Google Changes the way Cookies Work on Chrome

[engine]

Google is planning on changing the way cookies work on Chrome to strengthen privacy, and will show this later this year.
It'll modify the way cookies work, and developers will have to explicitly specify which cookies are allowed to work across websites, especially related to user tracking. This is using SameSite cookies. [web.dev...]

In the coming months, Chrome will require developers to use this mechanism to access their cookies across sites. This change will enable users to clear all such cookies while leaving single domain cookies unaffected, preserving user logins and settings. It will also enable browsers to provide clear information about which sites are setting these cookies, so users can make informed choices about how their data is used.

Google says that this also has a significant security benefit for users by protecting cookies from cross-site injection and data disclosure attacks like Spectre and CSRF by default. Google went on to say its plan to eventually limit cross-site cookies to HTTPS connections, adding to user protection.

Dev builds of Chrome will allow developer testing.

Chrome will also aggressively restrict fingerprinting across the web.

[blog.chromium.org...]

[Dimitri]

Hi,

It sounds like the upcoming ePrivacy-Directive requirements more than a real initiative. Isn't it?

[Law59]

Hi
No I think this is better for the every day use of everyone. These big companies are just ruining the free internet, trying to capture every move ordinary
people make it's shocking.
It's about time browser developers got their act together and put an end to sites been able to download anything they like onto peoples computers,
as you can see I believe all cookies should be band!

[tangor]

@Law59 ... Welcome to Webmasterworld!

Cookies have been a part of the net since forever, unfortunately, they have also become abused ...

Will g's attempt to corral such behavior work? Probably not. The bad actors will figure a way to work that as well. Does that mean no attempt should be made? Not at all!

Will it work? Only time will tell.

What is clear is users are beginning to wake up to the issue and some are taking steps with script and cookie restrictions (browser or add-on functions) and this might be g's response to that growing number of users. If users really get smart and nuke all cookies except the actual site they are on, g's biz could be severely impacted.

Question is ... too little too late?

[engine]

Law59, Welcome to WebmasterWorld. [webmasterworld.com]

The more i've been reading about this the more i'm concerned about the spin being applied. Yes, it will help with privacy by third party cookies, and, importantly, abuse by bad actors.

Is this now locking people more into Google's ecosystem?

[tangor]

Is this now locking people more into Google's ecosystem?

A very valid question!

Meanwhile, users are addressing this in increasing numbers ... not yet a tipping point, but certainly numbers sufficient to indicate a trend.

[RhinoFish]

That's the way the cookie crumbles...

[tangor]

^^^ groan!

[DixonJones]

^^^ Does RhinoFish get censored for that? :)

This seems a welcome and necessary move as far as I can see, but I can absolutely see Engine's point that it have the ulterior motive of locking in market share for Google/Chrome. That said, each browser seems to have its own LastPass equivalen built in these days, and I am switching netween browser types more than ever before. Indeed... I actully enjoy having my Chromium settings so locked down that I can't even use Google.com for long before it baulks, at which case I hit Edge, or Safari or Firwfox, depending on what frontstage persona I wish to offer the Interweb at that moment.

[tangor]

Fun and games for those who know how to play ... USERS on the other hand, they are handicapped by not even knowing what the game is!

Time will tell.

[heisje]

Is this now locking people more into Google's ecosystem?

This is the sole objective, have no doubt. As always with G, malevolence under the guise of benevolent intentions such as 'do no evil', 'user experience', 'war on spam', 'privacy', 'security' and such. Words devoid of their original meaning. Have been playing this game ad nauseam. The meanest wolf in sheep's clothing.
.

[tangor]

I know I come off as a g basher over the years, but that's not entirely correct: I view g as any capitalist (that's not a bad thing!) MONOPOLY levering their market share to the max. Zillion years back it was OIL and RAILROAD, and TELEPHONE and ultimately it do government to level the field, both for consumers and competitors. What we have not seen is any willingness to address the elephant in the room by current authorities. Cookies are the least of the problem ... and g appears to be making an effort to ward off any legislation by proclaiming: "we addressed this!" with a new cookie policy.

These days it has nothing to do with "do no evil", but with expanding the bottom line. In that regard I am neither surprised, or offended, by g ratcheting up the skim. :)

It is just business ... until somebody (gov) takes exception for "price fixing" etc. Recently privacy and personal data are included.

[engine]

I'd like to move on from the reasons behind it to the developer technical aspects of what we can and cannot do, and what changes we will have to make to ensure seamless performance.

Anyone have some input?

[goodoldweb]

Somehow i do not believe google has the best intentions in heart for users. One more way for them to control your hard earned audience and site data. I have no doubt Adwords and Anlytics data/cookies will somehow be exempt from this new "development".

It is simply designed to blindfold webmasters even more and force them to spend more on ads by not having the data they so much need.

First they took away your search visitors, then they removed your ability to directly communicate with gmail customers via email by burying your emails in the dreadful promotion tab. Now they are going after your site data ensuring a complete blindfold. Google are the only ones allowed to gather every piece of personal data known to man.

[iamlost]

The most telling bit of buried obfuscation is These changes are all backwards-compatible with other browsers.
Thanks, Chrome, welcome to 2013; good of you to get within the past decade of other browsers' privacy behaviours.
Note: yes, SameSite is circa 2016 (RFC6265 [tools.ietf.org]) but much of that behaviour was introduced in Safari circa 2013.

SameSite overall is far less damaging to Google, due to it's ubiquitous reach, than it's 'third party' ad network competitors.

Plus, if one is logged into Google all this cookie SameSite privacy 'nonsense' is moot.

Note: Google is THE maestro of tracking prevention work arounds; always a joy to parse their announcements.

Note: how sites manage SameSite looks, to some extent (will have to wait and test), to mitigate it's tracking 'damage' potential. It will be interesting to watch who 'get' this and who do not.

Note: there remain other quite viable xSite tracking mechanisms than cookies. They are becoming (slightly) more prevalent due to EU's 'cookie' et al regulations and competitors' increase (which will be heightened by this announcement) in browser cookie blocking/containment. Will be interesting to see which are most commonly used/abused and various browser/regulatory reactions.

Note: eg: ye olde 'link decoration' aka using query strings to (among other info passing possibilities) set first party cookies AND can track cross 'companion' sites.
Note: used as example due to WebKit aka Safari announcement last month on changes in ITP 2.2 [webkit.org] addressing link decoration.
Note: never out a competitive advantage before it's gone public.

Final thought: in same post Google also mentioned making fingerprinting more difficult (minus actionable info), which will be intriguing to follow... as currently:
* 99.9% accurate identifying same device same browser over 90 days.
* 97.2% accurate identifying same device xBrowser over 90 days.
* 90.5% accurate identifying xDevice xBrowser over 90 days.
And nary a cookie.