value exchanges with consumers, thus helping power more advertising with first-party, consented data.

“Ultimately, we want to create more value for consumers,” Sol Ghafoor, director of strategic services at digital creative agency AnalogFolk, says.

Ghafoor, whose clients include Nike, L’Oréal and Hyundai, argues there needs to be a shift towards embedding behaviour and context in all creative and experience design. It is, he says, a philosophy that guides AnalogFolk’s output, and he thinks it will help define the new world adland is building.

“To collect data, you should create something of real value, and by doing so that creates a balance between consumers and brands.”

Adland now has to find all the right balances if it wants wholesale and equitable recalibration – and to do so against a ticking clock. Yet getting it right, for everyone, holds the promise of delivering a fairer, better internet.

*Source for table: IAB’s State of Data 2021 produced by Ipsos in March 2021 for the US market 

---

Bye bye, GDPR. Hello, brexit benefit?

By Simon Gwynn

Arguably, there has been little evidence so far of any tangible benefit to the UK economy from its newfound “sovereignty”, but for the advocates of Brexit, the dream of a freewheeling global Britain unbound from the shackles of unnecessary European bureaucracy remains central to its appeal.

And if Oliver Dowden, the then culture secretary (now succeeded by Nadine Dorries), is to be believed, one of the biggest prizes will come in the opportunity to rethink UK data rules – diverging from the EU’s General Data Protection Regulation, in force since 2018.

In an interview with the Telegraph last month, Dowden said he wanted “light touch” regulation that would nevertheless set the “gold standard”, and make it easy for the UK to reach agreements on cross-border data sharing with non-EU markets. Dowden’s plans include limiting the use of cookie permission pop-up boxes and easing the compliance burden on small companies and organisations.

According to IAB UK’s Tina Lakhani, the proposals could offer some benefits to consumers, but pose risks to advertising businesses. “Overall, the digital ecosystem is shifting to become more privacy-conscious and the government has been clear that any new framework needs to continue to deliver on security, privacy, trust and responsible use of data,” she says.

“IAB UK research shows that people find cookie banners and pop-ups among the most annoying aspects of digital advertising, so addressing that would be a big step in improving people’s online experience.

“However, businesses don’t thrive on regulatory uncertainty or inconsistency. Changes to current UK GDPR or ePrivacy laws will create disruption in the short term and potentially a more fragmented market for advertisers that will face different compliance demands in different markets. It’s also essential that any changes don’t compromise the UK’s data adequacy with the EU which would be a huge blow for our industry, risking data freezes with the EU.”

---

How the cookie has crumbled

The way cookies are used now is a far cry from the original intention 

1994

Lou Montulli, a 23-year-old Netscape engineer, invented the cookie to give websites a “memory”

1996

Advertisers learned how to “hack” cookies to follow people around the internet

2008

Google launched Chrome, now the world’s most-used web browser

2014

Spanish Data Protection Authority issued the EU’s first fines for failure to properly inform visitors about the use of cookies

2018

General Data Protection Regulation (GDPR) implemented across EU, forcing websites to ask for consent before tracking

2019

Firefox blocked third-party tracking cookies by default

2019

ICO launched a review of practices of the adtech market

2019

Google announced The Privacy Sandbox to create web standards for websites to access user information without compromising privacy

2020

Apple’s Safari blocked all third-party cookies by default and launched Intelligent Tracking Prevention (ITP) privacy feature

2021

Montulli cites the web’s reliance on advertising as a revenue source as “very detrimental” to society and “perverts the user experience”

Jan 2021

UK’s Competition and Markets Authority began investigation into Google’s Privacy Sandbox browser and whether it could cause adspend to become more concentrated on Google

Jun 2021

Google announced a delay to its plans to phase out third-party cookies in the Chrome browser until 2023

This story first appeared on campaignlive.co.uk.