Publishers Question Related Website Sets, Google's Privacy Sandbox Solution for Cross-Site Tracking

The proposal lets websites use cookies among related domains, and it's drawing controversy

While most Privacy Sandbox solutions are designed to help the internet ecosystem still operate on Chrome once the Google browser deprecates third-party cookies this year, some proposals aim to maintain the status quo.

One such solution, Related Website Sets, is not so much about creating alternative ways to complete a function, but rather allowing cookies to continue to exist in limited contexts. And, like other Privacy Sandbox proposals, RWS is drawing controversy.

Websites use third-party cookies for a variety of functions besides creating a profile of audiences to sell to advertisers. For example, a brand or publisher might have multiple domain names where users expect to only log in once, such as a travel company with a flight and car booking website. Or, websites with different country domains might maintain functionality for their users across them. Or, there are publishers like Condé Nast, Gannett and News Corp., which own many domains and want to share information between those domains about users.

Publishers can only register five domains as part of a main use case of RWS, which several sources argued is too restrictive for publishers that operate multiple sites.

“Just because a business has 100 websites doesn’t mean” it’s violating privacy laws, said independent privacy consultant Zach Edwards. “It’s more important to not arbitrarily restrict a company.”

Others argue that RWS is too permissive because it still allows cross-site tracking, which cookie deprecation was meant to prevent.

RWS is designed for these scenarios where cross-site tracking is more about functionality than gleaning user behavior. It shows the uphill battle Privacy Sandbox faces toward wider adoption and the difficulty in threading the needle between maintaining existing processes and respecting privacy once cookies disappear.

The challenge of ensuring functionality for publishers

Chrome engineers designed RWS to minimize disrupting peoples’ browsing experiences while enhancing privacy on the web, a Google spokesperson said, noting that when browsers like Brave offered a strict fingerprinting protection mode for users, websites would function incorrectly or not at all.

Publishers use RWS to continue to track readers across websites they own, so that they can monetize their audiences effectively, even though Google maintains that RWS is not an advertising solution, unlike other Privacy Sandbox solutions like Topics API (application-programming interface), Protected Audiences API and the Attribution Reporting API.

In 2022, Google limited the number of domains a publisher can register as part of an associated RWS to three, addressing privacy concerns from governance body W3C (the World Wide Web Consortium) and regulatory watchdog the U.K.’s Competition and Markets Authority. In September 2023, Chrome raised the domain limit for RWS to five. Four sources say that this higher bar is still insufficient for publishers.

“Only through this being a publisher group is there a chance to compete with the platforms,” said one publishing ad-tech source, who spoke on the condition of anonymity.

Moreover, if brands can’t track users effectively between the various sites they own, publishers might not get proper credit for their advertising, said Amanda Martin, senior vice president of monetization and business strategy at publisher network Mediavine.

“Our concern is more on the brand side and how it allows them to track and attribute from ads,” she said. “The biggest risk associated with the deprecation for third-party cookies is measurement.”

Not restrictive enough

Others, however, think RWS plays too loose with user privacy.

“It encourages companies to buy additional sites that are not related to each other,” said a second publishing ad-tech source. A tennis website might buy a fashion domain with a completely different user base just to have more data to sell to advertisers.

Even publishers sharing user data among the sites they own can violate user privacy, especially because many readers might not know why two websites are related to each other, despite sharing a common owner.

“Either the user is empowered to determine their privacy choices or … a bunch of corporate identities get to make decisions,” the second publishing ad-tech source said.

Ultimately, there are better solutions for publishers trying to maintain targeted advertising across websites, said Don Marti, vp of ecosystem innovation at Raptive, who still believes Google’s domain limit is too restrictive.

“It’s not really a solution that’s going to be a long-term thing for co-owned media sites that want to have addressability,” Marti said.