Google said it would be updating its Chrome browser to give users more information about how they're being tracked across the web using cookies.
The changes, among other moves in the digital world toward more privacy features, will likely have deep implications for how some advertising players target consumers online.
The new Chrome feature was one of several Google announced Tuesday to show it's a proponent of consumer privacy. Apple has also tried to position itself as a champion for consumer privacy for its device owners. It recently unveiled a new version of its anti-tracking tool Intelligent Tracking Prevention, cutting a first-party cookie's lifespan to track your browsing history. Apple has also highlighted its privacy features in commercials and billboard ads.
"We are making a number of upcoming changes to Chrome to enable these features, starting with modifying how cookies work so that developers need to explicitly specify which cookies are allowed to work across websites — and could be used to track users," Google engineers wrote in a blog post on the Chrome changes
Chrome will enable users to clear all of those cookies, while not affecting single domain cookies, which preserve things like logins and settings. Users will also be given clear information about which sites are setting these cookies "so users can make informed choices about how their data is used," the post said.
In the post, Chrome developers also said the browser would more aggressively restrict "fingerprinting" — which they define as harder-to-detect methods of user tracking that subvert cookie controls — across the web, in part by "reducing the ways in which browsers can be passively fingerprinted, so that we can detect and intervene against active fingerprinting efforts as they happen."
Some experts wondered whether Google will have to play by the same rules as third-party advertisers, and whether if Google cookies were blocked, the browser would still be able to track a user using their Google ID if they were logged in.
A Google spokesperson said the measures will apply to everyone, including Google.
But industry players like Dataxu CEO Mike Baker said he was worried whether Google might give its own ad tech business a free pass for being operated under the same brand. Dataxu is an advertising tech company that runs digital and linear TV advertising using data and analytics.
"Do Google's self-defined rules of the road favor companies like Google that combine a consumer-facing business with an ad tech business (giving their own ad tech business a free pass because its operated under the same brand)?" Baker wrote in an email to CNBC. "And especially given the recent experience with Facebook, how do we know that Google or any other Big Tech company is actually doing what they say they are doing?"
A Deutsche Bank analyst said in a note in late March that Google could "inflame already high antitrust concerns if it does something in Chrome," AdExchanger reported at the time.
Google wouldn't provide any further details around how users would be shown information about cookies, or exactly how the information would be phrased.
Andrew Frank, a distinguished vice president analyst at Gartner, said Monday that much of the response people will likely have to these changes will depend on how the information is presented to users. He points out that the way cookies work isn't simple in a way consumers are likely to grasp, so the way these new options are presented will have a lot to do with how consumers will proceed.
"It's sort of easy to present the negative side of cookies. It's much harder to present the positive side. The benefits of cookies are much more indirect," he said. Frank said cookies support a lot of of third-party websites, and consumers may not want all news and information filtered through a small number of companies like Google, Facebook and Amazon. If third-party cookies were killed, it would increase the concentration of ad targeting in the hands of the "walled gardens," he said.
A note on ad tech company Criteo from SunTrust Robinson Humphrey said the data privacy changes appeared to be manageable from a business and financial impact point of view. The note said details on what the new user control dashboard will look like, how users will be made aware of new controls, how many steps it will take and other details are still unclear. But it doesn't expect Chrome to go "nuclear" on cross-site tracking.
"Based on the language and tone of announcements at I/O, we would be shocked at this point to see cross-site tracking disabled by default (i.e. we do not see Chrome going nuclear the Safari ITP and Mozilla Firefox route)," the note said. "Further, we would not expect Chrome to do anything to disrupt the user experience (e.g. having an always-open controls dashboard or putting mandatory accept/disable toggles on every site)."
Giving users more information or control is a move that will likely continue, some say.
"What's interesting is this seems like a first step, not just on Google's part but as an industry as a whole, where they are giving a small amount of control to the consumer to be able to have some limitations on how [they] are being tracked," said Joe Maceda, chief instigation officer at GroupM media agency Mindshare. "In the long run, this is likely simply a first step and eventually that will become the expectation."
Fatemeh Khatibloo, an analyst at Forrester, said these types of changes are a way for Chrome to protect its market share against more privacy-conscious browsers. The Brave browser, for example, touts itself for blocking ads and website trackers.
"Today, the people who are really worried about tracking are not using Chrome to begin with, or if they're using Chrome, they've installed tracker blockers like Ghostery or Privacy Badger," Khatibloo said.
She said one potential result of changes like this might be advertisers moving more to contextual ads. This would mean more advertising based on the kind of content a user might be accessing.
Khatibloo said she was glad to see fingerprint detection. "It's one of the things I appreciate about Brave browser, and it sounds like Google has figured out that it flies in the face of transparency and choice," she said.
Another factor to watch will be the effect on ad tech companies, many of which use this type of data to conduct their business. Dataxu's Baker said some firms have prepared more than others when it comes to replacing cookies with other types of identifiers.
"The world is changing for advertising technology," he said. "It's becoming more of these anonymous tokens and IDs than cookies."
Baker said it may have the result of moving more ad spending into apps.
"I think it can't help but shift more of the ad spending into the application environmental and maybe less in the browser," he said.
Joella Duncan, director of media strategy for global consumer solutions business for North America at Equifax, said her reaction was a "little bit of relief'" during a panel on programmatic in a "post-cookie world" at programmatic tech company TripleLift on Wednesday morning. She said her company will still be working on first-party cookie strategies as well as some other methods of matching that aren't based on cookies.
Ari Paparo, CEO of ad tech company Beeswax, said at the same panel he doesn't believe these changes should have much immediate impact.
"It was really kind of what you might think of as privacy theater," he said. "Google has been pushing this angle of: 'Consumers want to know why they're seeing ads.' Consumers do not care why they're seeing ads."
He said Beeswax created a task force once reports started brewing about potential cookie changes and started looking at how to adjust its data methods.
"We just started working the angles and figuring out what we could do," he said. "The answer wasn't pretty, but that's kind of the mechanics."
Paparo added he believes cookies had already been demoted from "strategic" to "tactical" and said cookies are primarily a tool for a "niche portion of ad tech."
Correction: Google briefly announced the change during its developer conference Tuesday. An earlier version misstated the day.