Leadfront Blog – News, tips and inspiration in digital growth

Changes in cookie management for Chrome - Leadfront AB

Written by Klas Bernehjält | Dec 14, 2019 5:30:00 AM

For those of us who live online, there are major changes in cookie management that are fundamentally changing how things work, how websites can be customized, communications personalized and web behaviors analyzed. The GDPR was a foretaste and is about how information is collected, stored and managed. In the near future (still unclear when), the current EU rules e-Privacy Directive (EPD ) which, among other things, deals with cookies will be updated and upgraded to the e-Privacy Regulation (EPR).

The change that is closest in time will come as early as February 2020 when Chrome is the first browser to change the handling of "SameSite cookies". The reason for this is to reduce the risk of false requests between sites or cross-site request forgery (CSRF).

Chrome status, SameSite explains it like this: "SameSite is a reasonably robust defense against some classes of cross-site request forgery (CSRF) attacks, but developers currently need to opt-into its protections by specifying a SameSite attribute. In other words, developers are vulnerable to CSRF attacks by default. This change would allow developers to be protected by default, while allowing sites that require state in cross-site requests to opt-in to the status quo's less-secure model. In addition, forcing sites to opt-in to SameSite=None gives the user agent the ability to provide users more transparency and control over tracking.

‍Is this the beginning of the end for smart, controlled communication and advertising?

No, it is unlikely to be, but it does set completely new requirements and requires the industry to make major adaptations.Here is a list of the scenarios that are likely to be affected by the changes to cookie management:

  • Integrations with identity providers using protocols such as SAML 2.0 or OpenID Connect.

  • Embedding web application content from a third-party domain ex iframes.

  • API queries from a third-party domain.

Good sources if you want to know more about the upcoming change:

Also read more in the EU e-Privacy Directive EPD and the upcoming update called e-Privacy Regulation EPR

Leadfront is constantly working to update itself on marketing and sales trends. We love to discuss new approaches and hear what challenges our customers are facing. What challenges are you facing in 2020? Feel free to contact us via the contact form and we'll buy you a coffee.