Marketing Without Cookies: How to Prepare Your Analytics for a World Without Them

The combined pressures of large advertising platforms like Google and Facebook and legal mandates have led to technical limitations poised to dramatically transform the digital marketing landscape.

These changes will shorten browser cookies' lifespan and curtail advertising systems' capacity to gather data at the user level. In 2023, digital marketers will be unable to capture a large portion of the data they currently rely on to gauge the effectiveness of their advertising channels.

Due to inaccuracies in data, marketers are misallocating about 21% of their budgets. This inefficiency is expected to increase even further as cookies are phased out. In 2024, your company's marketing team will need to shift to a new analytics framework to adapt to the global changes resulting from the phasing out of cookies. This article will discuss how these changes will affect your marketing strategies' efficiency and your analysts' operations.

Note: This post was written in 2022 and has been completely revised based on the recent updates in May 2024.

"Cookieless advertising" refers to a shift in digital advertising practices away from relying heavily on third-party cookies. The term implies a total elimination of cookies, but it does not mean all cookies are removed. Instead, marketing firms, especially in areas like Singapore, along with web browsers like Google Chrome and Safari, may continue to track cookies, but this depends on user consent. Consequently, users gain more control over their online data privacy. This transition is part of the broader response to the phase-out of third-party cookies, a significant challenge for digital media in the U.S.

Cookie-less ads: a silent earthquake? After Google announced a depredation of cookies on Chrome, it soon became a local news story. Industry newspapers coined a new, frightening term: Cookiepocalypse. All other webinar sessions and conferences were on the topic, although the consequences were unclear. Google delayed it a couple of times. The decision was partly influenced by privacy concerns and the feedback received from the industry regarding Privacy Sandbox solutions, partly through the antitrust scrutiny.

Cookieless advertising does not rely on third-party cookies to track users across websites. Instead, it utilizes methods like context-based targeting, where ads are aligned with the content of the website being viewed, and first-party data, which is collected directly from user interactions on a company's platforms. New technologies such as device fingerprinting and privacy-compliant universal IDs are also being explored to maintain ad relevance and effectiveness in a privacy-focused digital landscape.

Data from third parties was precious for digital advertisers, as it provided insights into user behavior beyond what they could gather from their data alone. With this in-depth information, advertisers could create retargeting lists that would be used to display ads on their websites or to individuals at similar companies. Initially, cookies were used in marketing for precise targeting, enhanced by introducing frequency caps. Before adopting real-time bidding (RTB) exchanges, digital marketing strategies offered limited scale and efficiency.

While first-party data is generally benign and straightforward (akin to the "chocolate chip" in data flavors), third-party cookies are a different story, sparking significant controversy and driving the shift towards a cookieless future. Primarily, third-party cookies are often set without explicit consent from users. As you navigate different websites, ads from these sites can place third-party cookies on your computer, enabling advertisers to track your online movements.

Third-party cookies are sophisticated ways of tracking your online activity. At their best, they leverage this tracking ability to create personalized experiences, typically targeted ads, across various websites you visit. This process involves the user receiving a third-party cookie, which influences the ads shown on other sites.

Cookies are being phased out primarily due to concerns about privacy and security. This transition is seen as beneficial for digital advertising in the long term, as it aims to build consumer trust and create less invasive marketing practices.

Here's a deeper look at the critical factors driving toward a cookieless future in advertising:

• Privacy Concerns: Third-party cookies often track users without explicit consent, leading to privacy issues. Even with regulations like GDPR, involuntary compliance persists, as users frequently accept cookies without full awareness. The detailed user profiles that cookies help build can be overly invasive, raising significant privacy issues.
• Security Risks: Cookies are vulnerable to security threats such as Cross-Site Request Forgery (CSRF), where they execute unauthorized commands, and Cross-Site Scripting (XSS), which involves stealing sensitive cookie data via malicious scripts. Other risks include Session Fixation, Cookie Tossing, and Cookie Capturing, where cookies are misused to hijack sessions or intercept data.
• Ad Fraud (Affiliate Fraud): Cookies can be exploited for ad fraud through cookie stuffing, where fraudulent affiliates generate illegitimate sales.
• Cost Savings: Monitoring and mitigating the risks associated with cookies incur significant costs. Eliminating cookies could reduce these expenses and simplify security management.

The move towards a cookieless future is about enhancing online privacy and security and reducing costs and potential fraud associated with cookie usage.

What exactly is changing:

• Browsers have started limiting the lifetime of cookies or completely refusing to use them.
  • Firefox already blocks cookie tracking by default.
  • Google plans to abandon third-party cookies in the Chrome browser by the end of 2023.
  • In Safari, the lifetime of third-party cookies has been reduced to seven days and, sometimes, to one day.

This means that the retargeting possibilities for third-party websites will be limited to one day. If a user doesn’t interact with the website during the day, the cookie will be deleted, and on the next visit, the website will identify a new user. Because of this, it will be difficult to identify users and correctly determine their source of transition.

