Risk
9/19/2013
04:47 PM
50%
50%

Google's Plan To Kill Cookies

Google proposes anonymous identifier for advertising, or AdID, to replace cookies used by third-party marketers. Google would benefit -- but would consumers?

Perhaps not surprisingly -- given the amount of revenue Google derives from online advertising -- the Chrome browser has never blocked cookies by default. By contrast, Apple Safari, first introduced in 2003, has always blocked all third-party cookies by default. Mozilla, meanwhile, plans to follow suit this year with its Firefox browser, despite strong protests from the Interactive Advertising Bureau (IAB). Internet Explorer 10 also ships with a Do Not Track (DNT) setting activated by default, indicating that users don't want to be tracked. Advertising networks, however, don't have to abide by that request.

Would Google's move benefit consumers? So far, the company has released scant details publicly, making any analysis purely speculative, said Stanford University professor Jonathan Mayer, who studies online advertising and privacy, and who until recently was working on the W3C's DNT standard. But one question Google will no doubt face is this: "From the consumer privacy perspective, how is AdID an improvement?" said Mayer via email. "Consumers can -- and increasingly will -- see Safari and Firefox defaults outright block third-party cookies." Accordingly, might Google's AdID push actually drive privacy-conscious consumers to adopt other browsers?

Furthermore, how exactly does AdID differ from DNT, which advertisers -- including trade groups to which Google belongs -- have actively resisted? "Google still doesn't support Do Not Track, despite participating in an industry announcement a year and a half ago," said Meyer. "Instead of starting from scratch, why doesn't Google support the consumer control technology that's already in every major Web browser? Twitter and Pinterest already do, in fact."

We also can expect Google's claims of anonymity for consumers via AdID to face strong scrutiny, especially given the vast quantities of data the company already can and does collect from people's searches and YouTube viewing habits, as well as through its Admob mobile advertising and DoubleClick online advertising divisions.

"Google needs to demonstrate this isn't merely a PR ploy designed to give increasingly privacy concerned users reassurance that they have nothing to fear," said Jeffrey Chester, executive director of the Center for Digital Democracy (CDD), via email. "The reality is Google is addicted to gathering our data -- that's the source of its revenues. The AdID will likely help them expand their surveillance of online users, especially as it focuses on monetizing our mobile phone and location activities."

Also expect any formal AdID proposals from Google to have to pass muster with the Federal Trade Commission. That's thanks to Google's 2011 privacy settlement with the agency, stemming from privacy violations associated with the 2010 launch of the now-defunct Buzz social network, which lead to the search giant agreeing to submit to regular reviews of its privacy policies. "The FTC will need to review AdID to determine whether it triggers a violation of Google's 20-year privacy consent decree," Chester said.

Interestingly, Google already has violated that settlement once, and triggered a record-setting $22.5 million FTC fine, after Stanford's Mayer discovered that the company was bypassing Safari privacy settings and placing tracking cookies directly on the computers of Safari users.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
rradina
50%
50%
rradina,
User Rank: Apprentice
9/23/2013 | 1:21:09 PM
re: Google's Plan To Kill Cookies
I agree that share looks low. However I recently read that one statistic group recently changed its methods. Among other things, they stopped counting page hits rendered in the background but never viewed (how they know that...I have no idea). They claim hits that are never viewed skew the numbers. I believe the article claimed Chrome leverages background page rendering more than other browsers and thus took the biggest negative hit.
WKash
50%
50%
WKash,
User Rank: Apprentice
9/20/2013 | 9:19:46 PM
re: Google's Plan To Kill Cookies
While this seems like a potentially better way to deal with privacy issues, I wonder whether the advertising world will go along with letting Google create a new standard that inevitably will give Google an advantage in tracking online behavior.
Somedude8
50%
50%
Somedude8,
User Rank: Apprentice
9/20/2013 | 4:22:03 PM
re: Google's Plan To Kill Cookies
If one wants to advertise on the web, one would have to play by the rules of a single corporation? Yeah...
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
9/20/2013 | 2:02:39 PM
re: Google's Plan To Kill Cookies
Nice analysis - killing cookies only makes them 'not evil' if they don't replace with something equally snoopy. I'm somewhat surprised Chrome is only at 16% - doesn't seem like a half-baked idea like this is going to help that.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
9/20/2013 | 1:55:15 PM
re: Google's Plan To Kill Cookies
I know they haven't released details, but any clue how this AdID code would be tracked, if not with a cookie? Would browsers have to build in support specific to tracking this other type of code?
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.