Google has made a significant shift in its privacy strategy, announcing that it will continue to support third-party cookies in Chrome, a decision influenced by feedback from the advertising industry. In a blog post, Anthony Chavez, Vice President of the Privacy Sandbox at Google, emphasized that Chrome users will still have the choice regarding cookies, marking a notable change from the company's earlier plans to eliminate them entirely.
Initially, Google aimed to enhance web privacy by phasing out third-party cookies. However, discussions with publishers, advertisers, developers, and regulators revealed that the industry was not yet prepared for such a drastic move. Concerns about balancing privacy with advertising revenue played a crucial role in Google's decision to adapt its strategy.
Despite this reversal, the Privacy Sandbox initiative, which was launched in 2019, will continue to evolve. This initiative aims to develop privacy-friendly alternatives to traditional online advertising, with APIs designed to meet new market demands. Google plans to release a revised roadmap that will clarify its future investment priorities and technological directions.
Alongside these changes, Google will enhance tracking protection in Chrome's Incognito mode. Starting in the third quarter of 2025, a new IP protection feature will be introduced, and AI-supported functionalities for threat detection and defense will be further developed. Chavez reiterated Google's commitment to creating a "sustainable, ad-financed internet" that adheres to high data protection standards.
In a related development, on March 10, 2025, Google announced that beginning April 10, 2025, the Google Tag within Tag Manager containers will be automatically loaded without requiring any user interaction. This change specifically affects containers containing Google Ads and Floodlight tags, while those with Google Analytics 4 will remain unaffected.
Previously, the Google Tag was only activated following a specific user action, such as clicking a link. This method helped mitigate potential oversights in tagging user interactions. However, with the new update, the Google Tag will load automatically, even if no events have occurred, raising important privacy concerns.
The intention behind this change is to increase the volume of measurement data and improve the integration of advanced features. However, it also means that user data will be collected automatically if the website operator agrees to the terms for customer data collection. This raises questions about the legal basis for such data processing.
According to the General Data Protection Regulation (GDPR), obtaining consent as outlined in Art. 6 Para. 1 S.1 lit. a is still the most secure legal approach, particularly for collecting customer data through Google services. If consent is chosen as the legal basis, it is crucial that the Google Tag is only loaded after consent is granted through the consent banner.
Website operators must also ensure transparency in their consent banners, verifying that the purpose and description of data collection remain accurate. Moreover, privacy policies should be reviewed and updated to reflect new processing activities. To avoid unlawful data collection, operators should timely implement Google Tags for Ads/Floodlight IDs to prevent automatic loading without consent.
For those who have integrated the Google Tag directly into their HTML code, it may be wise to reconsider this approach, as the tag will now load automatically without user consent, limiting control over data collection practices. Although this technical change might seem minor at first glance, it has significant implications for data protection compliance.
As the digital landscape continues to evolve, website operators are encouraged to reassess their Google Tag implementations to ensure they align with GDPR requirements. Those seeking assistance in navigating the complexities of data protection in relation to the Google Tag Manager are urged to seek expert support.
The date of publication for this article is April 23, 2025, marking a pivotal moment in Google's ongoing efforts to balance user privacy with the needs of the advertising industry.
