In July 2023 I got up on a stage at Campus Party Brasil (#CPBR15) to say that online anonymity was coming to an end. Apple and Google had announced they would stop supporting third-party cookies, and my point was that the digital advertising industry wasn't going to give up tracking without a fight (spoiler: it didn't). It would chase targeting techniques so advanced that browsing without being recognized would become practically impossible.
Two years and change later, Google gave up on killing cookies. You read that right: it gave up.
So, was I wrong?
What a third-party cookie is
You know the wristband an amusement park puts on you at the gate? With it, the staff know you've already paid and let you on the rides without asking again. That's a first-party cookie: the site you visit saves a small file in your browser to remember you, your login or your shopping cart.
Now picture a company that puts its own wristband on you at every park in town. It doesn't sell tickets or run any rides, but it knows which parks you went to, on which day and how long you stood in each line. That's a third-party cookie: a cookie from another domain, usually an ad or analytics company, loaded inside the sites you visit. Since the same company is on thousands of sites, it recognizes your browser on all of them and builds a profile of what you've been up to.
That wristband paid for a good chunk of digital advertising for the last twenty-odd years. Obviously, nobody in the business wanted to take it off anyone's wrist.
What happened since the talk
Safari and Firefox had already cut the wristband off. Safari has blocked all third-party cookies since March 2020, and Firefox keeps each site's cookies apart, with Total Cookie Protection on for everyone since June 2022.
Google gave up on cutting off its own. The plan to remove third-party cookies from Chrome was pushed back several times. In July 2024, Google dropped the timeline and started talking about user choice instead. In April 2025, it dropped that choice prompt too: Chrome keeps third-party cookies, same as always.
The Privacy Sandbox got shelved. The Privacy Sandbox was the set of technologies Google built to replace third-party cookies, like the Topics API, which let the browser itself tell advertisers what you're interested in. In October 2025, Google announced it was retiring most of them, citing low adoption (Google Reader sends its regards). The same day, the UK's competition authority (CMA) released Google from the commitments it had made about the project.
And fingerprinting got a free pass. Think of the doorman in your building. He doesn't need to see your ID to know it's you: he recognizes your walk, your backpack, the time you usually get home. Fingerprinting does the same thing to your browser: it identifies it by the combination of its traits, like the operating system, screen size, installed fonts and language. The difference from the doorman is that you can't swap backpacks: there's no cookie to delete. Since February 2025, Google's advertising rules no longer forbid the technique, and the UK privacy regulator (ICO) called the change irresponsible.
So was I wrong?
In my opinion, I got the trigger wrong and the outcome right. The third-party cookie didn't die in Chrome, but the race its threatened death set off had already started, and nobody went back to the starting line:
- First-party data. It's the corner store asking you to sign up for its loyalty card so you get the discount. Companies started asking for logins, sign-ups and consent so they could own their data about you, with no third party in the middle.
- Universal IDs. It's the "can I have your phone number for the rewards program?" of the internet. Solutions like UID2 and RampID turn your email address into a code that many advertisers and sites recognize.
- Clean rooms. Two stores want to know how many customers they share without showing each other their full lists. The clean room is the neutral room where both databases are matched and only the result comes out.
- Server-side tracking. Instead of your browser telling the ad platform you bought something (and your blocker cutting that message off halfway), the store's server tells it directly. You never even find out.
- Fingerprinting, now with the blessing of the biggest ad seller in the world.
Each of these techniques is more precise than the third-party cookie. Several tie your browsing to a person with a name and an email address, not just to a browser. The cookie, at least, was tracking you could see and delete. What came after is a lot harder to spot.
And so far I've only talked about the browser. Not to mention your phone, which is the doorman living in your pocket. Android and iOS control everything that happens on the device: which apps you open, for how long, who you talk to and, above all, where you are. In a 2018 study, Professor Douglas Schmidt of Vanderbilt University left an Android phone sitting on a desk, untouched, with Chrome open in the background. In 24 hours, the phone sent its location to Google 340 times, about 14 times an hour (Google called the study misleading and pointed out that the professor was a witness for Oracle in a lawsuit against it).
