How does targeted advertising work?

These third-party cookies can use information about our preferences and habits on one website to influence what we see on another.

While some browsers have phased out third-party cookies, Google is still working on how to do this and still protect competition and privacy.

At the same time, the UK Government is looking at ways of changing cookies to an opt-out rather than an opt-in.

Credit: BestForBest/Shutterstock.com

What are cookies?

Targeted ads are able to follow us around the internet thanks to small files called cookies and similar technologies.

These are small text files that are downloaded on to our devices (computer, phone, tablet) when we access a website and they help the website recognise our device, making online activities like browsing and shopping easier.

Cookies are also used for advertising purposes, so when it seems as though ads are being tailored to our likes, that's thanks to the cookies we've downloaded.

Before we go any further, let's take a quick look at the two main types of cookies we need to be aware of.

These different types of cookies (first-party and third-party) can co-exist on the same website.

This means that websites only share certain information with advertising trackers and they don't get access to the private information we might put into a site.

First-party cookies

Websites use first-party cookies to keep track of user data to make using the website easier.

These cookies are created and used on a single website. They aren't tracking cookies in the same way that third-party cookies are.

Some first-party cookies only last for the length of a user's session while others usually last until we clear our browser history.

First-party cookies remember things like:

• Items in our shopping cart
• Usernames and passwords
• Language preferences
• Other preferences and settings

In short, first-party cookies help websites run effectively and they don't track users from one website to another.

Third-party cookies

Third-party cookies are placed on sites by a third-party (hence the name) and are shared across other websites.

These cookies are used for advertising and behavioural targeting, meaning that third parties can serve us adverts that are relevant to our interests and that we're more likely to click on.

While third-party cookies have been around for a while, they are on the decline thanks to the decision by major browsers to phase them out - more on this below.

Example of cookie usage

To demonstrate how cookies work in the real world, let's look more closely at how ITV explain their cookie policy on their website.

They separate their cookies into three categories:

1. Essential
2. Performance and functionality cookies
3. Targeting cookies for ITV promotions

ITV also use some third-party applications as we explore below.

Essential cookies on the ITV website are required to collect information they need for the platforms to function and comply with regulations.

These essential cookies:

• Make sure that users logged into ITV Hub stay logged in, so they don't have to sign in every time
• They keep users secure while making payments
• They track the content users have watched to ensure they can pay companies who have licenced rights to their content
• Tell ITV which adverts customers have seen so they don't repeat the same ones over and over again

Meanwhile, ITV's performance and functionality cookies are used to make their platforms user-friendly and understand how users are moving around the sites.

ITV give some examples of how these cookies work:

• Track how many people visit their platforms
• Look at whether people have trouble finding a specific section of a platform to help them adjust accordingly
• Asking for feedback via surveys to test new functionality

So, essential and performance cookies are not used by ITV to show personalised ads. These are delivered via the third set of cookies: targeting cookies for ITV promotions.

ITV say these targeting cookies are used in some of their marketing campaigns and use unique identifiers to track the ads a user has seen or clicked on. These cookies also collect information such as the operating system a user has, their browser and their IP address.

This data is used by ITV to:

• Create reports and measure the efficiency of ad campaigns
• Build audience segments based on all visitors' actions on their sites
• Identify which audience segment a user falls into, enabling ITV to show more relevant ads about their products and services

These cookies are controlled by ITV, yet they also use third-party applications to deliver ads from other companies that they don't control.

ITV link out to the cookie policies of these third parties and all the relevant information is found on the external websites.

Yet it's a step removed from ITV and means that an external application has access to some of our browsing data.

If this application then has cookies on another site, it can help determine what ads to show us on that website that will be relevant.

Are cookies a good thing?

First-party cookies are usually seen as a good thing by many website users.

They ensure we don't have to keep inputting the same information and ensure that, for example, when we look at items on a shopping site, they often stay in a list that shows they were recently looked at.

However, third-party cookies are generally more contentious because of their tracking features.

There are two opposing arguments when it comes to these cookies:

• Some people see them as convenient method of enhancing the online experience
• Some people say they invade people's privacy because they share information about a customer's likes and interests

Critics have argued that advertisers have taken things too far and were pushing inappropriate and excessive ads on customers. It's also said they allow advertisers to collect too much information about us.

The contrasting view is that targeted ads are more relevant to customers than untargeted ones.

Websites are always going to sell space to advertisers, and it's suggested that it's better to have ads that are relevant to users than random untargeted ads.

For example, a young woman who is interested in fashion might be better served by ads showing dresses rather than toolboxes.

Third-party cookies enable more relevant adverts to be served to customers, yet many browsers have decided to block them.

Browsers and cookies

It was announced by Google in 2020 that they were planning to phase out the use of third-party cookies on their Chrome browser.

