The Impact of Third-Party Cookie Deprecation on Adobe Analytics

[ambikaTewari_ATCI]

Hi Team,

The Cookies that are placed by Experience Cloud VisitorID and Adobe Analytics are First Party Cookies and can see that SameSite is blank and and secure not set by default.

So wanted to check if the Third Party Cookie deprecation would impact these Experience Cloud VisitorID and Adobe Analytics  cookies ?

Any guidance would be really helpful.

[Jennifer_Dungan]

That is a really good question.. and one that I am not sure about... a few years ago, I had added the "secureCookies" true setting into my Visitor ID Service extension... I am sure it used to work... so I was a bit surprised to see that my cookies are also not secure right now.... 

I did a  quick search and found this: 
https://experienceleague.adobe.com/en/docs/analytics/implementation/vars/config-vars/writesecurecook...

Now this will only apply to the s_fid, s_cc and s_sq cookies, but it did say that we can get secure s_vi and s_ecid cookies by contacting Client Care?

So that might be worth a check...

As to why there is an option to set "secure cookies" in the extension, if it's not going to actually work, I cannot answer that one.... I guess maybe it made my AMCV cookies secure...

[leocwlau]

SameSite and Secure attributes are another level of security control on cookies and should be impacting the ECID cookies and the capabilities of tracking. Moreover, as you are aware ECID cookies are first-party cookies so they are not impacted by the deprecation of third-party cookies. You can try to actively disable third-party cookies on your browser and observe, you will find ECID retained and sent over to Adobe in the web beacon for tracking.

Just an update from Google that they are delaying the phase-out of third-party cookies on Chrome again.

Update on the plan for phase-out of third-party cookies on Chrome (privacysandbox.com)

[Jennifer_Dungan]

While ECID should be first-party, as you said @leocwlau, server-side set first party cookies (and those that are secure and "same site") are treated as a cookie with less restrictions... generally....

However, even those are under more strict restrictions now..  

I would say anything we can do to improve the authenticity of the cookies would be a good thing, and secure and same site are some of the ways to do that.

[ambikaTewari_ATCI]

Hi @Jennifer_Dungan  and @leocwlau Thank you  for the valuable feedback.
So demdex cookie is set in the third-party, demdex.net domain in the browser. This domain is separated from the site currently visited by a user.

Unlike the first-party, AMCV cookie, the demdex cookie and ID persists across different domains.  I have checked it and could see sameSite as None and secure is set by default. So this demdex will also not be impacted by 3rdParty cookie deprecation, can I assume it ? As I read somewhere (not able to find that link), if 3rd Party cookies having sameSite as None and secure is set then such cookies will not be impacted. Or CNAME implementation should be the final solution ?

[Jennifer_Dungan · Accepted solution]

@ambikaTewari_ATCI I believe that all third party cookies, including the demdex cookies are subject to the restrictions, unfortunately...

[bjoern_k]

@ambikaTewari_ATCI currently, Adobe's ITP is detecting all "cloaked" CNAME requests as going to Adobe IPs and hence treat them as 3rd-party cookie in terms of lifetime (7 days).

This blog explains it in more detail.