In the W3C, the Post-Cookie Conversation Finds Consensus

As the advertising industry braces itself for the deprecation of third-party cookies at the end of this year, web standards body the World Wide Web Consortium (W3C) is getting closer to reaching a consensus among its members on privacy-centric ad-tech that could power advertising in a cookieless future.

In August, Apple introduced a new version of its attribution proposal to the W3C, drawing ideas from the competing proposals of Google and Meta/Mozilla (which have been working together in the W3C).

Last week, Meta floated a new technical approach to its proposal that brings it closer to Apple’s framework at a meeting of the Private Advertising Technology Community Group within the W3C.

These developments from Apple and Meta are significant because if the W3C can usher in a new web standard for advertising without cookies, the major browsers would need to broadly agree. For this to happen, the different proposals of each browser need to be revised to become more similar until they morph into a shared vision.

“It’s interesting to see the size of the very large companies that are cooperating for a unified standard for this kind of thing,” said Don Marti, vice president of ecosystem innovation at publisher network Raptive and participant in the PATCG.

Standards organization the W3C—responsible for crafting technical policies for the structure of the internet—has been around since 1994 and counts nearly 370 members, including Meta, Microsoft, Google, The Trade Desk and The Washington Post. The W3C gained wider awareness among advertisers once Google announced cookie deprecation.

Notably, the W3C meetings last week provided a forum for the IAB Tech Lab and Google to thrash out some disagreements regarding Google’s Privacy Sandbox proposals, specifically the Attribution Reporting application-programming interface.

“We’re excited to see multiple browsers bringing proposals and that those proposals share similarities with the Attribution Reporting API,” a Google spokesperson said. “There’s clearly increasing alignment on the need for privacy-centric solutions that support an open web.”

The recent tone of W3C meetings contrasts with the broader industrywide conversation on cookieless advertising, which has been marred with inaction and discord. But the ability of this work to become anything more than productive conversations also depends on the W3C’s own politics.

Discrepancies in attribution frameworks

The W3C’s PATCG has been focused specifically on the attribution use case of advertising, or matching a customer action to the ad that potentially caused it—a piece of digital advertising that marketers have become reliant on.

One of the major differences to resolve is that the Meta/Mozilla and Apple proposals would break up users’ information and store it in multiple places via a process called multiparty computing. Google’s proposal relies on a trusted server, said Nick Doty, senior technologist at the nonprofit Center for Democracy and Technology.

But the W3C is only focused on the attribution use case, Doty said, adding, “[For] targeting proposals, I haven’t seen as much community consensus.”

For a while, the W3C was reluctant to enter the privacy-centric advertising conversation, said Aram Zucker-Scharff, engineering lead for privacy and security compliance for The Washington Post and co-chair of the PATCG. He said it took until Google Chrome announced that it was deprecating third-party cookies before ad-tech companies were willing to reevaluate measurement solutions they were invested in. Safari and Firefox deprecated third-party cookies in 2017 and 2019, respectively.

The authority of the W3C

There is still reluctance. Most conversations have been happening in the PATCG, and eventually, there would need to be a working group on private advertising for the organization to make any formal standard about advertising on the web.

However, the W3C hasn’t decided yet whether this working group should exist.

“[There are] people who don’t think this consortium should take on this work,” Doty said.

Plus, the W3C is not a government organization. Much of the fate of private advertising solutions is in the hands of the U.K.’s Competition and Markets Authority, which is monitoring Google Chrome’s cookie deprecation process and assessing its Privacy Sandbox proposals. The CMA has the power to stop Google’s plans if the regulatory body feels that they give Google an unfair market advantage.

“The W3C doesn’t have law enforcement,” Zucker-Scharff said. “There isn’t anything that will force browsers to use anything.”