By Kabir Ahuja, Thomas Bauer, Caroline Meder, and Oliver Gediehn

The rising privacy concerns have reached the ears of many large corporations, who are already taking measures with projects underway to address this global complaint. It may only be a matter of 1 to 2 years before the complete transformation of digital marketing in a cookieless world is complete.

Before the advent of the internet, advertising was a rather haphazard affair. Brands sent an abundance of messages and ads into the world, hoping that a few would find their intended targets. The system worked, but it was wasteful. Then the game changed. Web-based cookies and other personal identifiers enabled companies to track people online and target their advertising to specific kinds of users. But now third-party cookies are on their way out, and the game is about to change again.

How can advertisers prepare for this new reality? Building on recent McKinsey research into the challenges facing advertisers, we have developed three strategies that will help advertising brands thrive. Brands that leverage their own customer touchpoints, share data with other companies, and experiment with targeting consumers based on context as well as interests will position themselves for higher growth and more customer acquisition.

The cookie crumbles

“Before cookies, the web was essentially private. After cookies, the web becomes a space capable of extraordinary monitoring,” said Lawrence Lessig 20 years ago.

At the time, Lessig, a leading legal scholar and former director of the Safra Center for Ethics at Harvard University, was a pioneer, if not a prophet. Today, privacy protection is one of the megatrends shaping the evolution of the web. In a recent McKinsey survey, 41 percent of consumers said they don’t want advertisers to use tracking cookies.

In 2018, the European Union’s General Data Protection Regulation (GDPR) imposed strict privacy and security measures, and many more countries have introduced similar regulations since then. While these developments are welcome to many consumers, they inhibit companies’ efforts to measure—and maximize—their return on investment in advertising.

Advertisers have long relied on cookies to track consumers across the open web, displaying targeted ads based on a user’s browsing history. But now, cookies are heading toward obsolescence. Starting in mid-2023, Google’s Chrome browser is expected to block third-party cookies, which are already blocked in Safari and Firefox (see sidebar “Glossary”). Because Chrome is the leading browser in large parts of the world—its market share in Europe exceeds 60 percent—Google’s expected cookie policy will effectively put an end to cookie-based advertising.

Even more challenging for advertisers is that other tracking methods are also coming under pressure. In the mobile-app space, Apple already requires app providers to get explicit permission from consumers before tracking them through device identifiers as part of its app-tracking-transparency (ATT) framework. Initial observations suggest that only around 46 percent of consumers will agree to be tracked, and the percentage could be even lower in countries in which users are particularly concerned about privacy.

In practice, this means that app providers will be unable to track the majority of users based on device identifiers across the Apple ecosystem. Notably, both Google and Apple have said that they will neither create nor support workarounds, such as probabilistic fingerprinting, to build user-level profiles in their ecosystems.

The path forward for advertisers

Most observers believe that in the short term, the phasing out of third-party cookies and device identifiers will have a detrimental effect on advertising efficiency and thus on advertising ROI. The ban is particularly challenging for brand marketers in sectors that are removed from the customer transaction, such as consumer packaged goods, automotive, and pharmaceuticals.

That said, advertisers have several opportunities to balance the precision of targeting and impact measurement with the privacy of consumers. In general, increasing transparency and providing value in exchange for data will be winning strategies, because many users don’t mind personalized advertising as long as they are not kept in the dark or deceived about the mechanisms that drive it. This has the positive and important side effect of building consumer trust in the respective brand.

As third-party cookies and device identifiers become obsolete, advertisers that pursue the following three strategies will gain an advantage:

  • use their own consumer touchpoints to collect first-party data
  • create partnerships to leverage second-party data
  • experiment with contextual advertising, which displays ads based on the content a user is viewing, and explore the evolution of interest-based advertising, which targets consumers based on their recent top categories of interest.

Advertisers will also need to rethink how they approach measurement and attribution—the process of assessing the contribution of the advertising channels that lead customers to their website or app—given that Google’s cookie ban, Apple’s app-tracking-transparency policy, and evolving privacy-protection regulation will render some existing measurement and attribution methods obsolete (see sidebar “The future of advertising attribution”).