And turning the phone off doesn't always help. Since iOS 15, an iPhone can be found through the Find My network even when it's off, because it keeps sending out a signal that other Apple devices nearby pick up. Great for finding a stolen phone. But it shows that "off" doesn't mean what we think it means anymore.
Even the phone carrier's network gets in on the act. In 2024, Derek from Veritasium hacked, with permission, the phone of Linus from Linus Tech Tips without ever touching it, using only his phone number. He exploited a flaw in SS7, the system carriers use to pass calls and texts between each other, to redirect calls, read messages and, while he was at it, show how a phone's location can be tracked.
Now, here's something I said in the talk and I'll say it again: nobody steals our data. We give it away for free to big tech, in exchange for funny video filters, free email and a GPS that "protects us from traffic". There's even a famous line about it: if the product is free, you're the product. (Nobody knows for sure who said it first. Quote Investigator traced the idea to a 1973 art video, Television Delivers People, and the version that spread online to a 2010 comment on MetaFilter.)
Get it?
Anonymity is a double-edged sword
In my opinion, online anonymity is a double-edged sword. Anyone who knows me knows I work on the side of the people who want to recognize you, so let me start by defending my side.
Think about the difference between the flyer someone shoves at you on a street corner and the salesperson at the store where you always shop. The flyer comes from someone who knows nothing about you and doesn't care: it doesn't matter if you have a car, a dog or any money, it goes into everyone's hand. The salesperson knows your size, remembers what you bought last time and gives you a heads-up when something you'd like comes in. In advertising, being anonymous means getting flyers. When a site can't identify you, it shows you random ads, often from companies that don't much care who sees them.
That's what all this technology was born to do: identify you so it can show you things you're actually interested in, or might like, and make advertising useful. The problem isn't the technology. It's how companies have been using it.
The best-known case is Cambridge Analytica. A personality quiz app on Facebook collected data from up to 87 million profiles, and the consultancy used that data in political campaigns to learn how to talk to each kind of voter. Even Palantir, a company that specializes in cross-referencing huge amounts of data, turned up in the story: Palantir itself admitted that one of its employees worked with people from Cambridge Analytica, "in an entirely personal capacity", according to the company. In other words, the same tools that show you the right pair of sneakers can figure out what makes you scared, or angry, and use it to change your vote.
Then there are social media algorithms, which are the same problem in a different outfit. Picture a bartender who notices you order more beer every time your table starts arguing about football. If he gets paid by the beer, pretty soon he'll be bringing up last weekend's derby every time he walks past. A social network's algorithm is the bartender: it picks what shows up in your feed to keep you there longer, and it learns on its own that fights and outrage keep people around. This isn't a conspiracy theory. Facebook's internal documents leaked in 2021 said that optimizing for engagement was one of the reasons hate speech and misinformation spread, and that among teenage girls already going through a hard time, one in three said Instagram made their body image worse.
That's where the other edge comes in. For a long time, wanting to browse anonymously looked like something only people up to no good would do. Today, it's more and more necessary to keep your sanity and avoid being manipulated by companies with shady interests.
Now, seriously, though not that seriously: if you're browsing and an ad for penis enlargement pops up, worry if you're not anonymous. Maybe you need it and just don't know it yet.
What about the LGPD?
The LGPD (Lei Geral de Proteção de Dados, Law 13,709 of 2018) is Brazil's data protection law, our version of Europe's GDPR: it says what companies and the government can do with your personal data. In theory, it exists to protect citizens. In my opinion, it's been twisted to protect the political class more than the people.
