CX Decoded Podcast Episode 15: Marketers for an Open Web's Take on Google's Cookieless Future

Note: This transcript has been edited for space and clarity.

Dom Nicastro: James, thanks for joining. As a reporter for CMSWire you and I have chatted, and we appreciate all your time and insights, kind of keeping the Google engine in check, really. So tell us more about yourself, your role, your company and how coalition formed. 

James Rosewell: Well, I'm really pleased with the way that Marketers for an Open Web project has progressed. The background to it is that I'm an engineer. I started a business called 51Degrees 12 years ago now as an open-source business, providing real-time data services for web businesses. That's a moderately sized business that's been moderately successful. We're not going to be the next Facebook or Amazon, but we do a good job in the B2B market.

And in January 2020 as Google announced more plans around privacy sandbox and we also understood kind of the direction of travel of groups within the W3C, which we can talk about in a minute, it became clear to me that there were a lot of unintended consequences to this move toward privacy. And I started finding out more about it, started getting involved with the UK Competition and Markets Authority (CMA), that's the UK's competition regulator. Coincidentally, they were halfway through a year-long investigation into Google and Facebook at this point.

So during the spring of 2020, I met lots of other people that were like-minded from other disciplines and started talking about what would happen if this report from the CMA is favorable toward regulation and trying to prevent these unintended consequences to B2B businesses.

So for listeners, if you're in the field of analytics, if you're in the field of optimization, if you're in the field of basically using suppliers to support your website, then all of this stuff affects you. The headlines are around third party cookies, and that's only one of 23 changes that Google are proposing to make, and the W3C are the venue for that discussion. So this affects everyone. Absolutely.

We felt we needed to create a not-for-profit company, so that businesses could be represented with the CMA and other regulators anonymously. Of course, this would typically be done by trade bodies. But there are certain companies that are members of most of the trade bodies, and therefore they were compromised. So that's why we set up Marketers for an Open Web. We engaged with the CMA during the autumn, filed an official complaint and request for an injunction in November. The investigation was opened in January 2021. And on the 11th of June, a draft settlement agreement was published between the CMA and Google. And that really takes us to today.

Rich Hein: James, I wanted you to share with the audience what the actual privacy sandboxes are but before you do that, you mentioned there were 23 changes Google is proposing. Can you talk a little bit about the ones that you think are going to most impact marketers?

James: So if we look at privacy sandbox, we have something called Gnatcatcher. Gnatcatcher is removing the IP address from the web. So if you use the IP address for anything, perhaps fraud, for location services, things like that, that's going to go away if this proposal comes through, and that's pretty significant here. That's not being talked about in the media. We have changes to the way that the device information about the device, or the browser version, browser name, operating system, model of device, etc., that's used for content optimization, and analytics; that is going to be changed.

So even if you accept these things, they're going to have a massive change to the technology that you use. Anyone who's listening to this is going to be needing to budget engineering time or cost with suppliers in order to change their technology stack to continue to use these features of the web. And I'm not even talking about third party cookies here, I'm just talking about other aspects. I could go through the other 20 proposals, but hopefully that gives you a flavor of the magnitude of the change that is being proposed.

And fundamentally, when you start messing around with these sorts of components of the internet, this isn't 1995 anymore. Yeah, there are markets worth trillions of dollars with individual participants worth trillions of dollars, that rely on this kind of stuff. You can't just go and get 10 million engineers to go and change something overnight, it'd be like changing the format of the zip code in the United States. There might be a more efficient way of doing things now but that doesn't necessarily mean it's a good idea, or it's easy to achieve. And a lot of these things are under appreciated.

Dom: Give our listeners a sense of what Google is proposing, because the one that is getting a lot of media attention is the privacy sandbox, or what Google calls its federated learning of cohorts, or FLoC. This is their alternative to third-party cookies tracking, which they delayed again, but it will meet its demise they're saying. First of all, a quick definition of the third-party cookie tracking and a high-level view of what they're proposing as an alternative through its privacy sandbox.

James: So the third-party cookie is a very simple and very long established component of the web. In practice, it came into being almost by accident in the late 1990s. And it enabled businesses like Facebook and Google to become the businesses that they are today. And it's simply a method of sharing information between different domains within the web browser.

