What happened to the post-cookie era, with IAB Tech Lab’s Anthony Katsur

“If there’s wild amounts of opt-in, then yeah, the third-party cookie in the Chrome ecosystem is probably alive and well. If there’s [a] wild amount of opt-out, if there’s no critical mass around the third-party cookie, then it is effectively dead, even if it lives on in some small percentage. We just — we don’t know how that’s going to shake out,” said Anthony Katsur, CEO of IAB Tech Lab, in the latest Digiday Podcast episode, which was recorded on the eve of the Interactive Advertising Bureau’s Annual Leadership Meeting in Palm Springs, Calif., which concludes on Jan. 28.

If Katsur had his way, though, the third-party cookie wouldn’t be on the chopping block in the first place. Moreover, other technologies like the IP address would continue to be available to be used for identifying audiences and tracking them across devices. At least until more inherently privacy-friendly identity options gain adoption. 

But it may be a while before the digital advertising industry’s post-cookie identity picture really comes into focus.

“It will be the year of identity solutions, the year of ID-less [solutions] for, I think, the next decade. I think this is a 10-year trajectory we’re on. And I think it’s a combination of regulatory forces, machinations of Big Tech is what I think is going to drive this,” Katsur said.

Here are a few highlights from the conversation, which have been edited for length and clarity.

The case for the cookie

My candid feedback is that the third-party cookie shouldn’t go away at all, because it’s supported interoperability between vendors and browsers for 25 years. The cookie, in and of itself, is not the bad actor. Bad actors that abuse the use of the cookie and that don’t adhere to consumer privacy law and abuse the cookie to that extent, that’s the problem.

The case for stronger privacy enforcement vs. 3P cookie elimination

States are being very proactive here. California has already proven they will enforce. GDPR has been enforced; there’s been enforcement of GDPR in Ireland and other jurisdictions across Europe. So there’s been enforcement. I would like to see more stringent enforcement. I’d like to see stiffer penalties for those that abuse consumer privacy or don’t honor consumer privacy.

The case against a new user consent mechanism in Chrome

Our feedback to the [U.K.’s Competition and Markets Authority, which is effectively overseeing Google’s cookie phase-out plans] is we’re just concerned about how [Chrome’s user choice consent mechanism] is going to be positioned to the consumer. All credit to Chrome; Chrome already has very robust privacy controls in their preferences, and it’s one-click deep. So our feedback has been, Don’t confuse the consumer. And what could possibly manifest itself in some form of consent dialog box at the browser level that the consumer doesn’t already have access to one click away. If it was really a concern of the consumer, they’re a click away from modifying their privacy preferences.

Post-cookie preparations

As long as the third-party cookie is alive and kicking, the industry will continue to leverage that interoperable token between providers. There’s still very active use of the cookie. However, the more companies I speak with, the more of them have contingency plans in place and/or are testing other solutions, other approaches to identity. So it’s given the industry time to kick the tires on other approaches, which when — and I really believe it’s when — the third-party cookie is effectively deprecated, the industry will have alternatives.