Google stays deaf to mounting criticism over its attempt to marry tracking and privacy

It’s no secret that Google for years has been trying to sunset the third-party cookie, the bedrock of retargeting ads and once the online tracking essential. While many other browsers are already blocking third-party cookies, seeing them as a privacy threat, Google still allows them in Chrome and will continue to do so until at least 2024. The reason Chrome has lagged behind its competitors is that Google hoped to create an alternative to the third-party cookie that would satisfy both advertisers and privacy-conscious users. Its proposed replacement, the Topics API, is promising to do just that. But sadly, and predictably, it has failed in its main goal — making interest-based advertising more private. In our in-depth article on the subject, we explained why in detail. And it’s not that our bar is set too high. Various privacy advocates, browser vendors and other industry players have poked holes in Google’s approach as well.

Now, Google’s proposed API has been dealt another blow. After reviewing the API, the W3C Technical Architecture Group (TAG), a special working group within the World Wide Web Consortium, concluded that Topics fell short of achieving its ambition goal: that is to protect people’s privacy while also protecting advertisers from losing revenue. But what makes the Topics API, the cornerstone of Google’s privacy initiative, so bad?

Ad-friendly and privacy-friendly — too good to be true?

The core idea of Topics is to allow advertisers to keep targeting users with interest-based ads, while protecting the latter from unwanted tracking and profiling. As it turns out, you probably still can’t have your cake and eat it too.

According to TAG, the new API does not change the “status quo of inappropriate surveillance on the web,” because it still allows the browser to share information about a user’s browsing history with websites. Moreover, it does not give the user “fine-grained control” over what those sites can learn about them. The TAG wants Google to stop Topics API in its tracks. “We do not want to see it proceed further,” the group said.

With that, the TAG joins an extensive list of industry players that oppose Topics, Google’s second attempt to reinvent ad targeting after equally unpopular FLOC. But before we go any further, let us remind you how we got to this point.

A prolonged farewell

Once the backbone of cross-site tracking, the third-party cookie has been on its deathbed for quite some time. Unlike first-party cookies, which are small chunks of data planted by the websites you visit into your browser, third-party cookies are planted by ad and tracking domains present on those sites. Basically, what they do is they enable advertisers to track you around the web. Privacy-focused browsers like Brave, Safari, and Firefox have been blocking third-party cookies by default for years. With the growing list of browsers ditching third-party cookies, Google announced back in January 2020 that it would phase them out in Chrome “within two years.” The deadline was then extended to the end of 2023, and then again pushed back to the end of 2024.

The reason for constant delays was that Google did not want to simply block third-party tracking, claiming that doing so would “undermine the business model of many ad-supported websites” and encourage the use of covert tracking techniques, such as device fingerprinting. Instead, Google wanted to find a replacement for cookies that would suit both advertisers and privacy-minded users. In other words, Google wanted tracking to be and sound like a good thing (which it is not).

A bad beginning…

Its first attempt at this was FLoC, or Federated Learning of Cohorts. Google billed FLoC as a technology that would allow sites to learn about user behavior in a privacy-preserving way. We won’t go into too many details about how a now-defunct technology was supposed to work. In a nutshell, a browser with FLoC enabled would collect information about user behavior so that it could then group different users into cohorts (hence the name) based on their shared interests. The browser would then share a cohort ID with websites and advertisers.

The proposal did not go down well with privacy advocates and browsers. The Electronic Frontier Foundation argued that it would create new problems, like facilitating fingerprinting, and would perpetuate discrimination based on browsing history. All major browsers, except Google Chrome itself, refused to adopt it. Shortly after Google began testing FLoC in Chrome in March 2021, we at AdGuard began blocking it as well.

In January 2022 Google officially put the last nail in FloC’s coffin, and proposed a replacement — the Topics API.

…makes a bad ending

The Topics API promised to right the wrongs of FloC, that is to marry tracking and privacy once and for all. But in this case, as in the previous one, the two opposites couldn’t possibly be reconciled, and so they weren’t.

The new API could still be seen as an improvement on FloC. In short, it works like this: each week, the five most popular topics are identified on the user’s device based on that user’s online behavior, and a random sixth topic is added. Instead of a cohort ID, a browser with Topics enabled shares the three topics a user is interested in (one from each of the past three weeks) with sites and advertisers. To prevent sites from identifying the user, Google proposed that different sites receive different topics. Google also promised to exclude sensitive categories from topics.

The proposal may sound good on paper, but as we’ve shown in our deep dive into the Topics API and Google’s Privacy Sandbox as a whole, it won’t stop big corporations that leverage different services from identifying users. If anything, it would only entrench Google’s existing advertising monopoly.

Within the last year, a lot of industry players came out against Google’s proposal, among them Firefox’s maker, Mozilla, and Apple’s WebKit.

Mounting criticism

Commenting on the proposed third-party cookie replacement last month, Mozilla’s Martin Thomson wrote that it was “more likely to reduce the usefulness of the information for advertisers than to provide meaningful privacy protections.” Thomson concluded that the new API would “create a strong bias” towards large industry players, and argued that the privacy protections were “not sufficient to give users confidence that they cannot be re-identified and tracked.”

WebKit, the browser engine used in Safari, also opposes the API. WebKit noted that the Topics API does not solve the problem of cross-site data sharing and would benefit established players such as ad trackers. WebKit also argued that the Topics API would not prevent targeting based on sensitive interests, as these depend on culture, region, and age and cannot be defined once and for all.

Another browser, the privacy-oriented Brave, pulled no punches in its criticism of the Topics API, calling it an attempt by Google to “rebrand FloC” without addressing the underlying privacy issues. “Both systems are designed to share information about you with advertisers and organizations that you don’t know, and that are outright hostile to Web users’ privacy, without active permission or consent.”

Google refuses to budge

The overwhelmingly negative reaction to FLoC once prompted Google to scrap it and look for alternatives. But this time, despite the threat of limited browser adoption, Google has signaled that it has no intention of backing down. In its response to TAG, Google said it would proceed implementing the Topics API as planned.

While we appreciate the input of TAG, we disagree with their characterization that Topics maintains the status quo. Google is committed to Topics, as it is a significant privacy improvement over third-party cookies, and we’re moving forward

What we can take away from this

While Google’s response to the growing pile of criticism directed at its Topics API is not surprising, it is nonetheless disappointing. The tech giant seems hell-bent on implementing the technology despite the lack of industry approval. This is yet another example of the dominant position that Google has carved out for itself in the market, which allows it to act without regard to other players.

Fortunately for AdGuard users, Google’s new tracking gimmick won’t be that big a deal, as we’ve already blocked the Topics API.