FLoC, Cohorts, and the Cookie Endgame: Watch From Solid Ground

Google published a statement this month that deserves to be read as the landmark it is, separately from the controversy it launched. When third-party cookies leave Chrome, on the two-year horizon announced last January, still running, Google will not build or use other IDs that track people across the web. Not fingerprinting. Not email-based identity graphs. Not a cookie replacement under a new name. No individual-level cross-site identifiers, full stop, in the browser that carries most of the web’s traffic.

That sentence, from the company whose advertising business defined the cookie era, is the confirmation our privacy coverage has been tracking toward since 2017.

The controversy arrived with the other half of the announcement. Google’s proposed replacement is FLoC, Federated Learning of Cohorts. It sorts browsers into interest groups computed on the device. Sites and advertisers see only the group ID. It entered origin trials this month. It promptly drew a takedown from the Electronic Frontier Foundation, ‘a terrible idea,’ with fingerprint and sensitive-topic worries listed. Also no votes from the other browser makers, refusals from major sites, and a WordPress-community debate about blocking it at the platform layer. The post-cookie architecture war is now fully public and fully unresolved. Our advice for everyone who is not an adtech vendor is in the title: the specifics are a spectator sport. Watch from solid ground, which this post will once again locate precisely.

Reading the war correctly: direction versus mechanism

One split keeps this month useful. The direction is confirmed. The mechanism is contested. They carry entirely different planning weight.

The direction is that cross-site tracking of individuals is ending, by browser-maker decree. It is now unanimous across the rendering engines. Safari ended it years ago. Firefox followed. Chrome, the holdout whose owner had the revenue conflict, has now committed in writing, with the no-alternate-identifiers statement closing the workaround loopholes in advance. That is a settled planning input, as settled as the mobile trendline was in 2014. Every measurement and marketing setup this readership runs should already assume it.

The mechanism, what if anything replaces the targeting and measurement the cookie enabled, is where the war is. The war’s opening month has already shown why betting strategy on any single proposal is speculation. FLoC’s reception suggests the current proposal may not survive contact in its current form. The Privacy Sandbox contains a half-dozen sibling proposals in various stages. The regulators, already circling the cookie phase-out on competition grounds, hold veto-shaped cards. The whole apparatus has years of politics left.

Teams that rebuilt their stacks around FLoC this month would be rebuilding again. Teams that bet on cookie-era workarounds are betting against the unanimous direction. The correct stance toward the mechanism is watchful neutrality, which costs nothing, because the correct setup doesn’t depend on the winner.

The solid ground, surveyed once more

• Consented first-party relationships: the email list, the account relationship, and the preference center. Data given knowingly, held on your systems, run through your privacy plumbing, and untouched by any browser’s cookie policy. Every privacy shift since 2017 has raised these assets’ value. Nothing in any sandbox proposal lowers it.

• First-party measurement: analytics on your own domain, scoped to consent, filled in by models where gaps grow. The conversions your own systems record against your own goals remain the ground truth no phase-out touches.

• Contextual relevance: advertising and content placed by what the page is about rather than who the visitor is. The pre-cookie logic, returning with modern tooling, and the tier of the ecosystem this audience can use without touching the war at all.

• Owned channels over rented reach: the long-standing advice. The audiences you can reach without a middleman’s ID are the ones you actually have.

The practical calendar, modest by design

What does this month add to a well-placed team’s to-do list? Little, which is the point of being well placed. The census item: know whether your site’s advertising and measurement stack has cookie-era dependencies. The retargeting pools, the view-through attribution, the audience-matching flows. Price their decay into next year’s planning rather than this quarter’s panic.

The vendor item: every martech renewal between now and the phase-out should include one question. What is your post-cookie plan, and which sandbox outcomes does it lean on? Vagueness gets priced accordingly.

The FLoC item, for completeness: sites can opt their visitors out of group scoring with a header if policy prefers. Several platforms are debating defaults now. The call is a privacy-stance question your counsel and comms teams should make on purpose rather than inherit. And the housekeeping item: annotate. Watch the trial news monthly rather than daily. Skip the vendor webinars selling certainty about a plan whose own author cannot guarantee it. The war will run for years. Your quarter should not be spent on it.

The hedge that became consensus

When ITP arrived on one front and GDPR on the other in 2017, our advice to build on first-party ground was a hedge against a direction we considered likely. Four years on, the direction is unanimous among browser makers. It is written into law on two continents. It has now been formally adopted by the player with the most to lose.

The hedge has become the consensus architecture. The assets we said would appreciate have, visibly. The dependencies it said would decay are decaying on schedule, with the phase-out date supplying the final invoice.

The remaining unknown, the mechanism war above, is real but no longer strategic for this readership. Whichever acronym wins the sandbox politics, the winning setup for institutions was settled before the war began. It is the one you can build entirely on land you own. Build there. Watch the war from the porch, with annotations current. We will report the armistice whenever it arrives.