Google will soon disable third-party cookies in Chrome

Google will disable third-party cookies for millions of Chrome browser users starting Jan. 4, 2024, as part of its ongoing privacy initiative.

Google Chrome Tracking Protection feature will be rolled out to 1% of users, with plans to phase out third-party cookie tracking for all users by the second half of 2024.

Chrome Tracking Protection is part of Google’s Privacy Sandbox initiative, “an industry-wide effort to develop new technology that will improve people’s privacy across the Web and apps on Android,” as described on the Privacy Sandbox website.

Alternatives to third-party cookies are being developed that would allow sites to maintain functions like ad targeting and spam protection while preserving user anonymity.

With a browser market share of nearly 63%, Chrome is poised to strike a greater blow to third-party cookie tracking than its rivals Apple Safari and Mozilla Firefox, both of which had already disabled third-party cookies by 2020.

Those randomly selected 1% of users will receive a notification on their desktop or Android Chrome browser informing them that Tracking Protection is active.

Google will phase out Chrome support for third-party cookies throughout Q3 and Q4 of 2024, according to its current Privacy Sandbox timeline.

Meanwhile, APIs have been available since Q3 2023 for developers to replace the useful functions of third-party cookies. This includes the Topics API and Protected Audience API for displaying relevant ads and the Private State Tokens API for blocking traffic from bots and malicious sources.

Topics and Protected Audience provide advertising sites with limited information about a user’s interests, which Chrome compiles from their browser history and stores on the user’s device rather than any external servers. These APIs enable sites to select ads based on these interest topics without collecting the user’s cross-site activity like third-party cookies do.

Private State Tokens are cryptographic tokens that can be issued to a browser when a user’s activity is trusted, such as when they pass a CAPTCHA prompt. The tokens on a browser can then be “redeemed” on other sites that trust the token issuer. This allows sites to segment trusted and untrusted users as a way to prevent spam and fraud, including bot activity. The tokens are encrypted, meaning they can only be used to distinguish trusted browsers from untrusted browsers and do not identify individual users.

Google twice postponed its third-party cookie phaseout, which was originally scheduled to begin in early 2022. The feature was first pushed to late 2023 before eventually being revised to 2024.

Mozilla Firefox and Apple Safari were the first mainstream browsers to disable third-party cookies by default. Firefox released Enhanced Tracking Protection for all users in September 2019, which was followed by an upgrade to Safari’s Intelligent Tracking Prevention (ITP) in March 2020.

This rollout could potentially have some cybersecurity benefits, as it could reduce the amount of browsing information available to hackers. However, first-party cookies like authentication cookies, which can be stolen to bypass multi-factor authentication, are not affected by tracking protection measures.