Ben Thompson: Google's Ad Announcement, The Privacy Sandbox, Google's Advantage (Stratechery Daily Update 3-4-2021)

Good morning,

Believe me, I didn’t want to spend another day on digital advertising either! It is as if Google is tracking what I write and then generating news in response (I’m sorry, that was a terrible joke).

On to the update:

Google’s Ad Announcement

From the Wall Street Journal:

Google plans to stop selling ads based on individuals’ browsing across multiple websites, a change that could hasten upheaval in the digital advertising industry.

There is a ton to unpack about this announcement, so I’m going to break it down old-school blogging style; all uncited quotes are from this same story.

The Alphabet Inc. company said Wednesday that it plans next year to stop using or investing in tracking technologies that uniquely identify web users as they move from site to site across the internet. The decision, coming from the world’s biggest digital advertising company, could help push the industry away from the use of such individualized tracking, which has come under increasing criticism from privacy advocates and faces scrutiny from regulators…

Before you understand anything about what Google announced, I would bet that many of you have the same reaction as Paul Graham.

You would be right!

Google’s heft means the change could reshape the digital ad business, where many companies rely on tracking individuals to target their ads, measure the ads’ effectiveness and stop fraud. Google accounted for 52% of last year’s global digital ad spending of $292 billion, according to Jounce Media, a digital ad consultancy…

In fact, not only does Google have a way to target ads nearly as effectively, its method only truly works at Google scale; that 52% number is probably going up.

The Privacy Sandbox

Continuing with the Wall Street Journal story:

Google had already announced last year that in 2022 it would remove the most widely used such tracking technology, called third-party cookies. But now the company is saying it won’t build alternative tracking technologies, or use those being developed by other entities, for its own ad buying tools to replace third-party cookies.

Cookies, at a fundamental level, are about cloud-based tracking. It is as if you have a name card such that you show up at a website, where they take down your information, and send it on up to a centralized server along with information about the site you are visiting, what you did on the site, etc.; every website collects the same name card and sends the same sort of information to the same centralized server. Let’s suppose this centralized server is called “Google”. This information is attached to your profile, along with whatever data points Google can collect on its own properties (which is a massive amount: everything from searches to Maps data to mobile app activity via its SDKs to Android and a whole lot more).

Google then turns around and sells inventory to advertisers, both on its own properties and also 3rd-party ones. Notice that I said inventory, and not data; advertisers don’t know you, what websites you visited, or anything else — in fact, they don’t care. The goal of an advertiser to achieve some sort of business goal, from app installs to e-commerce to brand awareness; the way it works is that an advertiser tells Google the goal it wishes to accomplish, how much it is willing to pay to accomplish that goal, and then Google harnesses its mountain of data to find the exact right users to advertise to. Incredibly enough, this happens in fractions of a second the moment you arrive on a website — your name card is also how Google knows which ads to show you.

Instead, Google says it will use new technologies it has been developing with others in what it calls a “privacy sandbox” to target ads without collecting information about individuals from multiple websites. One such technology analyzes users’ browsing habits on their devices, and allows advertisers to target aggregated groups of users with similar interests, or “cohorts,” rather than individual users. Google said in January that it plans to begin open testing of ad buying using that technology in the second quarter…

Google’s implementation of this “privacy sandbox” is called “Federated Learning of Cohorts” (FLoC), and is detailed on this GitHub page (it’s open source):

Browsers would need a way to form clusters that are both useful and private: Useful by collecting people with similar enough interests and producing labels suitable for machine learning, and private by forming large clusters that don’t reveal information that’s too personal, when the clusters are created, or when they are used. A FLoC cohort is a short name that is shared by a large number (thousands) of people, derived by the browser from its user’s browsing history. The browser updates the cohort over time as its user traverses the web…

The browser uses machine learning algorithms to develop a cohort based on the sites that an individual visits. The algorithms might be based on the URLs of the visited sites, on the content of those pages, or other factors. The central idea is that these input features to the algorithm, including the web history, are kept local on the browser and are not uploaded elsewhere — the browser only exposes the generated cohort. The browser ensures that cohorts are well distributed, so that each represents thousands of people.

Here is how this works:

Given its huge amounts of first-party data, Google has the ingredients to create the best machine learning training sets in the world. The company will use these training sets to create machine learning models that fit data to some arbitrary number of cohorts. The company says the cohorts will contain thousands of people.
Google will then place those machine learning models in Chrome and Android, both of which have overwhelming share.
Chrome and Android will keep track of every website you visit, run the resultant data through those machine learning models, mark you as being a part of one of those cohorts (you can’t be a part of multiple cohorts), and report your cohort to whatever website you visit.

