Third-Party Cookies Fund 70% of Marketing Revenue

▶ Watch (1:59)

Marketing runs on data. First-party cookies come from the site you visit. Third-party cookies come from elsewhere and get ingested by whatever site you land on. The firms running those third-party analytics pipelines generate about 70% of their revenue from those secondary services. When Google announced it would eliminate third-party cookies, most of the business model for digital marketing disappeared on paper. That’s why the industry panicked, and why the workarounds came fast.

Google’s Privacy Sandbox Was a Monopoly Grab

▶ Watch (3:23)

Google named its cookie-replacement initiative “Privacy Sandbox” and pushed Google Analytics 4 alongside it. Privacy advocates called it monopolization: kill everyone else’s third-party cookies while positioning Google’s first-party data as the only option. Marketing firms used the word monopolist at ad conferences. Google responded with ads in industry magazines calling marketing firms selfish and anti-privacy. Then came delay after delay: January 2020 pushed to December 2020, then June 2021, every six months, until January 2024 when Google reversed course entirely and declared third-party cookies fine.

Server-to-Server APIs Renamed the Data Transfer to Dodge GDPR

▶ Watch (5:38)

Marketing firms built server-to-server (S2S): direct API links from client websites into marketing analytics engines. A retailer plugs its backend straight into its marketing partner, bypassing cookies entirely. The firms called these arrangements “first-party partnerships,” exempting them from GDPR’s third-party data transfer rules. Built in under a year with minimal security, S2S now includes Google itself: reCAPTCHA is Google-owned, and Google has begun piloting S2S integrations that let any reCAPTCHA-using site transmit visitor behavior data to marketing firms.

SSID Tracking Builds Social Network Maps for Nation-State Targeting

▶ Watch (8:41)

S2S data includes device fingerprints and SSID histories. Every Wi-Fi network a phone joins gets logged. A device that shares a home SSID with another likely belongs to the same household. Daily 9-to-5 SSID overlap means co-workers. A monthly bowling alley SSID maps a social circle. Marketing firms use this to build relationship graphs and target ads across them. Russia budgeted $14.9 billion on advertising last year, with $1.88 billion domestic, the rest abroad. Nation-state actors use the same cookie analytics to test which phrases spread fastest.

GDPR Works, and Individual Defenses Help

▶ Watch (16:42)

GDPR forced marketing firms to spend billions building S2S just to keep doing what they were already doing. That’s proof the law has teeth. The gap is enforcement and language: one software company 4dw@r3 reviewed defined “legitimate interests” as “the legitimate interests of my business to continue generating revenue.” For individuals: multi-account containers segment browser sessions so sites can’t cross-correlate. VPNs anonymize SSID and geolocation. Brave is not recommended; its first backer is Peter Thiel, founder of Palantir.

Notable Quotes

Marketing firms using S2S are not very aware of everything that they’re doing. 4dw@r3 · ▶ 7:51

they defined legitimate interests as the legitimate interests of my business to continue generating revenue. as such we are exempt. 4dw@r3 · ▶ 18:10

The first backer of Brave is Peter Theal. If the founder of Palunteer is funding your browser, that does not sound very private to me. 4dw@r3 · ▶ 20:22

Key Takeaways

  • S2S APIs reframe third-party data transfers as “first-party partnerships,” bypassing GDPR third-party transfer rules entirely.
  • SSID tracking maps social relationships by logging shared Wi-Fi networks, letting firms target people through their associates.
  • Russia’s $14.9 billion 2024 ad budget, mostly spent abroad, exploits the same marketing infrastructure built for commercial targeting.

About the Speaker(s)

4dw@r3 (they/them) is a security and risk management expert focused on complex environments and building strategic security roadmaps. They run Burps, a no-dues monthly meetup with seven chapters across the Chicagoland area, plus locations in Galway and Las Vegas, with 1,300 members in Discord. Outside security, they backpack with their Australian Shepherd and twins.