And I'm not alone on this. In 2021 and 2022, data protection and transparency experts called out the federal government for using the LGPD as an excuse to deny requests made under Brazil's freedom of information law (the LAI). The news agency Fiquem Sabendo counted 79 requests denied on LGPD grounds. The president's vaccination card and the access badges his sons used at the presidential palace were put under 100-year secrecy, on the grounds that they were personal data. The head of the São Paulo bar association's privacy committee, Solano de Camargo, put it this way: the government "has been improperly using the LGPD as an excuse to violate the LAI" (my translation).
In other words, the law that was supposed to hide your data from companies ended up hiding the government's data from you. Ironic, to say the least.
Even so, the LGPD gives you things you can (and should) demand from any company that keeps data about you. Under article 18, you have the right to know whether a company has your data, to see what it is, to correct what's wrong, to ask for what was collected without need to be deleted, to know who it was shared with and to withdraw the consent you gave. And under article 20, you can ask for a review of a decision made by an algorithm alone, like a denied loan. If the law doesn't enforce itself, it gets enforced when we push for it.
Can you browse without being tracked?
First of all, there's no need to get paranoid. A 2019 Forrester study commissioned by Oracle found that only 11% of brands can effectively use the data they collect about their customers (which is why companies call me and I get to pay my bills, thank goodness). Six years later, things haven't improved much. In a 2025 Apply Digital survey of UK retail marketing executives, only 8% said they had no problems using their own customer data, and the top complaints were inaccurate (34%), inconsistent (33%) and outdated data (32%). The same survey found a juicy detail: 94% had already started swapping third-party cookies for their own data, but 99% were still using third-party cookies to buy ads.
In other words, what protects you today is their incompetence.
That's no excuse to get careless (and no, I'm not talking about covering your webcam). A few tips from people who know security:
- Find out how exposed you are. Cover Your Tracks, from the EFF, a US digital rights nonprofit, tests whether your browser blocks trackers and how unique your fingerprint is.
- Use a browser that blocks trackers by default, like Firefox or Safari, and a tracker blocker, like the EFF's own Privacy Badger.
- For the strongest protection, use Tor Browser. It's the EFF's recommendation against fingerprinting, at the cost of slower browsing.
- Review the privacy settings on your social networks and phone apps, as the Cartilha de Segurança para Internet, the internet safety guide from Brazil's CERT.br, recommends.
- Think twice before handing over your email address or your ID number. For sign-ups, a forwarding email (a throwaway address that passes messages on to yours) already keeps your life apart from marketing lists. And when a store asks for your ID number or phone number at the register, ask what it's for before you answer.
- And please, don't use your ID number or your phone number as a payment key!!!! In Brazil, Pix (our instant payment system) lets you receive money through a key, and to get paid you have to give that key to whoever is paying, so your taxpayer ID or your phone number goes along with it to anyone. Use the random key. If your country has something similar, the same goes for you.
None of these tips is 100% effective. The EFF itself warns that blockers stop some trackers, "but unfortunately not all". And everything keeps changing online: this very post started with a prediction about cookies that Google made sure to prove wrong.
The wristband came off. Too bad the doorman now knows the way you walk.
References
This part was filled in for me by Claudinho (that's Claude, Anthropic's AI, with a Brazilian nickname). You didn't think I was going to format citations by hand, did you?
AGÊNCIA CÂMARA DE NOTÍCIAS. Acesso à informação não pode ser prejudicado por conta de Lei de Proteção de Dados, dizem especialistas [Access to information cannot be harmed because of the Data Protection Law, experts say]. Portal da Câmara dos Deputados, Brasília, 18 Nov. 2021. Available at: https://www.camara.leg.br/noticias/828370-acesso-a-informacao-nao-pode-ser-prejudicado-por-conta-de-lei-de-protecao-de-dados-dizem-especialistas/.
ALMOND, Stephen. Our response to Google's policy change on fingerprinting. Information Commissioner's Office, Wilmslow, Dec. 2024. Available at: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/our-response-to-google-s-policy-change-on-fingerprinting.