So I can write some information, and you can read that information, we being operating on separate domains. And that in the view of Google, and others, privacy advocates in general, would say that that has been abused. And what we should be doing is removing that feature from the web. And the removal of third-party cookies within privacy sandbox is Google's plan for removing that shared state or sharing of data effectively feature.

Now this has profound impact. This is used generally whenever you use a third-party. So if you run your website, you have a CMS, you then use another supplier to provide location services or analytic services or device information services, all sorts of things my business 51Degrees does, then you've got a problem because Google are interfering with your ability to transfer data to those other parties, those suppliers that you rely on.

So what we have is a situation a little bit like the Tom Cruise film Minority Report, where Google are trying to get involved in future crimes. What they're saying is because this capability exists, we have to remove the capability from the web, irrespective of whether it's used for good acts, or bad acts, we're going to kind of take this preemptive action, and that therefore interferes with choice. And that's why competition regulators have a problem, because it's effectively interfering with the smooth operation of supply chain choices in an environment that's already highly skewed towards Google in particular.

So what Federated Learning of Cohorts is doing is saying, well, we're going to remove that capability, but the only use for that capability is for advertising. So what we'll do is we'll have some machine learning that runs in the browser. And what it'll do is look at the sites, you're visiting the pages, the sorts of content you're going to, and it'll assign you to a number between zero and 32,000. And we will then transmit that identifier, that number, which is a relatively small number in computing.

So you could consider that if you choose number 1,000, there's going to be, let's say 50,000, people in flock ID, so therefore, it's not a privacy concern. And then it's up to the people who receive this to kind of work out what that number means. But through some sort of complicated machine learning or some other methods, they might be able to work out that it correlates to people who like pets, for example. And therefore that signal, when you've worked everything out, can be used to target advertising for pets.

So what does that mean in practice? You can only be in one cohort. It's like the Roman army, and you get put in cohort 1,000. And let's say that doesn't mean that you like pets; the marketing companies have done their work, and they're found out that cohort 1,000 means pets, then you're going to start seeing a lot of adverts for pets-related products, because that's the only group that you're going to be in.

So I think that there's a privacy concern. That's why some organizations are turning the feature off by default. I think famously WordPress and Amazon, I think, have said they're turning the feature off. But also I think, in practice, we can agree, it's going to be a pretty poor experience.

So if Google thinks this is an improvement in advertising, then the question to ask Google is, will they be using this on YouTube? Will they be using it in Gmail, when it's advertising funded? Will they be using it in search? And if the answer to that question is no, then I think we can be pretty certain that it's an inferior solution, compared to the solutions that Google will enjoy. And that's why there's a competition concern.

Dom: Yeah, well, if I'm a marketer, though, you know, what's going to lead to trouble from me and my marketing team with cookies versus the FLoC? Like, why do I care? This seems like they're trying to help us out still in targeting, and we're gonna get some good data on our prospects. So what's the marketers big concern here, James?

James: How do you optimize? So how do you say I want to just target three adverts a day? You've got nothing else to go on other than the FLoC ID? How do you do attribution? How do you do measurement as a publisher and advertiser? How do you know what you paid for? Because you don't have a transaction ID anymore?

Rich: So as a marketer, how would I go in and build a cohort for my organization?

James: You don't build the cohort, the browser builds the cohort. This is another problem. Only Google can build cohorts. So there's no competition in cohort construction.

Rich: It also sounds like there's going to be less precise targeting, that seems like that would be a larger issue.

James: Yes. Yeah, absolutely. And that precision disproportionately hurts smaller organizations. So if you're a large national brand, you can probably survive reaching audiences through mass scale advertising, you know, TV advertising, etc. You don't need personalization as much.

But if you're local, a local publisher, a local business, then those cohort sizes, I think there's different numbers that have been talked about, but let's say 1,000 people have to be in a cohort, in order for it to become addressable and become something that's signaled, then that's going to be a problem for you again, so different businesses will be impacted in different ways.

