Digital Publishing Platforms Top Stories
8 mins read

The ending of third-party cookies: Big tech developments

This article is an extract from our free-to-download report, Which Way Now? Publisher Options For The Ending Of Third-Party Cookies

Google’s FLoC, and Apple’s walled garden

FLoC takes flack

Although Google claims its privacy sandbox solution, FLoC (Federated Learning of Cohorts), will produce 95% of the per-dollar conversions that third-party cookies previously achieved, so far it has met with widespread resistance. Although a number of companies are either testing the sandbox this year (AdThrive, CafeMedia), or working with Google on their proposals (PubMatic), the criticism is certainly gathering momentum. This is significant, as ostensibly, Google is designing FLoC to become a fundamental part of the web, not just Chrome.

Several web browsers (Firefox, Brave, Vivaldi, and Opera) announced they would not support FLoC in its current form because it fails to provide sufficient user privacy. Apple’s WebKit Security and Privacy Engineer John Wilander, perhaps unsurprisingly, expressed skepticism about the proposal. Meanwhile, privacy-minded search engine and direct competitor of Google,  DuckDuckGo, rejected it outright.

The initial CMA (Competition and Markets Authority) investigation to assess whether FLoC is likely to distort competition was followed by a consultation in June 2021 about accepting Google’s commitments. Scrutiny is perhaps prudent, since the European Commission also launched its own investigation into Google in the same month, this time to determine whether the company violated antitrust rules by favoring its own ads in the online auctions it manages using current cookie technology. Google had already been fined €220 million ($268 million) in France for abuse of market power. The Commission’s investigation follows similar lawsuits in the US, with concerns around Google restricting access to user data for third-party websites and apps, while reserving this data for its own gain.

Future PLC, a UK-based media company with a portfolio of over 50 brands, is backing the scrutiny as a chance to improve privacy compliance. Future’s Global Commercial Operations Director, Nick Flood, says that with the CMA’s announcement comes “an opportunity for the entire ecosystem – including Google, advertisers, publishers and the ICO – to work together to meet privacy goals, and better serve the needs of consumers and advertisers alike. The conversations and actions already in progress as a result of Google’s sandbox changes have rightly brought consumer privacy to the fore, and reflect a positive shift towards prioritizing audience needs.

As far as tech vendors are concerned, aside from privacy, FLoC has other drawbacks which will likely result in it constituting only a small part of the replacement of third-party cookies. The consensus is that long-tail publishers alone (for example, recipe websites that some users only visit occasionally) do not provide enough valuable data for advertisers. A third-party tracer (e.g., cookie) benefits these publishers because it follows users around each website, providing more data to the long-tail site and improving the value of its ad inventory. FLoC is a continuation of this principle.

However, larger and more premium publishers are disincentivized from opting in because their sites provide a disproportionate amount of user data compared with smaller publishers. For instance, behavioral data from the Wall Street Journal will power impressions biddable on the recipe website. Furthermore, FLoC will require user consent, which will dramatically reduce its reach, especially in the case that Chrome is the only browser to adopt it.

For these reasons, Jakob Bak, Co-founder at Adform, believes large and premium publishers will experiment with FLoC, but that it won’t constitute more than 30% of any media plan, and that ultimately, they will end up disabling it. “In a data-siloed world, where larger publishers build data on top of their first-party IDs, long-tail publishers will lose out.” However, Bak believes this is a fairer ecosystem, since value is apportioned according to the data a publisher provides.

Alasdair Cross, VP Sales EMEA at cross-device ID resolution platform,, agrees: “the problem is that it’s effectively unattributable as they describe it, unless you set the interest category as a unique ID, which, inevitably, everyone will do, and the interest category will just act like a first-party cookie that only some DSPs have access to. Why don’t we skip to the end game and just use first-party cookies?”.  

Meanwhile, the Teads survey reflects these sentiments, revealing that the following proportions of publishers are considering the various alternatives to third-party cookies: 27.6% are exploring first-party data, 27% contextual, 21.8% universal ID, and only 18% FLoC. So, if FLoC cannot replace third-party cookies alone, what will the rest of a publisher’s portfolio look like?

CafeMedia’s FLoC Origin Trials

Among the participants in the FLoC Origin Trials – in which a small number of Chrome users running a beta version of the browser have been assigned to FLoCs – is CafeMedia. Although it is not yet being used by advertisers to target and buy ads, the trials do show how FLoC groups online users based on content consumption across 3,000+ sites that work with the publisher network.

FLoC works by using an algorithm to convert browsing history into a hash (a very long value), preventing the entire browsing history from being reconstructed. This is not revealed because it might only correspond to a small number of users and show information about their history. Algorithm values that are similar will have similar browsing histories. These are grouped and share a shorter version of the value. These groups are the cohorts, and their shortened algorithms are their FLoC IDs. A user can only be in one cohort at a time, although their cohort may alter if their browsing behavior changes.

There are currently approximately 34,000 cohorts, but not every one will be seen. The system won’t use a cohort if it is likely to visit domains tagged as sensitive, or contains fewer members than the minimum (for privacy). 

