As a scrappy Silicon Valley startup, Google’s motto was “Don’t Be Evil”. The phrase was part of the employee Code of Conduct and was even the Wi-Fi password for its company shuttles. The phrase disappeared from the Code of Conduct in 2018, long after Google had become an Internet search giant and had begun acting the part. This includes aggressively collecting as much data as possible from users of its services and global users of the Internet generally. An important piece of this data collection is the use of “third party cookies”. Google may now be rendering these cookies obsolete, while perhaps softening its public reputation, with its new “Project Sandbox”.
Third party cookies are pieces of tracking data (cookies) collected by Company A (for example, Google) about a user’s interaction with Company B (for example, shopping on Amazon.com). The problem is that Google (and other companies) collect data from a huge number of such websites, and aggregate the data into detailed profiles of users. This can include where you live, work, and shop, your interests, whether you are married or single, have children, how much money you likely earn, your political preferences, and even your health. With very limited exceptions, we don’t know who has our data, how they use it, or how to change it. But they know who we are, down to minute details, and they sell this data to advertisers. Even people in the same household are probably seeing completely different ads.
Unsurprisingly, this has led to consumer backlash. Companies like Apple have taken steps to limit the data collected or shared with data aggregators. Both Apple’s Safari browser and Mozilla’s Firefox browser block third party cookies by default. Google has now apparently gotten the memo. Its Chrome browser will phase out third party cookies this spring, to be replaced by a Google-specific alternative: “Project Sandbox”.
Project Sandbox won’t turn off third party tracking altogether, but will instead group together users who have similar browsing habits. Advertisers can then target ads to the entire group. While this doesn’t stop the problem of invasive ads following you across the Internet, it can prevent data aggregators from building specific individual profiles.
It remains to be seen whether Google’s alternative is an improvement. Instead, it enables them to retain their business model of serving ads (which earns them billions of dollars) while potentially damaging the business model of data aggregators.
What should users do? At this point, turn off third party cookies in your web browser and delete cookies regularly (on both computer and mobile platforms) if you want to limit how much advertisers know about you. Here are instructions for Chrome, Firefox, Safari (Mac), and Microsoft Edge.
The alternative to this is legislation but that hasn’t progressed very far in the United States, except in California. If you live in California, you have certain rights that the rest of us lack, under their California Consumer Privacy Act. Those rights will be increased starting in 2023, under a new data privacy law (the California Privacy Rights Act) approved by voters in November 2020. There is not yet a comparable Federal data privacy law.
The attorneys at Lipton Weinberger & Husick are glad to answer your questions about your privacy rights and responsibilities. It’s a quickly changing landscape, and we can help you navigate the road ahead. Drive safe.
— Joshua D. Waterston, Esq.