In the online advertising industry, the use of third-party cookies is ubiquitous (for optimisation, retargeting, pricing etc.). However, cookies are transient and may only exist for short periods of time. They can cease to exist because they have been deleted knowingly by the user; or they can be deleted by the web browser due to space restrictions or configuration settings. Cookies can also be blocked completely via browser settings (either by default or by choice). Stricter laws on how cookies are used and increasing online access from mobile devices, that may have different support levels for cookies, further increases the uncertainty about the viability of using 3rd party cookies. So, how useful are they?
Examining recent data from ad impressions on the websites of European Premium Publishers shows that 3rd party cookies are still widely enabled in general (85% of impressions), but much less so on mobile devices (46% of impressions). Furthermore, the data shows that not all cookies necessarily exist for long periods of time - in fact only 48% of impressions have cookies that are observed to exist for longer than 31 days. These figures combined with the news that Firefox will shortly disable 3rd party cookies by default adds weight to the argument that 3rd party cookies, while still adding value today, are not to be relied on for much longer. In other words, the advertising industry currently stands at the precipice of a new era in a world without 3rd party cookies.
We think that this is good news, not only for the privacy of web users, but also for publishers as it gives them an opportunity to regain control of their audience data. Today, the proliferation of ad networks, open ad exchanges, external demand providers etc., means that many publishers are exposing their inventory and their audience data to a multitude of 3rd party players. Publishers are seeing their inventory devalued by demand partners cherry-picking impressions while exploiting the publisher’s audience data collected through 3rd party cookies. Several reports show that this data leakage is harmful and costly for the publisher [1,2]. This data hi-jacking is enabled primarily by the (mis)use of 3rd party cookies and has also resulted in growing concerns from visitors about their privacy , which is the key reason that browser manufacturers are now trying to restrict the use of 3rd party cookies.
But, via 1st party cookies and pay/sign-in walls publishers are actually in a strong position to own, control and value their audience data. This should not need to come at the cost of lower advertising revenue. In fact it is the opposite - private ad exchange solutions using proprietary audience data that are closely integrated with the publisher have the potential to leverage this information to produce better results for both the publisher and the advertiser compared to external exchanges or similar whose sales rely more heavily on information collected via 3rd party cookies. Furthermore, and importantly, private ad exchanges can be used without the risk of data leakage.
Most commentators are predicting the demise of the 3rd Party Cookie in the near future but as our statistics show, the future is now. While a sizeable proportion of visitors still have 3rd party cookies enabled, many of these cookies do not exist for very long, thus limiting their practical usability. Furthermore as IE 10, with ”Do Not Track” by default, and Firefox with 3rd party cookies disabled by default are adopted more, the availability of cookies will be even less. Many in the advertising industry are concerned about this, but primarily those on the advertiser side, who realise that their ability to identify and track users will be severely compromised. In the case of premium publishers with a strong brand, it is now they who have the power. Online publishers can legally and ethically collect information about their visitors using 1st party cookies, sign-ins or paywalls. This audience data is a valuable commodity that should be used to increase advertising revenue of the publisher and allow advertisers to reach their target demographics, while still respecting the privacy of the visitor.
The systems that can advertise most effectively using this data will need to be closely integrated with the publisher, as opposed to many solutions today that include many middlemen between the advertiser and publisher and that often rely on 3rd party cookie information to work well. Publishers using a private ad exchange can avoid leaking data and protect visitor’s privacy, while still optimising return on investment for both themselves and their advertisers.
Appendix - The Statistics
This study examines data from Admeta, collected while serving ad impressions on the websites of premium European publishers. We look at a random sample of 246566 impressions/visits from March 11th 2013. On each of these impressions, a 3rd party cookie was set (or an attempt was made to set it) and we then followed these cookies for a period of 10 weeks to examine how long (if at all) the cookie was observed to have existed .
In Figure 1, we see that approximately 15% of impressions were from visitors that had either had 3rd party cookies disabled or were not seen again after the initial impression. Also significant is that a further 14% of cookies are only observed to exist for less than 24 hours. Of the impressions that have cookies enabled, only 71% are observed to have had cookies longer than 1 day and 48% longer than 31 days. In other words, less than half of the impressions were served to visitors where long-term tracking via 3rd party cookies is viable .
So, where do the cookies go? The browser statistics in Figure 2 show that Safari has the highest proportion of impressions with cookies disabled (73%). However, looking at the cookie lifespans, we can see that for all other browsers less than 60% of the cookies were observed for longer than 31 days - even when 3rd party cookies are enabled by default, there is no guarantee that the cookie will stay around for long. Apart from Safari, Internet Explorer shows slightly shorter cookie lifespans than the other browsers and this correlates with increased adoption of IE 10 that has the ”Do not track” flag set by default. Also of note is that 82% of Firefox impressions are currently trackable. Recent versions of Firefox currently have 21% of the browser market share, which means that up to 17% of all impressions may go from trackable to untrackable when 3rd party cookies are disabled by default in Firefox.
Looking from the device perspective in Figure 3, we see that platforms where Safari is dominant have many impressions from visitors that do not allow 3rd party cookies: iPhone and iPad - 89% of impressions are not trackable; Mac - 45% of impressions are not trackable. And while impressions to non-Apple mobile devices and PCs are certainly trackable, many cookies are still lost along the way: non-Apple mobile - 60% of cookies last longer than 31 days; PC - 50% of cookies last longer than 31 days.
To sum it all up: Third-party cookies are already not useful for huge numbers of impressions and this situation is only going to get worse.
 Note that for practical reasons it is impossible to get the exact cookie lifespan: it may exist for some time after its measurement ends; or it may still exist without being observed (i.e. we can never know if the reason we do NOT observe a cookie is because it no longer exists, or because the visitor has simply not returned). However, it is worth pointing out that the impressions were on premium websites that would typically have many returning visitors. Allowing for this, our measurements should provide a reasonable approximation.
 Note that the duration of the tracking was 10 weeks, so a lifespan less than 31 days means that at least 39 days passed without that cookie being observed again. Thus it seems reasonable to conclude that the cookie no longer exists or the impression is for a visitor with little browsing history to track.
This article was done in collaboration with my Admeta Colleagues: Anders Sjögren, Knut Nordin and Ola Tiverman.
- Tom Chavez. Publishers and the hidden costs of data leakage, July 2010.
- Krux Digital. Krux digital study: Significant data skimming leads to revenue loss for premium publishers, November 2010.
- Ovum. Ovum predicts turbulence for the Internet economy, as more than two thirds of consumers say ’no’ to Internet tracking, February 2013.