Use brand’s consumer touchpoints to collect first-party data

Because it is increasingly difficult to track users across the open web, brands should intensify their efforts to collect data at the consumer touchpoints they control, such as their own websites and apps, and use analytics to fill in the blanks where their data sets are incomplete.

Data that are collected passively—without the user’s direct participation but with the user’s consent—are known as first-party data. They include such information as browsing behavior, content consumption, location, device, and time of day.

While this information is valuable, it isn’t enough to understand the complete customer journey and support the development of granular user profiles, let alone customized content. To really understand to whom they are talking, companies need information about a user’s intentions, preferences, and lifestyle. A powerful way to convince users to identify themselves and share this kind of information (known as zero-party data) is to give them something valuable in exchange. Examples include personalized product recommendations, free samples, coupons for discounts, extended warranties, and exclusive or early access to new products.

Westwing, an online-only furniture retailer based in Germany, invests the lion’s share of its marketing budget in content creation, often in collaboration with social media influencers. The resulting stories about home makeovers and interior-decorating hacks are not only entertaining but also closely tied to the company’s products. Westwing says that content-driven user engagement generates much deeper bonds and a higher return on marketing investment than paid advertising.

In a similar vein, the consumer-review website Yelp asks registered users for details about their dining habits to drive the relevance of restaurant recommendations. If you are registered as a vegan, restaurants offering vegan meals will feature more prominently in your search results, and you’ll see sponsored ads that match your preferences. Likewise, Procter & Gamble’s Tide brand, which makes cleaning products, posts simple surveys on its website. Users who answer three or four questions about how they do laundry are rewarded with a recommendation for the most suitable product.

The fuel that drives this kind of exchange is clarity of the value exchange, how embedded it is in the native customer experience, transparency on data storage and use, including user control, and brand trust. Brands should be open about the data they seek to collect and the benefits they will provide in return. They should also make it easy for users to understand how their information is stored, what the company is doing to keep it secure, and how a user’s consent can be changed or revoked.

Leading companies use customer data platforms (CDPs) to integrate data from multiple first-, second-, and permissible third-party sources—such as traditional customer-relationship-management (CRM) systems, websites, and apps—to build unified, real-time profiles of anonymous and known users and the data-usage rights that each has granted. Based on this integrated platform, brands can offer a personalized user experience and targeted advertising while protecting the privacy of their users. When a user opts into (or out of) a specific service, such as push alerts for exclusive sales or special offers, this preference will automatically be reflected in companies’ outbound marketing campaign tools.

Create partnerships to leverage second-party data

While first-party data are a great starting point for advertising in the postcookie era, they are not enough to enable state-of-the-art targeting and attribution. “Unless you are Facebook, Apple, or Amazon, even analyzing all your data perfectly will only tell you about a tiny fraction of the world,” says Auren Hoffman, CEO of data company SafeGraph and former CEO of LiveRamp, a leading provider of ad-tech solutions. “The more connected a data set is to other data elements, the more valuable it is.” Additionally, first-party data is not sufficient to satisfy a brand’s reach aspirations.

To maximize the value of their own data, advertisers can form partnerships with other companies to exchange data that users have cleared for certain purposes. Typically, marketing data partnerships bring together two companies that are not competitors but pursue complementary interests. For example, a manufacturer of consumer products could partner with an e-commerce retailer to combine browsing-history data with shopping-cart data. Which products did the user research on the manufacturer’s website? Which products did the user end up buying on the retailer’s? Answers to these questions can inform initiatives to increase the conversion rate and encourage repeat purchases.

Brands are allocating larger shares of their advertising budgets to online retail media, including retailers’ websites, apps, and other digital properties. In the United States, according to data from eMarketer, 12 percent of digital-advertising spending in 2020 went to retail media, while European retail media are still in their infancy. In the United Kingdom, for example, only 5 percent of digital-ad spending was allocated to retail media in 2020. European advertisers would do well to ramp up their efforts in this area.

As smart stores take hold, advertisers’ digital partnerships with retailers could even extend to the physical realm. For example, a customer who has registered with a brand could receive tailored offers through the retailer’s app while shopping at a smart brick-and-mortar store, informed by the shopper’s customer profile, past purchases, and location in the store. In other cases, advertisers may choose to partner with content providers, such as TV networks or online publishers, to reach users whose attributes match those of their existing customers, such as families with children who are interested in team sports.