• Advertising services will limit the ability to track campaigns at the user level. Worldwide, there is growing concern about the constant collection of personal data, so advertising services will show aggregated data in campaigns to protect users. This will significantly complicate cohort analysis and data audit.
• Platforms and browsers will limit user-level tracking. For example, iOS already blocks IDFA, an analog of cookies for users of Apple devices. By default, IDFA is disabled for mobile applications. Without this ID, actions that an application sends aren’t associated with a specific device. Restrictions regarding the User Agent in the Chrome browser that will make it impossible to use most fingerprint techniques are also actively being discussed.

These changes have significant implications for collecting and utilizing consumer data, presenting challenges in targeting and personalizing relevant advertising, while emphasizing the importance of respecting consumer privacy regulations.

These changes are happening for three main reasons:

1. Business interests of market players. As the market consolidates and competition increases, big players (Apple, Google, Facebook) are making these changes to defend their interests.
2. Compliance with user data protection requirements (GDPR, CCPA).
3. Technical limitations. Some platforms and tools are changing precisely because the technical capabilities for applying data or working with advertising campaigns are changing.

In advertising campaigns:

1. The cost of attracting a client will increase as advertising strategies face new challenges in planning and execution. Advertising services will need more information to target an advertisement to a suitable user. The less ability an advertising service has to determine that an offer is in a particular user's interests, the less relevant its offers will be. This means that CTR will decrease and CPA will increase.
2. Coverage of lookalike and retargeting campaigns will decrease (assuming these campaigns remain). Retargeting will work only for as long as a third-party cookie lives. After receiving third-party cookies, if the user goes to another website, such as Google, the life of the third-party cookies will be extended. This means retargeting, for example, in Google or any other walled garden, can take longer than retargeting within a hypothetical Criteo. Because Criteo has less website coverage, the inaccessibility of information at the user level will prevent you from using lookalike audiences.
3. This will lead to small advertisers leaving the market. It will be difficult for small players to prove their value with associated conversions. Relying on third-party data to target prospective consumers is becoming increasingly challenging due to regulatory scrutiny and the phase-out of third-party cookies, urging a shift towards alternative data sources for personalization and targeting.

Advertising companies could shift from cookie-driven advertising to one that is cookieless to be able to scalability in a cookieless market in the coming years.

You can collect first-party data in your app, web page, or website. This is information the user provides you. Utilizing a Customer Data Platform (CDP) can be pivotal in effectively centralizing and leveraging this first-party customer data.

The advertising service collects second-party data without third-party cookies, such as data from advertising accounts.

1. First, you must implement a marketing data lake such as Google BigQuery, AWS Redshift, HP Vertica, or Hadoop. To do this, you need to collect data somewhere, and it must also be controlled by you, not by an advertising service. As long as your campaigns and user activity are stored in different systems, especially those that don’t belong to you (advertising account, Google Sheets, CRM), a comprehensive analysis of your advertising campaigns isn’t possible.
2. Collect raw user activity data from your website and mobile app. Raw data means that each user activity is registered and saved. This isn’t aggregated data on the number of visits, for example. There should be no metric as a required parameter. Each interaction is a separate hit. The value of raw data is that it isn’t aggregated and, therefore, is accurate. In addition, ad blockers and browsers don’t limit the collection of raw data. Utilizing data clean rooms can further enhance the security and analysis of this data without compromising customer identities.
3. Import the most granular data from advertising accounts into your data lake. Many accounts are limited to UTM tags for tracking transitions from advertising accounts. But this isn’t enough to build an analysis without connecting data to a specific user. For example, Facebook Ads allows you to upload up to 200 fields. You can build reports of the depth you need using raw data with any parameters. For example, with geodata, you can analyze the effectiveness of your advertising campaigns in different regions. In addition, you can use accumulated data for machine learning and forecasting the best marketing mix. Granular data from advertising services is required to perform calculations.
4. Motivate users to log in to the website and mobile app. This significantly underestimated activity allows the advertiser to collect and leverage their own first-party data in the context of a particular user without IDFA and cookies. In a separate article, we’ve collected more than ten ways to increase the share of identified users. We recommend you check whether you use all the methods in your business.

There are seven possible ways a company can avoid dependence on third-party cookies. Adding to this is the imperative to acquire coherent consumer data. These steps involve providing comprehensive data access by utilizing Customer Data Platforms (CDP) for actionability in alignment with using other cookieless advertising solutions.

The tool and service help organizations coordinate user IDs across multiple platforms. The customer data platform (CDP) allows companies to create personalized messages from customers based on their unique data and insights. Further, data clean rooms, ad campaigns such as Privacy Sandboxes, and other new customer acquisition technologies highlight the importance of robust ID management and the practical usage of first-tier data within these solutions, which makes it crucial to ongoing customer acquisition in the cookie world.

The Privacy Sandbox Initiative includes several technologies to improve online users' privacy, like Google Privacy APIs and Google FLEDGE. This solution for cookieless advertising will prevent third parties from using a cookie and help users track and analyze a website's content. Google wants to keep its ad budget consistent, but must address advertisers' concerns. The solutions use brand-specific anonymized data input from Google Clean Room (Google PAIRS) and use that data to retarget users using the Protected Audience API.

