Technology

The advertising industry’s anticipated shift away from third-party cookies led to the proliferation and normalisation of first-party identification architectures online. Marketed as ‘privacy-friendly,’ the new technologies promise to deliver the efficiencies that advertisers have become accustomed to, while addressing privacy concerns from third-party cookies. Such tension calls for a better understanding of the privacy implications from first-party online identification architectures. We evaluate first-party user identification mechanisms by (1) surveying the literature to create a typology that synthesises existing privacy concerns in third-party cookie-based identification, and (2) applying our typology to evaluate the privacy of prime examples in what we frame as three distinct types of first-party ID architectures — Universal IDs, Onboarding ID, and Walled Garden ID. We analyse technical documentation and code repositories from each architecture type and show how first-party ID solutions still enable cross-site tracking over longer periods of time and encourage sensitive user targeting. First-party ID solutions do create mechanisms to ease opting out from tracking, but the implementation of those mechanisms is questionable. Our findings demonstrate how the advertising industry is trying to maintain its existing structure and replicate the tracking functionalities on which it has grown reliant.