‘Cookie apocalypse’ forces profound changes in online advertising

Complex, unloved and often over-intrusive: few are mourning the demise of the third-party cookie — cross-website trackers that Apple has banned and Google will phase out by 2022.

But the so-called “cookie apocalypse” is forcing some profound changes in digital advertising and adtech, which has relied on these parcels of data to power the delivery of targeted ads within seconds of a user opening a website.

While the screw has long been turning on the sector’s working methods, the recent assault on cookies by privacy regulators and browsers such as Apple’s Safari and Google’s Chrome has been an unforgiving lesson in business upheaval.

“The ad ecosystem we see today would not exist without cookies. That is how fundamental they are,” says Ratko Vidakovic, founder of consultancy AdProfs. “Losing them is extremely disruptive from a technical perspective, because they are used by industry at every stage: planning, targeting, measurement and attribution [of sales].”

The trauma for cookie-reliant companies has been described vividly by Jean-Baptiste Rudelle, founder of Criteo, a French adtech group whose market capitalisation has gone from a high of $3.5bn in 2017 to less than $1bn.

“The first time we were caught off guard, we didn’t really think this would be a risk,” he told analysts in November, referring to regulatory assaults and bans on cookies by Apple and Mozilla. “We were a bit in panic mode because, wow . . . those guys overnight can press a button and hurt us a lot.”

His point was that the onslaught was now “part of our business”, forcing adtech groups to reinvent their operations and business model to survive without cookies, which were invented almost 25 years ago.

But which adtech groups will be able to adapt fast enough remains unclear. Criteo’s shares fell by almost a quarter in January after Google announced that Chrome, the dominant product in desktop browsing, with more than 60 per cent of the market, would stop using third-party cookies within two years.

It seems naive to say Google’s initiatives are designed to ensure a healthy online ad ecosystem for all parties

Investors have been more patient with some other big listed players in the sector — such as The Trade Desk and the Rubicon Project — because of the mix of their businesses. But the race to find ways to thrive in a post-cookie world is still in its early stages.

One crucial point is that not all cookies are disappearing. First-party cookies — created by the domain a user visits so it can remember shopping carts or usernames — are unaffected by the bonfire of trackers. Indeed, their value has increased as a source of data to tailor ads to individuals.

Within the advertising market, this may result in a further shift in power. This would move from the open internet, where adtech once thrived — and cookies traced user activity between sites — to more enclosed domains that have detailed data about their direct users.

This closed world stretches from small retailers or publishers, which might ask users to register or pay subscriptions, to big platforms such as Facebook or Google, which hold vast amounts of data on their users.

Some ad executives and analysts see cookie elimination strengthening Google’s market power, making Chrome an almost indispensable intermediary for advertisers that need data to target adverts accurately and track their effectiveness.

“What is Google’s end game?” Tim Nollen and Sean Kumar, analysts at investment bank Macquarie, have asked. “While Google depends on online advertising for the vast majority of its revenue, it seems naive to say Google’s initiatives are designed to ensure a healthy online ad ecosystem for all parties. Google increasingly holds the cards and, barring antitrust regulation, Google can refashion the industry to help serve its needs.”

There are various options for independent adtech operators to reduce their reliance on cookies, but all of these carry a degree of risk.

The most obvious is to establish other systems to replicate the functions of a cookie. But the countless attempts to standardise identity tracking of users — either to make cookies more effective or replace them — are testament to how hard the goal can be to achieve.

Making matters worse, some effective alternatives rely on techniques such as fingerprinting devices that are frowned on by the browser operators and regulators that killed the cookie in the first place.

The UK’s information commissioner noted in a report last year that new device-based online tracking capabilities “are becoming more common and pose much greater risks in terms of systematic monitoring and tracking of individuals, including online behavioural advertising”.

A second approach is for adtech companies to concentrate on serving parts of the advertising market that use no cookies, such as mobile devices and connected televisions. But creeping privacy restrictions could also reach these areas.

The scale of the challenge was recently laid out by the Interactive Advertising Bureau, a global trade body for digital advertising, when it launched its own attempt to establish harmonised industry standards to cope with a post-cookie world.

“With the loss of third-party cookies, and potentially mobile ad IDs thereafter, the default future state of digital media will be 100 per cent anonymous, non-addressable to third-party vendors that support advertising-funded media and services today,” wrote Dennis Buchheim and Jordan Mitchell of the IAB Tech Lab.

The IAB’s Project Rearc acknowledges the solution to will depend on a consent-based system to identify consumers. The most obvious basis would be encrypted log-on details or email addresses. But this could prove an expensive system to operate, with its own privacy problems.

Mr Vidakovic of AdProfs says companies will probably “figure out ways to technically continue to function”, adding that “the big question is whether advertisers will accept the alternative way of working, or just turn to the big platforms like Google, Facebook and Amazon”.