A key enabler of safe data sharing is the concept of the data clean room, a construct that resembles a notary’s escrow account. In a data clean room, shared data are typically stored in the cloud by a neutral third party. While neither party has to reveal its data to its partner, both parties can access the shared data to build audience segments and for analyses. Targeting itself is done anonymously; the identity of the targeted user is not revealed to the advertising brand. A data clean room enables advertisers and media owners to expand their relationships in a way that meets privacy regulations without exposing personally identifiable information.

In addition to technologies for local identity resolution, advertisers are exploring so-called persistent identifiers. The Trade Desk, Zeotap, and other players are working to establish universal IDs, anchored by identifiers such as email addresses. Daniel Heer, founder and CEO of Zeotap, says that the “universal ID functions as a master first-party ‘cookie’ but one that is persistent and valid across all data-collection (and activation) channels. This ID can then be used for relevant second- or third-party-data enrichment and activation across a plethora of marketing channels, including the open web.” To be GDPR compliant, these solutions will need to ensure that consumers’ privacy choices, including explicit user consent, are respected.

Experiment with contextual advertising, and explore the evolution of interest-based targeting

If you’re working out at the gym, you may be receptive to information about a new protein shake. If you’re at a nightclub, you’re probably interested in discovering new music. And if you’re attending a fashion show, there’s a good chance that you wouldn’t mind hearing about trendy apparel, accessories, and shoes.

Marketers can learn a lot about your interests based on where you hang out, what you’re doing, or what you’re viewing, and they can use that information to send you messages that resonate. This is what contextual targeting and interest-based advertising are all about. Whereas cookie-driven approaches display ads based on a user’s browsing history and inferred interest, contextual advertising is based on the current content that a user is viewing. Interest-based advertising still relies on data about the websites a user visits, but only to identify broad content topics in which the user is likely to be interested. Based on a visitor’s behavior, selected topics are then made available to the website to help determine which ad to show them.

Contextual advertising. As users grow increasingly wary of tracking, and tech giants limit person-level targeting online and within apps, contextual advertising is emerging as a promising way for brands to reach their target groups. It may seem like a step backward in the evolution of advertising, and it’s been criticized for inefficiency. But it could offer a viable short-term solution for advertisers, because technological advances are increasing the granularity and precision of context classification and ad matching. For example, contextual advertising has traditionally relied on keywords—but keywords often don’t reflect the full context of a web page or an app.

New contextual targeting tools that rely on natural language processing and image recognition allow algorithms to grasp the sentiment of pages and apps with unprecedented speed and reliability, enabling marketers to display ads in an environment that is both highly relevant for their potential customers and safe for their brands. As the technology evolves, what at first looks like a step backward sometimes turns out to be a step in a new direction.

Interest-based targeting. A related approach, promoted by Google as an alternative to cookie-based targeting, is interest-based targeting. Google’s most recently proposed concept, Topics, replaces its controversial initial one, Federated Learning of Cohorts (FLoC). The idea behind Topics is that the browser learns about users’ interests as they surf the web and shares their top interests with participating websites for advertising purposes.

It does so by categorizing the websites a user visits into a limited set of around 350 broad topics, such as hair care or classic cars, excluding any sensitive topics, such as race or sexual orientation. When a user visits a website that supports the Topics API, the browser will choose up to three topics on their device from their most frequent topics of each of the last three weeks and share them with this website. The website and its advertising partners can then use these topics to determine which ads to display.

Google claims that Topics is more private and offers greater transparency and user control than FLoC and cookie-based targeting, but many specifics of the concept were still unknown at the time of writing. The jury is still out on whether Topics will eventually satisfy advertisers, media owners, regulators, watchdogs, and other stakeholders.

The emergence of device-identifier restrictions and the end of third-party cookies are sure to have a highly disruptive impact on the advertising industry—for both advertisers and other players (see sidebar “The impact on other players”). While advertisers have already had to start adapting to privacy-driven changes, they should intensify experimentation with viable alternatives to third-party cookies. If they don’t make dramatic changes in their approach to advertising, they will face significantly higher acquisition costs going forward.

Each stakeholder will forge its own path to success, but the governing principle should be to create and sustain consumer relationships that produce a value exchange, while protecting the privacy of users. -McKinsey