Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Google's Plan To Kill Cookies

Google proposes anonymous identifier for advertising, or AdID, to replace cookies used by third-party marketers. Google would benefit -- but would consumers?

Perhaps not surprisingly -- given the amount of revenue Google derives from online advertising -- the Chrome browser has never blocked cookies by default. By contrast, Apple Safari, first introduced in 2003, has always blocked all third-party cookies by default. Mozilla, meanwhile, plans to follow suit this year with its Firefox browser, despite strong protests from the Interactive Advertising Bureau (IAB). Internet Explorer 10 also ships with a Do Not Track (DNT) setting activated by default, indicating that users don't want to be tracked. Advertising networks, however, don't have to abide by that request.

Would Google's move benefit consumers? So far, the company has released scant details publicly, making any analysis purely speculative, said Stanford University professor Jonathan Mayer, who studies online advertising and privacy, and who until recently was working on the W3C's DNT standard. But one question Google will no doubt face is this: "From the consumer privacy perspective, how is AdID an improvement?" said Mayer via email. "Consumers can -- and increasingly will -- see Safari and Firefox defaults outright block third-party cookies." Accordingly, might Google's AdID push actually drive privacy-conscious consumers to adopt other browsers?

Furthermore, how exactly does AdID differ from DNT, which advertisers -- including trade groups to which Google belongs -- have actively resisted? "Google still doesn't support Do Not Track, despite participating in an industry announcement a year and a half ago," said Meyer. "Instead of starting from scratch, why doesn't Google support the consumer control technology that's already in every major Web browser? Twitter and Pinterest already do, in fact."

We also can expect Google's claims of anonymity for consumers via AdID to face strong scrutiny, especially given the vast quantities of data the company already can and does collect from people's searches and YouTube viewing habits, as well as through its Admob mobile advertising and DoubleClick online advertising divisions.

"Google needs to demonstrate this isn't merely a PR ploy designed to give increasingly privacy concerned users reassurance that they have nothing to fear," said Jeffrey Chester, executive director of the Center for Digital Democracy (CDD), via email. "The reality is Google is addicted to gathering our data -- that's the source of its revenues. The AdID will likely help them expand their surveillance of online users, especially as it focuses on monetizing our mobile phone and location activities."

Also expect any formal AdID proposals from Google to have to pass muster with the Federal Trade Commission. That's thanks to Google's 2011 privacy settlement with the agency, stemming from privacy violations associated with the 2010 launch of the now-defunct Buzz social network, which lead to the search giant agreeing to submit to regular reviews of its privacy policies. "The FTC will need to review AdID to determine whether it triggers a violation of Google's 20-year privacy consent decree," Chester said.

Interestingly, Google already has violated that settlement once, and triggered a record-setting $22.5 million FTC fine, after Stanford's Mayer discovered that the company was bypassing Safari privacy settings and placing tracking cookies directly on the computers of Safari users.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
rradina
50%
50%
rradina,
User Rank: Apprentice
9/23/2013 | 1:21:09 PM
re: Google's Plan To Kill Cookies
I agree that share looks low. However I recently read that one statistic group recently changed its methods. Among other things, they stopped counting page hits rendered in the background but never viewed (how they know that...I have no idea). They claim hits that are never viewed skew the numbers. I believe the article claimed Chrome leverages background page rendering more than other browsers and thus took the biggest negative hit.
WKash
50%
50%
WKash,
User Rank: Apprentice
9/20/2013 | 9:19:46 PM
re: Google's Plan To Kill Cookies
While this seems like a potentially better way to deal with privacy issues, I wonder whether the advertising world will go along with letting Google create a new standard that inevitably will give Google an advantage in tracking online behavior.
Somedude8
50%
50%
Somedude8,
User Rank: Apprentice
9/20/2013 | 4:22:03 PM
re: Google's Plan To Kill Cookies
If one wants to advertise on the web, one would have to play by the rules of a single corporation? Yeah...
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
9/20/2013 | 2:02:39 PM
re: Google's Plan To Kill Cookies
Nice analysis - killing cookies only makes them 'not evil' if they don't replace with something equally snoopy. I'm somewhat surprised Chrome is only at 16% - doesn't seem like a half-baked idea like this is going to help that.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
9/20/2013 | 1:55:15 PM
re: Google's Plan To Kill Cookies
I know they haven't released details, but any clue how this AdID code would be tracked, if not with a cookie? Would browsers have to build in support specific to tracking this other type of code?
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3896
PUBLISHED: 2019-06-19
A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).
CVE-2019-3954
PUBLISHED: 2019-06-19
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 81024 RPC call.
CVE-2019-10085
PUBLISHED: 2019-06-19
In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on that page.
CVE-2019-11038
PUBLISHED: 2019-06-19
When using gdImageCreateFromXbm() function of gd extension in versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been ...
CVE-2019-11039
PUBLISHED: 2019-06-19
Function iconv_mime_decode_headers() in versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.