WTF is Chrome’s SameSite cookie update?
On February, 4, Google is set to roll out a new Chrome update that promises a bunch of new features designed to make the browser faster and more secure — including a new approach to cookies.
The SameSite update will require website owners to explicitly state label the third-party cookies that can be used on other sites. Cookies without the proper labelling won’t work in the Chrome browser, which has 64% of the overall browser market, according to Stacounter.
What is the change?
Google first announced in May last year that cookies that do not include the “SameSite=None” and “Secure” labels won’t be accessible by third parties, such as ad tech companies, in Chrome version 80 and beyond. The Secure label means cookies need to be set and read via HTTPS connections.
Right now, the Chrome SameSite cookie default is: “None,” which allows third-party cookies to track users across sites. But from February, cookies will default into “SameSite=Lax,” which means cookies are only set when the domain in the URL of the browser matches the domain of the cookie — a first-party cookie.
Any cookie with the “SameSite=None” label must also have a secure flag, meaning it will only be created and sent through requests made over HTTPs. Meanwhile, the “SameSite=Strict” designation restricts cross-site sharing altogether, even between different domains that are owned by the same publisher.
Mozilla’s Firefox and Microsoft’s Edge say they will also adopt the SameSite=Lax default.
Why is Google making this update?
Third-party cookies can make people vulnerable to malicious tracking, data leakage and can also make them susceptible to what are known as cross-site request forgery attacks. A user might click on a nefarious link in an email that allows a bad actor the ability to log into their banking website, for example.
“In order to move the web ecosystem to a more healthy place, we are changing the default behavior for when SameSite is not specified to automatically default to a more secure option rather than a less secure option,” said a Google spokesperson.
What do publishers need to do in order to get ready for February?
Publishers can begin testing whether their sites are affected by going to chrome://flags and enabling #same-site-by-default-cookies and #cookies-without-same-site-must-be-secure to see whether anything breaks. They should also migrate to HTTPS secure pages, if they haven’t done so already.
Google is encouraging publishers to review the alerts in their developer tools to check whether vendors, including ad tech and analytics providers, are setting or accessing third-party cookies on their sites without the correct labeling.
What are the risks?
Sometimes publishers use third-party cookies for logins and remembering user preferences when they should really be using first-party cookies, according to Kevin Joyner, director of planning and insight at digital marketing agency Croud. This tends to happen when a publisher owns a number of different websites and domains — so publishers looking to maintain single sign-ons spanning multiple domains would need to ensure their cookie configuration is compatible.
The biggest potential fallout could be for vendors who have built up cookie-reliant audience databases. Adobe, for example, has warned in a blog post that cookie matching might decrease for its Audience Manager customers as there’s a possibility some of its partners might not make the necessary changes in time.
“The issue is the new standard cookies will not be compatible with the old cookie,” said Joyner. “It means that marketing pool is suddenly useless.”
Is this the beginning of the cookieapocalypse?
Not quite. Experts are split as to whether the SameSite update is a precursor to Google further tightening its wider cookie policies, in a similar direction as Apple’s Intelligent Tracking Prevention and Firefox’s Enhanced Tracking Protection — not least as Google has an advertising business of its own to protect.
Chrome already offers users the ability to block third-party cookies and to clear all their cookies. The SameSite change should allow users more nuanced control of their privacy settings as first-and third-party cookies will be more accurately designated — so they can clear ad-tracking cookies but leave their on-site login details and preferences unaffected.
But further down the line, Google has already been hinting at what a cookie-free web might look like. At last year’s Chrome developer conference in November, Michael Kleber, a Google software engineer who works on privacy and tracking prevention in Chrome, spoke about shifting from cookies to “more right-sized APIs” that don’t allow for unfettered tracking of individuals across the web. Chrome is also exploring techniques such as federated learning of cohorts to continue to allow behavioral ads to work.
How NBC’s News Group is shaping NBCUniversal’s commerce bets
The nearly 50-person group now oversees two shopping shows, commerce sub-brands across three NBC News properties and direct deal-making for a growing list of sister brands.
Member ExclusiveMedia Briefing: How publishers with teen audiences are making their Instagram presences more inclusive
In this week's Media Briefing, media reporter Sara Guaglione reports on what Bustle and Teen Vogue are doing to make sure their Instagram accounts don't contribute to the platform's reported negative impact on teen girls' wellbeing.
‘Levers being pulled that are unseen’: Measurement errors inside Amazon’s OSP program setting publishers on edge
A series of reporting errors has become emblematic of a program that has grown increasingly frustrating for its participants over the past year.
SponsoredHow publishers can future-proof their contextual advertising strategy
Sal Cacciato, managing director, North America, video intelligence The discourse on contextual targeting has moved from “if” to “how.” Publishers are well aware that they need to be packaging their audiences in ways that enable contextual targeting, but many are still asking themselves what is the best way to achieve that goal. In a telling […]
Axios has made $1M in revenue from its eight-month-old software licensing business
Less than a year in, Axios HQ is bringing in more revenue than expected, but the challenges of a tech company are different than those of a media company.
Why The Telegraph thinks retiring some newsletters will actually help grow subscriptions
After shuttering a half-dozen newsletters this year and consolidating others, The Telegraph produces over 40 editorial newsletters, eight of which are exclusive to paid subscribers.