Web browser privacy updates and what they mean for your tracking

Why so many privacy updates?

Whether we’ve been searching for electric bike reviews on Google or sharing parenting memes on Facebook, most of us have been giving away more and more data about ourselves over the last decade. Concerns about privacy and how our data is used has been growing in parallel. By the time the Cambridge Analytcia scandal was uncovered in 2018, the big tech companies were well aware that things had gotten out of control. Apple for example had already stepped up measures to protect users privacy in early 2017 with the introduction of Intelligent Tracking Prevention (ITP) which reduced the amount of data sites could share for Safari users.

Upon introducing ITP, product lead John Wilander at Apple said “The success of the web as a platform relies on user trust. Many users feel that trust is broken when they are being tracked and privacy-sensitive data about their web activity is acquired for purposes that they never agreed to.” Its safe to say this rationale still holds true today and perhaps is why Safari, Chrome and Firefox are all speeding up the roll out of new privacy updates that lessen publishers and advertisers ability to track users. As these changes gather pace, here we take a look at what they mean for marketers and publishers as we head into a privacy focused 2020 internet.

The key browser updates in 2019, so far

Safari

Due to high adoption of Apple products in this part of the world, an estimated 32% of web traffic happens on Safari browsers in New Zealand. For some publishers that number will be higher. Apple have done three key updates this year, with the most recent (ITP2.3) being rolled out over the last two months, all with the objective of further limiting cross site tracking capabilities.

To dive into the specifics for a technical audience, Apple have provided a dedicated section in the Webkit blog which breaks out the implications of each update for developers and tracking specialists. If you’re looking at reviewing your tracking strategy its recommended reading:

https://webkit.org/blog/category/privacy/

In more simple language, there are now tracking limitations on Safari for almost any form of cookie used to read and write data from one website to another. At the start of this year there were a number of workarounds for tracking that did not rely on third party cookies. The most common method was passing unique IDs from one domain to another using link decoration (for example facebook.com?clickid=456), unique IDs would be stored as first party cookies on the destination sites, and would pass back information to the referring site using javascript.

This method was effective until the start of 2019 when ITP2.1 capped the lifetime of such cookies, by the time ITP2.2 rolled out such cookies would only persist for 24 hours if Apple’s machine learning algorithm determined they came from a site with cross domain tracking capability (or intention). At this point there were still one or two easy loopholes available such as having unique IDs stored using a website’s local storage. This loophole was closed down a month ago so now any script-writeable data shared between sites now has a capped lifetime.

The changes rolled out in Safari this year have significant implications for conversion tracking, web analytics, attribution and remarketing. We’ll look at ways to deal with this a little further on.

Chrome

Google Chrome has an estimated 55% market share in New Zealand, however changes rolled out for Chrome are less extreme as those rolled out for Safari, this is perhaps because Google earns its revenue from advertising and stands to benefit from cross site tracking in some ways. In saying that, Google recently flagged a more significant overhaul of Chrome privacy controls changes for next year.

Foreshadowing their 2020 privacy overhaul Google said “We have a big, bold vision for how we think privacy should work on the web, how we should make browsers and the web more private by default.” While recent updates to Chrome made it easier for people to opt-out of cookie tracking, research suggest opt-out rates are low as most people don’t read the fine print. Google have also briefed developers on marking all cookies as first or third party, this might be so they can respect personalisation and user experience benefits that come with first party cookies.

Google have acknowledged research indicated the lack of third party cookies can impact publisher revenue by as much as 50%, and indicated their desire to strike the right balance between privacy and a healthy online advertising and publishing ecosystem. To this end they plan to introduce the idea of a “privacy budget”. This concept would allow websites to gather enough data about users to track them at a group level, but not a personal level.

Others

With Chrome and Safari holding almost 90% market share, any changes with other browsers are not going to have a material impact. However Firefox and Edge are both rolling out their own privacy measures which indicates that whatever benchmarks are set will likely to be followed by the other smaller players in the browser market.

Potential headaches and what you can do

Most of the challenges of the browser privacy updates are around tracking Safari users, Apple is used to doing things their own way and they don’t have an advertising business to worry about. Their number one priority is respecting the privacy of users to sell more devices, but for publishers, marketers and ad-tech providers this has created some unintended consequences.

Web analytics

Safari users will show an inflated number of users in Google Analytics as anyone coming back after one week may be recorded as a new user. To understand how this impacts your reports you can view your historical data around unique user to session ratios, which will let you give you a reference point to estimate more accurate data.

Attribution

With unique tracking IDs only persisting for between one and seven days, it will be harder to get a clear picture of marketing attribution across the purchase consideration funnel. For example a user reads some sponsored content on a publisher site for brand X, engages with the content by clicking to view brand X’s product range, then returns two weeks later to make a purchase on brands X’s website, attribution of the valuable top-of-funnel work done by the publisher is lost.

To retain some level of visibility you may choose to use attribution insights from Chrome users to make assumptions about Safari users, as the overall numbers will now be skewed.

Remarketing and DMPs

The accuracy of audience segments will suffer, as will marketer’s ability to remarket for longer periods of time. Some DMPs will see inflated numbers in segments as new users are created from visitors who may already be in the data segment. On the remarketing side previously effective strategies like identifying user’s purchase intent through Google search and remarketing over the following 30 days will no longer work, or will work for much shorter time windows.

Other tracking

There are many other scenarios where tracking plays a useful role for marketing effectiveness, personalisation, marketing automation and tracking affiliate marketing conversions and lead generation. Most of these will be affected in some way.

For businesses that rely on conversion information the days of being able to easily deploy tracking scripts through Google tag manager are over. The robust technique conversion tracking now involves websites passing and storing unique IDs via their own servers, rather than passing this information through the browsers. Affiliate networks, for example, set up this form of tracking as a standard now. On the one hand it’s a little more development work up front but on the other it prompts publishers and advertisers to be selective about who they work with.

What the future might hold

Those with large walled gardens, such as Facebook, Amazon and Google are likely to benefit from their massive amounts of first party data. Publishers that create walled gardens through logins for example may also benefit, if they can maintain adequate scale. Of the two major browser providers, many in the industry view Google’s approach as doing a better job of respecting the needs of all the different players in the online marketing ecosystem, but it may take years for standard adoption.

There are others that think things have gotten too far out of control and that these changes will not do enough to protect users privacy. The inventor of the internet, Tim Berners-Lee, is one of those. His new project, Solid, aims to create an entirely new and modular internet. One where users proactively determine who they share their data with, and what they share. An idea so bold it could very well be the thing that nobody expected would come along and disrupt the internet as we know it.