As potential behavioral targeting of advertisements seems set in the most optimal scenario for a severe cut in cookies, PPC advertising is a possible win for the short term. The focus is on delivering ads relevant to users that they can find by looking at the contents of an online website. Paid advertising has its advantages as a whole. It leverages unbiased information to understand a person and their needs, then analyzes the information to help you target your customers in a targeted way.

Data clean rooms are places where advertisers share aggregate, not customer data, with Google. However, the company remains strictly controlled. Advertising companies with first-party data can enjoy the clean room because they are transparent in matching data with other sources.

The partnership consists of two companies that use customer information to enhance advertising. These may also become increasingly popular in advertising over a short period when both parties establish a contractual agreement based on expected benefits for the parties and the required opting-in processes are set up by both parties. Airline and travel companies are particularly well acquainted with such partnerships, which allow you to request taxi service, car rental, or additional ancillary upsell offers based upon the contract partners agreed to.

The User Identity Diagram is designed to merge personally identifiable information (PII) with non-PII data within a single database. This integration is achieved through probabilistic and deterministic matching techniques, enabling data consolidation from multiple sources into a singular customer profile. It combines information on your customer journey with details on your app and website from different points of your website. Those data are also used in advertising campaigns such as programmatic advertising.

Implementing ad networks with retargeted and targeted audience data is best for future-proofing your marketing in an increasingly cookie-less environment. However, most advertising firms rely on data from first-party advertisers to target their ads effectively. Many data providers use cookies to identify their users on the partnered site. Using this data, advertisers can generate detailed profiles for their audience - understanding their interest behaviors and populations. Several advertising programs utilize these profiles to target specific audiences.

Considering all the data and upcoming changes, we’ve developed a solution to help companies smoothly switch to a new analytics format without losses.

With OWOX, you will receive:

1. A clear plan for preparing for the post-cookie world that is developed for your specific project.
2. The ability to use first-party cookies with a long lifespan through OWOX BI server-side tracking to identify users. This will significantly reduce the percentage of direct/no traffic.

The main reason for the inability to determine sources of user sessions (direct/none) is the absence of a stable user ID.

The primary identifier for an unauthorized user is currently Client ID. It’s set by Google Analytics JavaScript code in the user’s browser and stored in a cookie. This cookie is treated as a third-party cookie and is subject to browser restrictions, including Safari.

The result of ITP in Safari is a reduction in the lifetime of data privacy for a cookie with a Client ID to no more than seven days and, in some cases, only one day.

How do we solve this problem? Make cookies perfect for browsers.

Here’s what this means in technical terms:

• Set cookies not with a JavaScript code but with a server
• Assign cookies with httplOnly, Secure, and SameSite parameters
• Install cookies on behalf of the domain of the same site (via A-DNS records)

OWOX writes its unique user identifier to the owoxUserId cookie, allowing you to determine transition sources correctly. Our experiments have shown that collecting data in the first-party context results in a 2.1 times increase in the number of tracked returned users to Safari Mobile, and a 9.6 times increase in the number of tracked returned users to Safari.

1. Comply with personal data protection requirements (GDPR, ePrivacy).
2. Configure a GA/GBQ proxy to resolve data loss problems due to AdBlock.
3. Regularly collect and enrich raw hits in the usual session format. For analysts, it’s easier to work with data this way, and as a result, users get more opportunities to derive value from the collected data.
4. Model business-ready data for use in marketing and product reporting.

In addition, the OWOX team can help you set up Google Analytics 4 to collect complete, high-quality data both there and in Google BigQuery.

What the OWOX team will do for you as part of this solution:

1. Audit your Google Analytics and Google Tag Manager accounts and compile a personalized roadmap of changes to switch to post-cookie tracking.
2. Set up data collection in Google Analytics and Google BigQuery.
3. Transfer all web/app data you collect into Google Analytics 4.
4. Set up OWOX BI server-side tracking, which collects first-party data and combines it with marketing data in your repository.
5. Configure Consent Mode for correct and secure first-party data collection.
6. Set up cross-device profile generation and ready-to-use (business-ready) data.

We are transitioning from traditional data management platforms to innovative analytics solutions, which enables companies like OWOX to signify a pivotal shift towards more sustainable and privacy-compliant data practices. These solutions offer businesses enhanced data accuracy and user tracking capabilities in a cookieless future.

Familiar ways of working with marketing data are gradually changing, with programmatic and paid ads becoming critical focus areas in adapting strategies. Personalization of advertising, retargeting, and so on is becoming more difficult due to public outrage about privacy violations and the resulting laws and rules.

Integrating zero-party and own first-party data is crucial in enhancing customer data repositories for better targeting. Influential companies have already begun to change the way personal data is used, and this situation can no longer be ignored. Businesses should prepare their marketing and analytics for a post-cookie reality and new conditions for working with personal data, shifting towards privacy-friendly methods like targeted ads.

You should prepare for a cookieless future before you lose access to some of your data. You can evaluate campaigns in a changing environment by calibrating your analytics and metrics systems. The fading of third-party data audiences presents challenges and opportunities, highlighting the evolving role of third-party data providers in this new landscape.