Rich: Yeah, and I don't think anybody's going to feel bad for Google. But I do think they find themselves in quite an unenviable situation in that anything they do to remove cookies looks like they're hurting their competitors, or taking something away from their competitors. And if they do nothing, they're likely going to catch flack for not protecting the customer data and privacy. So when you talk specifically about the delay, why do you really think they delayed the demise of third-party cookies?

James: Well, just before I answer that question, I need to take issue with your statement earlier. So how is people's privacy improved when Google know more about you than they do today, and there's no effective competition for Google. This isn't about improving privacy. This is about who gets access to certain types of information.

So let's take that example we were talking about earlier with FLoC. further forward. So you're an advertiser, and you go, well, actually on the open web, I'm not really getting a great return on investment. I can get a better return on investment if I use Google's products, because I can personalize, I can choose by gender, I can choose by other characteristics. So I start spending my money there.

So other websites are then faced with a problem, because the return on investment for advertisers can never be as good because of the features that have been taken away by Google. So we've got a competition issue, we've got a choice issue. And on the privacy side, which is where your assertion was Rich, in practice, people are less private, because they're being forced to use Google products more often, where they are being tracked within those products with their consent, of course, because when you sign up for your new Android phone that you just bought for $600, you've got no choice but to accept the consent that includes all these other features. And you know, that becomes a real problem from a privacy perspective.

So I think it's really wrong. To kind of present this as a privacy improvement, it's just shifting more control to Google, and is based on the premise that those businesses that aren't Google and those actors that aren't Google are in some way less trustworthy, assumed to be bad actors assumed to be doing bad things. I don't think that's true of any of us. I don't think it's true of many of our listeners.

Rich: Okay, fair point. But the question still remains, ultimately, why do you think Google made this move to push back third-party cookies?

James: So I think that there are two parts to the answer. So one is that in order to put in a replacement for a technology like third-party cookies, the entire solution would have to be up and running, ad operations people trained, all the technology implemented trials done by Halloween OK. That was never going to happen. It was abundantly clear in January, that was never going to happen. So I think there's just engineering reality about if you're going to change an ecosystem, it takes more time. You need at least a year, in order to make these sorts of changes, if you're going to do it sensibly, and maturely.

So I think that it was inevitable, it was always going to happen. I think the intervention with the Competition and Markets Authority, and the proposed settlement agreement also had some influence on it, because what that agreement is doing is placing the retirement of third-party cookies, so that they're not time bound, but it's criteria bound. So ultimately, the CMA and the Information Commissioner's Office, the ICO, will be involved in deciding on the replacement and confirming that the replacement is both privacy preserving and support to competitive market.

So really, when they say they're pushing it back to 2023, they're kind of ignoring the CMA's settlement agreement that they've kind of negotiated with them in order to make it a criteria-based retirement rather than a time-based retirement.

Dom: James looking at the effect on the actual consumer, right, and, you know, we talk a lot about the effect on marketers, you know, that's what CMSWire does, and we're proud of, but at the end of the day, what could be the ramifications of a privacy sandbox on the consumer? I mean, they have a lot of concerns lately about privacy. Who am I giving my data to? There's regulations that support them. Is there something a consumer should be concerned about? And kind of an extended question to marketers communicate these concerns? Do companies communicate these concerns to the consumer about the ramifications of FLoC and the privacy sandbox?

James: Well, do you remember the days of Prodigy and CompuServe?

Rich: I do, yeah, absolutely.

James: So back in those days, for our younger listeners, you had a dialup modem, you would subscribe to these services, you would access these services. And that would be your your walled garden, that was your digital life effectively. And it was really exciting in the 1990s, to have these sorts of services. And then the web came along: this explosion of connectivity and interoperability. And it's been wonderful.

For the last 20 years, we've seen the growth of massive businesses, businesses like ours have been able to thrive and flourish. And what's going to happen for consumers if the direction of travel is not altered, is that we will have this return to the walled garden. So already, some reports are saying that 60-plus percent of searches on Google stay on Google properties. So you might search for news. You go to accelerated mobile pages or app and you see a carousel of news stories. And you simply read them on that carousel, you never actually go to the publishers website, for example.

