My talk from Digital Elite Day 2020 (Conversion Elite track). I go over the main changes in browser tracking protections since as early as 2003 (Safari version 1). Then I discuss the impact these tracking protections have on digital analytics, advertising, and experimentation.

1. Web browsers and tracking protections
Impact on data, experimentation, and personalization
@SimoAhava from @8_bit_sheep at #DigitalElite20

2. Simo Ahava
Partner, co-founder, 8-bit-sheep
Google Developer Expert, Google Analytics
Blogger, developer, www.simoahava.com
Twitter-er, @SimoAhava
Curator, www.cookiestatus.com

5. www.CookieStatus.com

6. Tracking protections? From
what?

8. Default browser settings

9. Default browser settings
designed to protect the user

10. Default browser settings
designed to protect the user
from tracking vectors that
can be harmful

11. Default browser settings
designed to protect the user
from tracking vectors that
can be harmful
which the user has traditionally
only been able to opt out of.

12. Graphic adapted from https://web.dev/samesite-cookies-explained/
https://www.simoahava.com/

13. Graphic adapted from https://web.dev/samesite-cookies-explained/
Same-site === First-party context
https://www.simoahava.com/

14. Graphic adapted from https://web.dev/samesite-cookies-explained/
https://image.cdn.com/image.gif
https://www.simoahava.com/

15. Graphic adapted from https://web.dev/samesite-cookies-explained/
Cross-site === Third-party context
https://image.cdn.com/image.gif
https://www.simoahava.com/

16. Graphic adapted from https://web.dev/samesite-cookies-explained/
https://page.somedomain.com/
https://page.otherdomain.com/
https://page.thirddomain.com/
https://image.cdn.com/image.gif
All pages include a request to the third-party resource, thus including
all cookies written on the third-party domain, enabling cross-site tracking.

17. Not just cookies, my friend

18. Trackers can leverage other types of browser storage.

19. Identity platforms can decorate all outbound links.

20. Trackers can utilize stateless tracking, such as fingerprints.

21. Third-party-to-first-party collusion, e.g. with CNAME.
https://www.simoahava.com/web-development/whats-in-a-cname/

22. The (perceived) dangers of
cross-site tracking

23. Build graphs and comprehensive audience profiles

24. Build graphs and comprehensive audience profiles
Target ads

25. Target ads
Manage ad frequency
Build graphs and comprehensive audience profiles

26. View-through attribution
Manage ad frequency
Build graphs and comprehensive audience profiles
Target ads

27. Manage ad frequency
Build graphs and comprehensive audience profiles
Cookie matching/syncing
View-through attribution
Target ads

28. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads

29. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations

30. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows

31. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows
State in embedded services

32. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows
State in embedded services
Multi-purpose scripts

33. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows
State in embedded services
Multi-purpose scripts
1st party data collection

34. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows
State in embedded services
Multi-purpose scripts
1st party data collection
Tag management

35. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows
State in embedded services
Multi-purpose scripts
1st party data collection
Tag management
Client-side state

36. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows
State in embedded services
Multi-purpose scripts
1st party data collection
Tag management
Client-side state
Data quality

37. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows
State in embedded services
Multi-purpose scripts
1st party data collection
Tag management
Client-side state
Data quality

38. Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-through attribution
Target ads
Analytics integrations
SSO / login flows
State in embedded services
Multi-purpose scripts
1st party data collection
Tag management
Client-side state
Data quality

39. Browsers take the initiative

41. 2003
3P cookies blocked
by default without prior
"seeding"

42. 2003
3P cookies blocked
by default without prior
"seeding"
…

43. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites

44. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018 Storage Access API

45. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018 Storage Access API
ETP
3P storage access on known
tracking domains blocked

46. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018 Storage Access API
ETP
3P storage access on known
tracking domains blocked
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation

47. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
ETP
3P storage access on known
tracking domains blocked
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation

48. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation

49. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation
Tracking parameters removed
from URLs

50. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation
Tracking parameters removed
from URLs
Tracking protection
in Edge beta

51. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
2020
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
All 3P cookies blocked
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation
Tracking parameters removed
from URLs
Tracking protection
in Edge beta

52. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
2020
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
All 3P cookies blocked
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Daily purge of storage from
known tracker domains
Requests to fingerprinting
domains blocked
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation
Tracking parameters removed
from URLs
Tracking protection
in Edge beta

53. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
2020
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
All 3P cookies blocked
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Daily purge of storage from
known tracker domains
Requests to fingerprinting
domains blocked
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation
Tracking parameters removed
from URLs
Pioneering work on reducing
fingerprinting surfaces
continues
Tracking protection
in Edge beta

54. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
2020
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
All 3P cookies blocked
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Daily purge of storage from
known tracker domains
Requests to fingerprinting
domains blocked
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation
Tracking parameters removed
from URLs
Pioneering work on reducing
fingerprinting surfaces
continues
Tracking protection
in Edge beta
Chromium Edge released
Block 3P storage access from
known trackers

55. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
2020
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
All 3P cookies blocked
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Daily purge of storage from
known tracker domains
Requests to fingerprinting
domains blocked
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation
Tracking parameters removed
from URLs
Pioneering work on reducing
fingerprinting surfaces
continues
Tracking protection
in Edge beta
Chromium Edge released
Block 3P storage access from
known trackers
Referrer truncation

56. 2003
3P cookies blocked
by default without prior
"seeding"
…
2017
ITP 1.0
Algorithmic classification
of tracking-capable sites
2018
2019
2020
…
Storage Access API
ITP 2.1 - 2.3
Restrictions on 1P storage
Referrer truncation
All 3P cookies blocked
ETP
3P storage access on known
tracking domains blocked
ETP set on by default
for all Firefox installs
Daily purge of storage from
known tracker domains
Requests to fingerprinting
domains blocked
Brave Shields
3P storage access blocked
1P cookies restricted
Referrer truncation
Tracking parameters removed
from URLs
Pioneering work on reducing
fingerprinting surfaces
continues
Tracking protection
in Edge beta
Chromium Edge released
Block 3P storage access from
known trackers
Referrer truncation
All 3P cookies blocked?

