4.06. Tomorrow, a World Without Cookies?

Disclaimer / Warnings: This sheet discusses the evolving practices of the web regarding advertising cookies and audience tracking, whose developments may progress faster than our page updates.

Cookies play a crucial role in internet tracking for digital marketing strategies. These small text files, stored on a user's device (computer, smartphone, tablet, etc.), collect and store various information about their online behaviors. There are two types: "first-party" cookies and third-party cookies.

First-party cookies, placed on the user's device by the website they are visiting, serve performance and service quality purposes: by retaining the user's browsing sessions, they enable faster loading of web pages on subsequent visits. These are called "technical first-party" cookies.

First-party cookies also have marketing purposes-and therefore require consent in this case: they allow the site owner to improve knowledge and advertising targeting of consumers or to keep a shopping cart on an e-commerce site to facilitate completing a purchase later.

Third-party cookies are placed by an advertiser or ad network different from the website visited. These cookies track a person's browsing activity across multiple websites. This information then enables advertisers to display targeted ads based on the user's interests and behavior.  

For several years, these cookies have been increasingly regulated and challenged due to their invasive nature, lack of transparency, and the excessive data collection they generate. In this context, the future of cookies is uncertain: after announcing their end for 2020, then mid-2024, Google has just postponed the removal of third-party cookies on its browser to 2025. The end of third-party cookies also aims to respond to growing pressure from European regulators on personal data protection, symbolized by the implementation of the GDPR in 2018.

The "cookieless" era thus represents a major and essential challenge for all stakeholders. The transition to solutions that are both marketing-effective and respectful of privacy is not without difficulty. This major change will affect how cultural institutions track and understand their audiences' online behaviors. So, what does a world without cookies concretely mean for theaters and cultural institutions?  

Cookies can be categorized by their functions as follows:

• Essential cookies are necessary for the proper functioning of the site, such as managing a shopping cart or identifying a user during an online ticket purchase. These do not require prior explicit consent.
• Functional cookies improve the user experience, for example by remembering language preferences or display settings.
• Audience measurement cookies are used to analyze site traffic (e.g., Google Analytics, Matomo). Since the implementation of the General Data Protection Regulation (GDPR) (see fiche 9 "What data protection regulations apply?"), these require explicit consent and the use of compliant solutions.
• Advertising cookies track user navigation to deliver targeted ads. They are currently at the center of privacy concerns and are subject to strict regulations.

These functional categories overlap with the more technical distinctions of first-party cookies and third-party cookies introduced earlier.

Information collected via third-party cookies creates a detailed user profile including preferences, purchasing habits, and interests. This explains why digital marketing currently relies heavily on cookie usage.

They are used for:

• Ad targeting: advertisers can deliver personalized ads based on user profiles.
• Retargeting: users may see ads for products they previously viewed on other sites (see fiche 27 "Understanding and investing in different forms of online advertising").
• Behavior analysis: marketing and communication teams can understand the customer journey and optimize their strategies.
• Personalization of the online experience: although rarely used by cultural organizations, websites can theoretically adapt content based on user preferences.

Intensive use of cookies raises privacy concerns, especially regarding third-party cookies. These tracking cookies are under significant regulatory scrutiny due to issues linked to user confidentiality:

• They collect detailed data on users' online behavior, allowing the creation of comprehensive digital profiles.
• This information can be shared with third parties without explicit user consent.
• There is growing user concern over the lack of transparency about the scope and use of data collection.

Consent modules often discourage or make it difficult to refuse third-party cookies through opaque designs (e.g., refusal options hidden, requiring deselecting hundreds of partners one-by-one, or blocking access without full acceptance).

Furthermore, the effectiveness of tracking cookies is also challenged:

• Despite measures to reduce refusals, cookies are frequently blocked or deleted by browsers, with rejection rates up to 64% on desktop and 75% on mobile.
• Cookies struggle to track users across multiple devices and apps, leading to inaccurate data and potential ad budget waste.

Google plays a major role in the move toward a cookieless web. With Chrome holding over 60% market share, its decisions strongly influence digital practices.

In 2020, Google launched its "Privacy Sandbox" initiative to replace third-party cookies with more privacy-respecting technologies. One solution, the Google Topics API, assigns interest-based themes to users (e.g., "live performance," "cinema") without identifying individuals. Advertisers can target these themes instead of specific profiles.

However, this transition away from third-party cookies remains slow, even for Google. The company has postponed the removal of third-party cookies on Chrome twice already due to balancing industry feedback, regulatory concerns, and developer challenges. Originally planned for 2024, the removal was delayed to early 2025 and is being implemented very gradually.  

With the announced disappearance of third-party cookies, several strategies are emerging to continue leveraging data:

• First-party data: collected directly by a website during user interactions (e.g., ticket reservations or newsletter subscriptions). These become a key lever for personalizing the relationship with the audience.
• Second-party data: data shared between trusted partners. For example, a theatre might collaborate with a festival to pool some anonymized information about their respective audiences.
• Third-party data: historically from third-party cookies, these will become increasingly difficult to obtain. Alternatives are emerging via platforms like Google Topics API or contextual data (analyzing the content viewed rather than past behavior). The use of DMPs (Data Management Platforms) is also worth exploring. (see link to CDP/DMP fact sheet)

The disappearance of third-party cookies entails significant changes for cultural organizations and calls for a profound shift toward "cookieless marketing" practices:

• Prioritize first-party data: Venues will need to strengthen direct data collection by encouraging audiences to create accounts, subscribe to newsletters, or participate in post-show surveys.
• Adopt alternative measurement tools: Solutions like Matomo, an open-source platform compliant with GDPR, offer alternatives to traditional tracking tools.
• Develop strategic partnerships: Sharing certain data with partner institutions can enrich audience insights while respecting confidentiality.
• Focus on contextual targeting: Targeting audiences based on the content they consult (e.g., promoting a dance show on a page dedicated to the same genre, or a family show on a page for young parents) becomes a key strategy.

In conclusion, although cookies currently lie at the heart of digital marketing strategies, we must already envision solutions to adapt to a future where their use is more limited. Especially since several browsers today offer "privacy-protecting" navigation by not storing cookies: DuckDuckGo, Startpage, Qwant, to name just a few.  

• [FR]  Cookies et autres traceurs : ce que dit la loi (external link), CNIL, octobre 2020
• [FR]  Questions fréquentes concernant l'arrêt des cookies tiers dans Chrome (external link), Google Help
• [EN] What is 0, 1st, 2nd and 3rd party data? (external link), Zuora
  
• [FR] #Cookieless - Comment repenser le rôle des DMP avec l’émergence des CDP ? (external link), Oracle, mai 2022
• [FR] De plus en plus de marques se lancent dans la 1st party data pour se libérer des grandes plateformes (external link), Nicolas Zunz, octobre 2021