So this walled gardens sort of starts to come in through the back door. And consumers might find that the lack of friction effectively associated with just finding the news articles in Google's new service, for example, is very convenient. But then we start to have problems. So those publishers how are they going to get paid for their content if Google are controlling the entire experience the advertising? What if Google start to favor certain publishers over other publishers? Rhere's a court case taking place in New York at the moment between Daily Mail General Trust and Google.

So this has been done before, you know, there's there's evidence to suggest this, and that's highly problematic. So if we think we've got problems with the media today, they're only going to get worse, if we don't have a competitive set of technologies that allow businesses to compete on an equal footing.

Rich: So James, you mentioned a couple times the walled garden. And when you say that, that immediately brings to my mind, Apple, and I'm just curious to know how you think Apple is stacking up in comparison to customer data and privacy in this area?

James: Well, Apple does have some wonderful marketing, don't they? And let me give you some figures just to try and cut through this. So Apple, absolutely in the advertising game, their largest single customer is Google. Google paid them, according to their 2019-20 accounts, just shy of $12 billion. They're the largest single customer of Apple.

Now, Google are not paying that money for having their logo on the Apple home screen, or in Apple's products and services. They're a commercial organization, they're a Delaware-registered company, they have only one mission in life, which is to make money for shareholders, as any Delaware-registered company is obliged to do. That's their only purpose.

So all this talk of you know, all these altruistic things that's not required as a Delaware-registered company to consider those other things. They're paying that $12 billion, because they're getting data, something in return data that they can monetize for considerably more than $12 billion. Yeah, that's why Google are paying it. If we look at Texas versus Google, and the evidence that's been presented in that court case, Google referred to it as a code red event, if that deal with Apple were to be threatened, it's hugely significant to Google. What that means for Tim Cook, is that 20% of his net income is coming from Google. And coming therefore, from advertising, which is how Google monetizes it. So if Tim Cook was sincere, he would cancel that deal, he would cancel that deal and get out of the advertising business and not do that.

Now, again, he's a Delaware-registered company, he has to put his shareholders first. Not sure they'd be too happy about that. So I think Apple has done an amazing job of making people look the other way, and Google taking the flack effectively, but Apple is involved in this as well. And between them, those two companies control our gateway effectively to digital services. And they can extract a high toll for doing so. We've seen that in the charges that they make to publishers for the app store's and of course, that's now coming to the web, once Google kind of dominate that advertising why would advertisers not be paying 20%-30% to Google to in return for reaching audiences? So if you think the kind of advertising percentages are quite high at the moment, just look at the app store's to see how how this is going to go.

Dom: When your organization Marketers for an Open Web, what would you like to see Google do? What would you like to see Apple do instead of what they're doing? Now? Some people say Google's too big, they should be broken up. Same with Apple. But what do you think?

James: So breaking up companies is one has to think really, really carefully about. So if we take some people have said, Well, we just need to separate Chrome, take Chrome and Chromium, which is the browser component, take that out and put it in another business? What's the business model for that business? Why would there continue to be investment in the browser if there were no viable business model?

Others, perhaps from a telecom background, might look at an access remedy. So they'd say, oh, any of the data that Google get well you have to share that with your competitors well then we immediately have a privacy problem. So that doesn't work either.

So our view is to work with the regulators and to look at remedies that the regulators can support in practice. And they're taking tiny steps in that direction. So for example, the Competition and Markets Authority have recognized how problematic the role of standards setting is. So if you take the W3C it dominated by browser vendors, these businesses can afford to have 10s, hundreds of people even working on developing standards, businesses like ours or the listeners, businesses cannot afford that kind of commitment. Even having one person there just for a day a week is a huge commitment just to follow what's going on.

So I think really, that takes us towards you know, a couple of simpler steps. One is to have a roadmap for change that doesn't necessarily work at the pace of the lowest common denominator. But it certainly doesn't work at the pace of the very largest companies, where we can all input into the discussion and turn what Google has billed as a debate or conversation effectively, but it's really been a lecture to date into a genuine debate where they're listening. And perhaps that can happen now, as part of these changes, both the timeframe delay that you talked about earlier, and also with the work of the CMA.