APPLEINSIDER. Find My can find powered-off or wiped iPhones in iOS 15. AppleInsider, Jun. 2021. Available at: https://appleinsider.com/articles/21/06/07/find-my-can-find-powered-off-or-wiped-iphones-in-ios-15.
BRAHM, Wagner. #CPBR15: O fim do anonimato na internet [The end of online anonymity]. In: CAMPUS PARTY BRASIL, 15., 2023, São Paulo. Talk. Available at: https://app.4.events/palestrante-wagner-brahm-3556-c18443.
BRASIL. Lei nº 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados Pessoais (LGPD) [General Personal Data Protection Law]. Brasília, DF: Presidência da República, 2018. Available at: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm.
CENTRO DE ESTUDOS, RESPOSTA E TRATAMENTO DE INCIDENTES DE SEGURANÇA NO BRASIL (CERT.br). Cartilha de Segurança para Internet [Internet Safety Guide]. São Paulo: NIC.br, [n.d.]. Available at: https://cartilha.cert.br/.
CLOVER, Juli. Firefox's Total Cookie Protection now available to all users by default. MacRumors, 14 Jun. 2022. Available at: https://www.macrumors.com/2022/06/14/firefox-total-cookie-protection/.
CLOVER, Juli. Safari in new versions of iOS and macOS includes full third-party cookie blocking. MacRumors, 24 Mar. 2020. Available at: https://www.macrumors.com/2020/03/24/safari-full-third-party-cookie-blocking/.
ELECTRONIC FRONTIER FOUNDATION. Cover Your Tracks. San Francisco: EFF, [n.d.]. Available at: https://coveryourtracks.eff.org/.
FACEBOOK investigating if Palantir had improper access to user data. CNBC, 26 Apr. 2018. Available at: https://www.cnbc.com/2018/04/26/facebook-investigating-if-palantir-had-improper-access-to-user-data.html.
McKELVEY, Charlie. Only 8% of marketers face no first-party data issues. Decision Marketing, 4 Mar. 2025. Available at: https://www.decisionmarketing.co.uk/news/only-8-of-marketers-face-no-first-party-data-issues.
MILMO, Dan. Facebook revelations: what is in cache of internal documents? The Guardian, via Yahoo Tech, 25 Oct. 2021. Available at: https://tech.yahoo.com/general/articles/facebook-revelations-cache-internal-documents-184246049.html.
ORACLE. New study: only 11% of brands can effectively use customer data. PR Newswire, 18 Nov. 2019. Available at: https://www.prnewswire.com/news-releases/new-study-only-11-of-brands-can-effectively-use-customer-data-300959509.html.
QUOTE INVESTIGATOR. Quote origin: you're not the customer; you're the product. Quote Investigator, 16 Jul. 2017. Available at: https://quoteinvestigator.com/2017/07/16/product/.
SCHIFF, Allison. Google pulls the plug on Topics, PAAPI and other major Privacy Sandbox APIs (as the CMA says 'cheerio'). AdExchanger, 17 Oct. 2025. Available at: https://www.adexchanger.com/privacy/google-pulls-the-plug-on-topics-paapi-and-other-major-privacy-sandbox-apis-as-the-cma-says-cheerio/.
SCHMIDT, Douglas C. Google Data Collection. Nashville: Vanderbilt University, Institute for Software Integrated Systems, 15 Aug. 2018. Available at: https://www.dre.vanderbilt.edu/~schmidt/PDF/google-data-collection.pdf.
VALLE, Leonardo. LGPD está sendo usada para censurar informações públicas, alertam especialistas [LGPD is being used to censor public information, experts warn]. Instituto Claro, 29 Mar. 2022. Available at: https://www.institutoclaro.org.br/cidadania/nossas-novidades/reportagens/lgpd-esta-sendo-usada-para-censurar-informacoes-publicas-alertam-especialistas/.
VERITASIUM. Exposing the flaw in our phone system. [S.l.]: YouTube, 21 Sep. 2024. 1 video. Available at: https://www.youtube.com/watch?v=wVyu7NB7W6Y.