This put them in line with major browser rivals such as Microsoft (Edge), Apple (Safari) and Mozilla (Firefox).

Google's decision was in response to calls for greater privacy controls amid concerns that companies were flouting rules on cookies and using dubious site design methods to hide consent options such as:

• Pre-ticked boxes (people opting out rather than opting in)
• Placing opt-out options on later pages
• Requiring multiple clicks
• Tracking users before they consent and after they reject

So, Google were set to phase out cookies by 2022, although this has since been pushed back to 2023 while Google get their newly designed system in order.

This is the important point: targeted ads aren't going away, but the tracking used to deliver them is going to change slightly.

Their proposals attracted the attention of the Competition and Markets Authority (CMA), who are currently keeping a close eye on Google's replacement plans.

They extracted the following commitments from Google as they work on their cookie removal plans:

• Google will involve the CMA and the Information Commissioner's Office (ICO) in developing their proposals to check they protect both competition and privacy
• Google will be more transparent in their development process than initially planned
• Google will restrict sharing of data within its ecosystem to ensure it doesn't gain an unfair advantage over competitors when third-party cookies are removed
• Google will not remove third-party cookies until the CMA is satisfied that their concerns about competition have been addressed

This last point is the one to pay attention to for now. It means that Google won't be removing third-party cookies until the CMA is happy with their new processes.

While the CMA is focusing on the competition element of the issue (because that's their major remit), concerns about privacy are also at the heart of it, with the CMA saying they will safeguard users' privacy.

For customers, this means that third-party cookies aren't going away on Google Chrome yet, so it's important to be aware of the implications we've discussed above.

What is the UK policy on ad tracking?

Cookie consent banners have become commonplace on the internet thanks to the implementation of rules by the European Union that the UK took forward when we left the EU.

It means websites must ask for explicit consent rather than leaving it to the user to opt-out of cookies.

According to the ICO, websites must:

• Tell users the cookies are on the site
• Explain what the cookies are doing and why
• Get explicit consent to store a cookie on a user's device

We usually see this in the form of a pop-up on a website the first time we visit. These pop-ups and banners have become so commonplace that many people are accepting cookies without understanding what they mean and what they're giving permission to.

Under the rules, it must be straightforward for a user to understand what they're agreeing to and opt-out if they want to.

As we've discussed above, that doesn't always happen, and some websites are hiding how they use our information in plain sight by having lengthy explanations about their cookie use which few people bother to read.

Future of cookies in the UK

The UK Government wants to change how cookies work in the UK as part of the wide-ranging Data Reform Bill.

The aim is to cut down on the number of pop-ups and banners users see by moving towards an opt-out model.

While the Government say this will result in people seeing fewer "frustrating boxes online", privacy campaigners have reacted badly to the proposals, and there will be battles as the bill makes its way through Parliament.

Watch this space to see whether cookie consents in the UK will change and how users will be able to opt out.

Can you stop ad tracking?

The consent banners we currently see on websites give us the option to opt-out of cookies.

There are often tiers of cookies, with websites warning that essential cookies are required to ensure a site can operate correctly (first-party cookies).

Even though these cookies are not usually able to be disabled on the website itself, users can update their browser settings to disable them.

However, websites often warn:

• Sites may not work effectively or as expected
• Some features may not work at all

So, users should think carefully about disabling these cookies and, if things aren't working as expected, update their preferences to see if that makes a difference,

As for other cookies, these may be referred to as:

• Analytical cookies
• Targeting cookies
• Ad cookies
• Personalisation cookies

These may be provided by the site owner themselves or be provided by third parties.

Websites will give us the option to opt-out of those cookies or, again, we can update our browser settings to specifically disable third-party cookies.

However, it's worth remembering that many websites use third-party cookies in a responsible way to enhance the customer experience.

We can periodically remove cookies - starting afresh with a blank slate - and this may be a better option for users who want to clear their history with websites but still want the functionality of cookies to help them navigate the website.

Summary: Understand the differences

Thanks to the current rules on cookie consent, we're all familiar with the pop-ups and banners that are visible every time we visit a website.

If the UK Government gets their way, these opt-in cookies will soon become opt-out cookies but, for now, we will continue to see banners encouraging us to give permission to use our data.

To summarise, here are a few things to remember about cookies:

• First-party cookies are placed on websites by site owners. These are used to help websites function properly and do not contribute to ad tracking.
• Third-party cookies are placed on websites by external parties. These help to gather information about users to better personalise their experiences online and provide ads.
• Several browsers have phased out third-party cookies and Google is in the process of doing so. However, this means replacing the cookies with a profiling system that will still deliver targeted ads.

The debate over cookies has reignited thanks to the Data Reform Bill and looks set to dominate the headlines for a while yet. It remains to be seen what changes will be made to cookies and what Google's final replacement will look like.