Ultimately, the proposal, the settlement agreement that Google and the CMA have proposed is a good start, it's a skeleton, it's hollow, but it can be worked on and fleshed out. And we believe that is something that the CMA is seriously considering at the moment. And we hope Google are considering.

But like any large organization, in any large merging sector, we can go back to the railroads, we can go back to Rockefeller and Standard Oil, we were 25 years in to the growth of this invention, and it's time to grow up. These organizations need to have compliance programs. Microsoft went through this with their well-publicized challenges of what, 10-15 years ago. So it's a case of learning from this and coming out of this, as Microsoft have done a stronger organization as a result of it. And ultimately, I think Google can benefit.

And let's just remind ourselves that with all this going on, as Sundar Pichai has increased the shareholder value of Google by I think three times in the last two years, I'll have to go and check the charts for that. But it's, it's a pretty phenomenal number. And all the time this goes on, Google is still making nearly a billion dollars a day. So there's not a great deal of downside for Google at the moment, to be honest. And I think they can learn from this and work with regulators and organizations like Marketers for an Open Web to produce a genuinely open web, not one that they have disproportionate control over.

Rich: Yeah, when you say a billion dollars a day, it just shows you what a fine means to them.

James: I think it's less than 12 hours revenue.

Rich: That's crazy. A couple times, we've talked about the World Wide Web Consortium, what's their role in all this? And what do you think that they need to be changing?

James: So the W3C was set up by Sir Tim Berners Lee in the 1990s to sort of steward his invention. And it's very much a sort of consensus driven body, it's very much dominated by the browser vendors, as I said earlier, for the reasons that they can afford to send people and really get involved in these debates. I think it's become a little bit of an echo chamber. So when you get a lot of really clever browser engineers and bright engineers coming up with solutions to problems that they've defined, you can kind of get divorced from reality.

And I think that's occurred, there's a couple of changes that I think are needed. One is the answer to these problems is not found just in engineering. The answer to these problems will be found in economics, and they'll be found in law as well. And if you have a technical standards body that's kind of working, divorced from a policy and divorced from these sorts of other disciplines, then you're not going to really come up with a great solution. And I think that's a problem Google will now recognize, and will start to introduce some of these other disciplines into their thinking. That would be an example of kind of joined-up, business growing up adopting an internal compliance program, for example, as has happened in other industries.

And the W3C can be a great forum to have those conversations. But at the moment, it's sort of institutionally biased against these sorts of debates. It would say otherwise, of course, but you know, the reality is that, you know, I've been part of some quite frankly, awful discussions and accusations where good faith isn't assumed because you don't agree with the other person, you can't respect them, those sorts of things come out. So there's also a kind of the heat needs to be taken out of the conversation a little bit as well.

So I think the W3C has a valuable role to play. But kind of like Google, it needs to grow up. It's not 1995 anymore, we don't find the answers to our problems entirely in engineering specifications. Life's a little bit more complicated than that. And I think a kind of dose of reality, engaging with other organizations, whether that's regulators because the regulator demands them to engage with them. But indeed other groups and other organizations just actually understanding what users want from the web, your listeners and readers, for example, and making the W3C more accessible, I think are all good things that could be done that will really help this debate. And that's what I'm trying to encourage is trying to build that dialogue. But sometimes it can be a bit hard, given all the rhetoric at the moment.

Rich: But ultimately, you feel like in a perfect world, there would be three organizations working together the World Wide Web Consortium, some organization within the government on the policy side, and then also the economic side.

James: Yes, and then there's other bodies that would represent that. So in advertising, you've got the 4A's and the different acronyms there. You've got the European publishers council representing publishers or bigger publishers, you've got the IAB of course, who will be familiar to some of the listeners. So, you know, I think all those organizations can step up as well. But it's really hard at the moment to do that. And I think if Google genuinely adopt a more open and collaborative approach, then that there might be possible.

Dom: Well, you know, it seems like Google's being sincere, though James, right with its promises to work with the CMA, the Competition and Markets Authority out of the the British government. You know, they've promised to work directly with them on timelines changes. They promised that Google's ad products will not access synced Chrome browsing histories or data from other user-facing Google products. They will not access synced chrome browsing histories or publishers, Google Analytics accounts to track users for targeting and measuring ads. In the privacy sandbox proposals, they won't give preferential treatment or advantage to Google's advertising products. So, sounds like they really want to work with the government and get this thing, right. What's the problem?