In other words, whereas cookies were used for cloud-based tracking, cohorts will be used for browser-based tracking, and instead of matching ad inventory to your profile in the cloud, Google will match ad inventory to your profile in your browser (which never uploads your personal data).

From a privacy perspective, this is at first glance a great solution; Google no longer has all of your individualized data! As the EFF pointed out a year ago, though, there are important ways in which this approach is worse:

A flock name would essentially be a behavioral credit score: a tattoo on your digital forehead that gives a succinct summary of who you are, what you like, where you go, what you buy, and with whom you associate. The flock names will likely be inscrutable to users, but could reveal incredibly sensitive information to third parties. Trackers will be able to use that information however they want, including to augment their own behind-the-scenes profiles of users.

Google says that the browser can choose to leave “sensitive” data from browsing history out of the learning process. But, as the company itself acknowledges, different data is sensitive to different people; a one-size-fits-all approach to privacy will leave many users at risk. Additionally, many sites currently choose to respect their users’ privacy by refraining from working with third-party trackers. FLoC would rob these websites of such a choice.

Furthermore, flock names will be more meaningful to those who are already capable of observing activity around the web. Companies with access to large tracking networks will be able to draw their own conclusions about the ways that users from a certain flock tend to behave. Discriminatory advertisers will be able to identify and filter out flocks which represent vulnerable populations. Predatory lenders will learn which flocks are most prone to financial hardship.

FLoC is the opposite of privacy-preserving technology. Today, trackers follow you around the web, skulking in the digital shadows in order to guess at what kind of person you might be. In Google’s future, they will sit back, relax, and let your browser do the work for them.

This sure feels like winning a battle to lose the war; again, in contrast to the deceptive way in which online tracking is represented, no one actually cares or wants individual-level data — it’s only useful in the context of a data factory. Advertisers want to achieve business goals, and Google wants to make money, and if the best way to satisfy the privacy industry is to require users to carry around easier-to-understand-and-act-on group labels instead of relatively worthless name cards then so be it.

Google’s Advantage

This gets to the question of competition. To go back to the Wall Street Journal:

Some analysts said Google could stand to benefit from the end of cross-website tracking because it is less reliant on data from other companies. Instead, it collects a large amount of data directly from users of its services, such as YouTube or Google Search. Google says it will still use that data, called “first-party” data, when targeting ads to be shown on its own websites. Many large advertisers also have a lot of first-party data on their customers…

This is definitely true; Google’s owned-and-operated advertising won’t really be affected, which is great news for the company given that 84% of its revenue comes from its own properties — which, of course, will have the same access to the cohort data as anyone else, just in conjunction with huge amounts of first-party data. As I noted yesterday, first-party data is going to be a massive competitive advantage going forward.

Moreover, while other sites will be able to make best guesses at what different cohorts represent, Google will understand them much more precisely given that it will be its own machine learning models generating them, based on its own private data sets and big picture understanding of what is driving what type of business results for advertisers. Plus, Google will be doing this at far greater scale than anyone else, which means its data advantage will only compound.

Ultimately, what makes all of this work is the fact that Google owns the device where users browse the web, whether that be Chrome on PC/Mac/iOS, or Android. True, most iOS browsing happens via Safari, but Safari has already cut off 3rd-party cookies by default; Google’s position on iOS isn’t really much worse than it was previously (Apple meanwhile, is reportedly hiring aggressively to build out its own browser-and-device-based ad solution).

Meanwhile, everyone that doesn’t have a browser or an operating system is in much worse shape, particularly Facebook, which will get much less useful data from Chrome once the third-party cookie ban goes into effect (Facebook will of course come to understand the cohorts better than anyone outside of Google, but it already is a data factory so it definitely prefers individual-level data). Unfortunately for the social media giant, this is the state of the privacy debate: Google can own over half of the digital advertising market, cut its direct rival off at the knees, and receive widespread praise for having done so, even as users give out less personally identifiable information in exchange for being more easily profiled. Yay?

This Daily Update will be available as a podcast later today. To receive it in your podcast player, visit Stratechery.

The Daily Update is intended for a single recipient, but occasional forwarding is totally fine! If you would like to order multiple subscriptions for your team with a group discount (minimum 5), please contact me directly.

Thanks for being a supporter, and have a great day!