Toward (Greater) Consumer Surveillance in a ‘Cookie-less’ World: A Comparative Analysis of Current and Future Web Tracking Mechanisms
Authors: Sivan-Sevilla Ido , Parham Patrick T. 
Published: July 2022

The anticipated shift of the advertising industry away from third-party cookies has been marketed as ‘privacy friendly.’ New cookie-less tracking technologies are being proposed, but the consumer privacy implications of those technologies are far from clear. To what extent ad-networks are going to change their practices, and no longer rely on cross-site consumer surveillance or historically rich consumer profiles for advertising purposes? Can the new tracking technologies become GDPR-compliant, given the significant compliance pushback against cookie-based advertising mechanisms?Our study seeks to evaluate the potential privacy harms of cookie-less advertising ID solutions by (1) building novel typology of tracking specifications to assess the privacy impacts of tracking technologies; (2) deductively analyzing cookie-based tracking mechanisms by collecting novel data on persistent user identification across the top 100 popular websites that work with all four main supply side platforms (SSPs) - Pubmatic, OpenX, AppNexus, and Rubicon; and (3) contrasting those findings with deductive analysis of data collected from technical industry documentation on the three main cookie-less ID architectures - The Trade Desk Unified ID 2.0, LiveRamp ID, and Secure Web Addressability Network (SWAN). We find how the new tracking architectures can make consumer surveillance in the Web dynamically wider, more persistent over time, and extra vulnerable to integration of first- and third-party data by advertisers. This could lead to the circumvention of consumer targeting restrictions posed by the main advertising platforms, in case advertisers choose to bid on ads based on sensitive profile categories. In contrast to existing criticism on cookie-less tracking solutions that mostly focuses on deficiencies in consent mechanisms or the lack of a governing body for the new solutions, our study underscores the structural impact of ad networks on the potential privacy harms caused by the proposed tracking mechanisms. Structures and processes of ad networks might lead to potentially longer, wider, and richer consumer surveillance, compared to cookie-based tracking mechanisms. Our findings also question the ability of suggested tracking architectures to become GDPR compliant. Despite civil society pushback against the current cookie-based tracking ecosystem and the marketing of new tracking solutions as ‘privacy-preserving-advertisement,’ we show how these technologies enable granular tracking and targeting of consumers. ‘Singling out’ individuals might become easier for advertisers, given the historically rich consumer profiles that advertisers are now incentivized to build. In contrast to existing debates about Universal ID solutions and GDPR compliance, that mostly focus on the lack of data controller and data processor roles in the proposed architectures, we are stressing the extent of profiling and targeting that the new solutions allow and the way they violate key GDPR principles such as article 9 and recital 26.Our empirical findings not only challenge the assumption that excluding third-party cookies would decrease consumer surveillance, but also show the potential for consumer surveillance to expand, seriously questioning the ability of those solutions to comply with the GDPR. A shift in one tracking instrument, as central as that instrument might be, cannot bridge the inherent gaps in consumer privacy caused by the structures &amp; incentives of the online advertising market.