James: There's a long pause while I pick through the problems with the statements that you've just made. Listener, please be aware, everything Dom just said, might be written down in the text, but the devil is in the detail. So let me rather than picking up on absolutely everything, I'll pick up on a few.

Dom: Bring out the devil.

James: He's on his way. So in that statement, the settlement proposal that you're referring to Google tried to define privacy sandbox as just third party cookies, that was not the CMA's intention. So we would expect another draft of that agreement to define the entire of privacy sandbox and like technologies.

The agreement requires reporting. So that's like me turning up and saying, here's my report. There's no requirement to do anything about noncompliance. Those sorts of important details, I hope we can agree, are pretty significant.

When we drill in to the detail, Google is saying, yes, we're not going to use this other form of data like browser sinking. But they're not saying they're not going to use all the information they get when you're logged into Google's products and services that isn't obtained through browser syncing. They're saying that they won't do certain things within certain timeframes. But they'll still be able to do them outside of those timeframes, for example.

So as Marketers for Open Web, as you can imagine, our legal team have spent a lot of time going through that document, and working to highlight the improvements that need to be made for it. Like I said earlier, it's a bit hollow at the moment, it's a good start, we welcome the fact that there was a consultation so that organizations like ours can provide our input. And we would hope that a revised agreement to reflect the input we've provided will come out in due course.

But there's many things in that statement that you cannot take it at face value. And let me give you a timely example of that. You mentioned at the beginning of the podcast, the French competition authority, who fined Google 500 million Euros simply for negotiating in bad faith. I don't think that sets a great precedent, as far as Google's approach to negotiation is concerned.

Rich: I think you make a great point here in that you have to incentivize the behavior you want and not having penalties attached to non-compliance. That just is a huge red flag, I mean, I know you mentioned many things, but that is the one that just jumps right out at me.

James: Yeah. I mean, what you want is just like Sarbanes-Oxley, in the SEC, you know, if that report about our compliance is found to be false, the person who signed it off faces jail time. Yeah, that incentivizes good behavior.

Rich: Absolutely, yeah.

James: Yeah. And it is well established, refer to the previous two organizations. You know it's not hard stuff.

Rich: So James, we are just about out of time here. So I'd like to ask you, is there a call to action for marketers today? How can they help affect change here? And what are some of the steps that they can take now to prepare for the changes that are coming down the road?

James: Well, look, the number one thing to do after listening to this podcast, is, don't be complacent. Okay? Don't sit back and think that someone else is sorting out this problem for you. Yeah, that's what I thought was happening if I go back to 2019, I'm focused on the growth of my business, I'm creating new innovation, I'm working on these things. And then suddenly, I come along and go, oh, my goodness, these features the web primitives, effectively, the Lego bricks that make the web work, they're being taken away. So there is a burden to understanding. I think as soon as you sort of accept that you need to spend, you know, two hours a week, kind of following what's going on and leaning in a little bit more, ask your suppliers, you know, what are they doing about it, depending on your role in the ecosystem, of course. What are they doing about it? Are they engaged at the W3C Do you need to be engaged at the W3C Are you a member of a trade body that's involved in the W3C? Are you asking that trade body what's going on? Are you asking them for updates and reports and things like that?

Start to scenario plan. What does it mean to your business? We've explained earlier the impact of FLoC. Is that going to affect your ability to reach audiences? I suppose I can understand if it's not an outcome I would like but if you think, OK we just got a budget to spend all our digital marketing with Google and Facebook, then I suppose you can start planning for that now. I hope you don't. I hope you'd consider going to some of the independent, open suppliers that can help you and have great offerings and can bring a lot of innovation and help them.

So I think that the main thing to do the number one thing to do is don't lean back, don't think someone else has got your back, because they probably haven't. Do those things that I've just mentioned. And, you know, obviously, follow this podcast that the group here, Marketers from Open Web are there as well. If you want to get involved in that, please contact me, LinkedIn or the website. And we can help you as well.