The fact that the similarity of the algorithm values correlates with the similarity of content means FLoCs with IDs closer to each other will represent more similar groups of consumers. For example, the highest value in cohort 17,000 will be similar to the lowest in cohort 17,001. However, there will be a degree of overlap between non-adjacent cohorts because content relationships are not linear.
CafeMedia combined FLoCs into larger groups called ‘kFLoCs’, each containing 1,000 cohorts. For each kFLoC, CafeMedia has surfaced 10 content keywords that over-indexed compared with the average in that kFLoC. For example, kFLoCs 14,000-15,000 showed a pronounced index value for the key phrase ‘finance & technology’, so a brokerage firm searching for likely investors may look to test advertising in those FLoCs first.

Apple’s walled garden

Apple’s developments in user privacy, combined with the prevalence of its devices (there are now over 1 billion active iPhones), are having a substantial impact on the ad tech landscape. Apple’s App Tracking Transparency (ATT) went live with iOS 14.5 on 26 April 2021, requiring users’ explicit permission to track their behavior across other apps and websites, with a prompt for each app. 

ATT appears to be having a negative impact on behavioral ad revenue. A recent Consumer Acquisition report found that only 20% of users are consenting to tracking, and that iOS advertisers are experiencing a 15-20% drop in revenue coinciding with increased unattributed organic traffic. The report corroborates an early Flurry Analytics study, which found that the US daily opt-in rate was 12-14% (rising to 22-31% worldwide). This leaves a huge volume of users invisible to behavioral targeting. 

Facebook’s iOS advertising revenue is also reportedly in decline due to the low ATT opt-in rate. Brian Bowman, CEO and Founder of Consumer Acquisition, attributes the loss to a reduced ability to recognize look-alike audiences and users with the highest propensity to purchase (known as value optimization in Facebook Ads). “There’s a collapse of value optimization bidding. The ability to specifically target people who are going to transact is diminished, and will continue to erode as ATT rolls out.”

If users decline cross-app tracking, attribution falls to Apple’s SKAdNetwork framework, which provides only limited information. Apple has made slight improvements, however, with the release of its SKAdNetwork 3.0 in iOS 14.6 in May 2021. The framework now allows devices to send postbacks to multiple ad networks, including the winning networks and up to five losing networks. However, this may not provide enough data, as it is not clear which five networks are chosen, and furthermore, they don’t know why their attribution was lost. 

Ingrid Couasnon, EVP EMEA, Smart, says that “today, [SKAdNetwork’s] scope is too limited to be used at scale as it only enables conversion measures for app install campaigns.” 

Cross agrees, saying that “in both SKAdNetwork and FLoC, attribution and retargeting become impossible. Multi-touch attribution becomes a distant fantasy. But the bright side is that publishers can turn to an alternative solution provider to fill in the blind spots.”

There have been subversive attempts to bypass ATT using probabilistic matching, including a consortium backed by the Chinese government, which dared Apple to ban all apps involved in one fell swoop. Apple has responded by blocking any apps using the system, known as CAID (China Advertising ID), and has prevented any app updates containing the ID from reaching the App Store.

The tech giant also announced two new measures, at WWDC21, to counteract fingerprinting: ‘Private Relay’, which uses two relay systems to obfuscate a user’s IP address to hide their browsing information in Safari (like a VPN); and ‘Mail Privacy Protection’, which hides the user’s IP address so that senders are unable to connect the address to online activity, and are unable to see whether an Apple Mail user has opened the email. These measures will likely restrict ID graphs and targeting on CTV, which is heavily IP-based.

Some advertisers expect Private Relay, in particular, to be the beginning of the end for fingerprinting on iOS, as Apple starts a battle to stamp out the practice. Shumel Lais, CEO of mobile advertising analytics platform, Appsumer, views the feature as “a precursor to Apple using welcome technical solutions to break fingerprinting.”

While Apple has restricted behavioral targeting, it has also expanded its own ad business, adding a new ad slot, ‘Suggested’, in the App Store. Some reports believe this expansion could be aided by their privacy moves. This has also elicited antitrust lawsuits in both France and Germany.

However, Bak doesn’t believe Apple is making a power play on the industry to build up its own ad business; instead, these developments are consistent with Apple’s history and guiding principle of putting the consumer first.

While both Apple’s approach and its ad tools have drawn criticism, publishers cannot afford to exclude Apple’s ads from their portfolio. As Mattia Fosci, Founder and CEO at EU-funded privacy-first DMP, ID Ward, says, “it would be silly not to embrace Apple ads, but it would be suicidal to only focus on Apple ads. Publishers need to keep their options open.”

In summary, behavioral targeting may become decreasingly effective on Apple devices to the point where it ceases to be worthwhile. If so, where does this leave publishers’ ad revenue? Having concluded in our previous report that a portfolio approach is needed, let’s explore which solutions are gaining traction in the industry.

Hazel Broadley
Author, Which Way Now? Publisher Options For The Ending Of Third-Party Cookies

This article is an extract from our free-to-download report, Which Way Now? Publisher Options For The Ending Of Third-Party Cookies