# Third-Party Cookies, Single Sign-On, and the Limits of Browser Privacy Interventions

DevFeed: [Third-Party Cookies, Single Sign-On, and the Limits of Browser Privacy Interventions](<https://devfeed.tech/articles/misfire-26543.md>)

Original publisher: [Read original article](<https://infrequently.org/2024/07/misfire/>)

Author: Alex Russell

Published: 2024-07-30T00:00:00Z

Content type: opinion

Language: en

Sources: [Alex Russell](<https://devfeed.tech/sources/alex-russell.md>)

Topics: [Cookies](<https://devfeed.tech/topics/cookies.md>), [Web](<https://devfeed.tech/topics/web.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [W3C](<https://devfeed.tech/topics/w3c.md>), [browsers](<https://devfeed.tech/topics/browsers.md>), [Google](<https://devfeed.tech/topics/google.md>)

Tags: [browsers](<https://devfeed.tech/tags/browsers.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [google](<https://devfeed.tech/tags/google.md>), [identity](<https://devfeed.tech/tags/identity.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [sso](<https://devfeed.tech/tags/sso.md>), [w3c](<https://devfeed.tech/tags/w3c.md>), [web](<https://devfeed.tech/tags/web.md>), [webdev](<https://devfeed.tech/tags/webdev.md>)

## AI overview

This commentary critiques the W3C Technical Architecture Group's response to Google's decision not to imminently remove third-party cookies. It argues that the response underplays both the limited benefits of cookie removal and the unresolved effects on Single Sign-On, sign-in flows, advertising, and user tracking.

## Source excerpt

The W3C Technical Architecture Group1 is out with a blog post and an updated Finding regarding Google's recent announcement that it will not be imminently removing third-party cookies. The current TAG members are competent technologists who have a long history of nuanced advice that looks past the shouting to get at the technical bedrock of complex situations. The TAG also plays a uniquely helpful role in boiling down the guidance it issues into actionable principles that developers can easily follow. All of which makes these pronouncements seem like weak tea. To grok why, we need to walk through the threat model, look at the technology options, and try to understand the limits of technical interventions. Contents Unmasking The Problem Fire And Movement Finding A Way Forward But before that, I should stipulate my personal position on third-party cookies: they aren't great! They should be removed from browsers when replacements are good and ready, and Google's climbdown isn't helpful. That said, we have seen nothing of the hinted-at alternatives, so the jury's out on what the impact will be in practice.2 So why am I dissapointed in the TAG, given that my position is essentially what they wrote? Because it failed to acknowledge the limited and contingent upside of removing third-party cookies, or the thorny issues we're left with after they're gone. Unmasking The Problem So, what do third-party cookies do? And how do they relate to the privacy theat model? Like a lot of web technology, third-party cookies have both positive and negative uses. Owing to a historcal lack of platform-level identity APIs, they form the backbone of nearly every large Single Sign-On (SSO) system. Thankfully, replacements have been developed and are being iterated on. Unfortunately, some browsers have unilaterally removed them without developing such replacements, disrupting sign-in flows across the web, harming users and pushing businesses toward native mobile apps. That's bad, as native app