57. Bubbling under

58. Technology Preview 113
Restrict cookies set in HTTP requests to cross-site CNAME origins.
Brave Chrome Edge Firefox Safari

59. Brave Chrome Edge Firefox Safari
Cookies set to SameSite=Lax by default.
Reject SameSite=None cookies that are not secure.
Chrome 80, *Jul 14 ->

60. Cap lifetime of all script-writable storage.
Brave Chrome Edge Firefox Safari
!

61. Block all cookies in 3P context.
2022?
Brave Chrome Edge Firefox Safari
!!

62. User-Agent freeze and Client Hints.
Chrome 85 (CH), 2021 (UA)
Brave Chrome Edge Firefox Safari

63. Technology Preview 99
The isLoggedIn API (experimental).
Brave Chrome Edge Firefox Safari

64. Private Click Measurement / Ad Click Attribution.
Brave Chrome Edge Firefox Safari

65. Impact

66. Analytics Advertising Experimentation

67. Analytics Advertising Experimentation
3P storage
restricted
* *

68. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations

69. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection

70. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity

71. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity
1P storage
restricted

72. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity
1P storage
restricted
User retention
Cohort analytics
Non-last-touch attribution
Campaign efficiency
User-scoped funnels

73. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity
1P storage
restricted
User retention
Cohort analytics
Non-last-touch attribution
Campaign efficiency
User-scoped funnels
Attribution
Audience integrity
Campaign efficiency

74. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity
1P storage
restricted
User retention
Cohort analytics
Non-last-touch attribution
Campaign efficiency
User-scoped funnels
Attribution
Audience integrity
Campaign efficiency
Variant reassignment
Variables for personalization

75. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity
1P storage
restricted
User retention
Cohort analytics
Non-last-touch attribution
Campaign efficiency
User-scoped funnels
Attribution
Audience integrity
Campaign efficiency
Variant reassignment
Variables for personalization
Referrer
truncation
*

76. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity
1P storage
restricted
User retention
Cohort analytics
Non-last-touch attribution
Campaign efficiency
User-scoped funnels
Attribution
Audience integrity
Campaign efficiency
Variant reassignment
Variables for personalization
Referrer
truncation
*
Full referrer dimension
AMP cache distinction
Social login distinction
Granularity of referral exclusion

77. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity
1P storage
restricted
User retention
Cohort analytics
Non-last-touch attribution
Campaign efficiency
User-scoped funnels
Attribution
Audience integrity
Campaign efficiency
Variant reassignment
Variables for personalization
Referrer
truncation
*
Full referrer dimension
AMP cache distinction
Social login distinction
Granularity of referral exclusion
Attribution for custom ad
placements

78. Analytics Advertising Experimentation
3P storage
restricted
* *
Iframes
Centralized identity
Advertising integrations
Cross-site profiling
Ad frequency capping
View-through attribution
Cookie matching / sync
Demographics / interest data
Fraud / spam detection
Iframes
Centralized identity
1P storage
restricted
User retention
Cohort analytics
Non-last-touch attribution
Campaign efficiency
User-scoped funnels
Attribution
Audience integrity
Campaign efficiency
Variant reassignment
Variables for personalization
Referrer
truncation
*
Full referrer dimension
AMP cache distinction
Social login distinction
Granularity of referral exclusion
Attribution for custom ad
placements
Experiment targeting based
on referrer

79. DOs and DON’Ts

80. DO
-Periodically audit the use of client-side state in your sites, services, and applications. Avoid
over-reliance; use HttpOnly where possible, then HTTP headers, then JS.
-Figure out how to incentivize logging in.
-Set cookies you need in third-party context to SameSite=None;Secure, with fallbacks
for unsupported browsers.
- Utilize Storage Access API for access to third-party storage.
-Consider the browser as a manifestation of the user’s desire and intent with regard to
tracking. Err on the side of as much privacy as possible.

81. DO NOT
-Look at "server-side analytics" as a silver bullet.
-Ignore small market share web browsers.
-Expect tracking prevention development to settle / slow down.
-Spread FUD about the impact of these measures without empirical data to back it up with.
-Expect that browsers will handle the ethical / legal side of data collection for you.
-Think that browsers have got tracking prevention "right"

82. Follow and participate

83. @BrendanEich
@EricLaw
@JohnWilander
@JustinSchuh
@Log3OverLog2
@pes10k
@RandomnessnCats
@SimoAhava
@TheZEdwards
bit.ly/privacy-sandbox
brave.com/blog
chromestatus.com/features
cookiestatus.com
cunderwood.dev
haveibeenpwned.com
panopticlick.eff.org
webkit.org/blog
webkit.org/tracking-prevention-policy
bit.ly/ad-click-attribution
bit.ly/privacycg
bit.ly/privacy-ig

84. log(`Thank you, ${yourName}`)