W3C urges Chrome, other browsers to ditch third-party cookies

The W3C Technical Architecture Group (TAG) is calling for a web without third-party cookies. The International Standards Organization says cross-site tracking cookies are harmful and “must be removed from the web platform.”

The W3C (World Wide Web Consortium) released an “agreed finding,” a document reflecting the consensus of the TAG, that “third-party cookies must be removed.” These little pieces of code enable cross-site tracking and are considered an invasion of privacy.

Google has previously abandoned its plan to phase out third-party cookies in Chrome, or even ask users if they agree to them with a standalone prompt.

Other browsers, including Firefox and Safari, have already implemented restrictions and block most of these cookies by default, while privacy-focused browsers completely eliminate them.

“Unfortunately, not all browsers have followed suit. The TAG calls for all browsers to drop support for third-party cookies, as this provides an opportunity to further improve the privacy preserving features of the web platform,” the document says.

TAG editors hope that third-party cookies will be removed in future specifications. Yet, TAG editors acknowledge that the solution is not without complications and there are uses for third-party cookies that “need to be preserved.”

Why are third-party cookies harmful?

The body explains that cookies were originally designed as a way to recognize repeated visitors to websites, but since they have become a tool for logins, single sign-ons, tracking states, like shopping choices, targeted advertising, fraud detection, measurement, and attribution of ad clicks.

Web users are not aware of the increased data collection and sharing, which “results in decreased individual and collective privacy.”

Third-party cookies power key tracking networks, which have been identified as a major threat to privacy. These networks work like intermediaries and have a presence across many sites.

However, eliminating cookies will require other solutions, such as federated identity, authorizing access to cross-site resources, fraud mitigation, and others.

“Any proposal that acts as a general-purpose replacement for third-party cookies would need to be accompanied by evidence that it does not recreate the same issues,” the document reads.

“We support removing third-party cookies from the web platform, and we embrace the opportunity to improve the privacy features of the web. When we review new technologies to replace third-party cookies, we need to ensure that the replacements do not recreate the same pitfalls to privacy.”

The standard’s body also sees an urgency to set a strict timeline for the removal of third-party cookies.

Any new web platform technologies should avoid preserving “the status quo of harmful tracking and surveillance on the web.”