Warning—digital fingerprinting is back
With Google’s last tracking u-turn fresh in the mind, here comes another one. Not only have cookies won a stay of execution, it now looks like digital fingerprinting is back as well. But as one regulator has pointed out, Google itself has said that this type of tracking “subverts user choice and is wrong.” And yet here we are—wrong or not. “We think this change is irresponsible,” the regulator warns.
For its part, Google cites advances in so-called privacy-enhancing technologies (PETs) as raising the bar for user privacy, enabling it to loosen the shackles on advertisers and the hidden trackers that underpin the internet and make the whole ecosystem work. This, it says, will unlock “new ways for brands to manage and activate their data safely and securely,” while “also giving people the privacy protections they expect.” The risk is that this simply rolls the dark side of tracking cookies forward into a new era, and in a way that is impossible for users to unpick to understand their risks.
The specifics are complex—these are the algorithms that ingest all the data signals you give off when browsing the internet on any device, some based on who you are—device, IP and credential identifiers, but also the sites you visit and apps you use as a map to be followed and analyzed. The change has been prompted, Google explains, in part by “the broader range of surfaces on which ads are served.” This includes smart TVs and gaming consoles, as well as all your usual browser and app activity.
While Chrome has taken plenty of flack for tracking, this takes it to a new, very different level. “In the past decade,” Google says, “the way people engage with the internet changed dramatically. So we’re constantly evaluating our policies to ensure they reflect the latest evolutions in technology and meet our partners’ needs and users’ expectations.” And so from February 16, Google will be “less prescriptive with partners in how they target and measure ads” across “the broader range of surfaces on which ads are served (such as Connected TVs and gaming consoles).”
“Fingerprinting involves the collection of pieces of information about a device’s software or hardware, which, when combined, can uniquely identify a particular device and user,” explains Stephen Almond, representing the UK’s Information Commissioner’s Office. “The ICO’s view is that fingerprinting is not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected. The change to Google’s policy means that fingerprinting could now replace the functions of third-party cookies.”
The ICO says that “when you choose an option on a consent banner or ‘clear all site data’ in your browser, you are generally controlling the use of cookies and other traditional forms of local storage. Fingerprinting, however, relies on signals that you cannot easily wipe. So, even if you ‘clear all site data’, the organisation using fingerprinting techniques could immediately identify you again. This is not transparent and cannot easily be controlled. Fingerprinting is harder for browsers to block and therefore, even privacy-conscious users will find this difficult to stop.”
Changes to user tracking confirmed
Both the regulator and Google have confirmed they’ll continue to engage on this change, which the ICO says is a “u-turn in its position and the departure it represents from our expectation of a privacy-friendly internet.” The regulator has also issued a stark warning for businesses that might be readying themselves for the gloves to come off in February when the changes kick in. “Businesses do not have free rein to use fingerprinting as they please. Like all advertising technology, it must be lawfully and transparently deployed—and if it is not, the ICO will act.”
Google gives an example of the need for such fingerprinting in its announcement—smart TVs and streaming services. “Internet users are embracing Connected TV (CTV) experiences, making it one of the fastest growing advertising channels. Businesses who advertise on CTV need the ability to connect with relevant audiences and understand the effectiveness of their campaigns. As people and households increasingly shift to streaming platforms, the ecosystem should invest in and develop solutions that are effective and measurable in an incredibly fragmented environment.”
Put simply—cross-platform, cross-device ad tracking. A move which does take the focus away from Chrome as being the epicenter of Google’s tracking empire—the timing of which is interesting.
It’s hard to imagine a more complex backdrop, with the ongoing DOJ action that is expected to see changes mandated, including the potential for Chrome to be divested. Then there is the uncertainty as to what will replace tracking cookies. “Businesses should not consider fingerprinting a simple solution to the loss of third-party cookies and other cross-site tracking signals,” the ICO says, insisting users have “meaningful control over how their information is used to show them personalized adverts.”
At its simplest, while tracking cookies are a nasty underpin to the internet, they can be seen and controlled, whether by those website popups or electing to use some form of private browsing that blocks such cookies altogether. Digital fingerprinting is not as obvious and so is harder to spot and to block, it’s also more open to clever manipulation as the tracking industry tests boundaries.
Google says it can “apply privacy-preserving protections that help businesses reach their customers across these new platforms without the need to re-identify them. And because we’re looking to encourage responsible data use as the new standard across the web, we’ll also partner with the broader ads industry and help make PETs more accessible.”
Coming just months after the tracking cookie u-turn and with no firm Plan B in sight, this is already being greeted with significant regulatory skepticism. For users it’s yet one more reason to think carefully about the browser they use and the settings they apply across all their smart devices.
I have approached Google for any comments on these regulatory warnings.