LGTM On Tue, Dec 26, 2023 at 8:11 AM 'Joshua Hood' via blink-dev < blink-dev@chromium.org> wrote:
> Hi Blink API owners, > > We would like to request your approval for adding a first-party version of > this Deprecation Trial. This will be helpful for top-level origins that > also need additional transition time, in cases where it is impossible, > impractical or unnecessary to sign the affected third-party (3P) providers > up for the 3P deprecation trial. This deprecation trial temporarily > provides cross-site cookie access for non-advertising use cases. > > This has been requested by web developers on threads such as the I2D&R > thread > <https://groups.google.com/a/chromium.org/g/blink-dev/c/RG0oLYQ0f2I/m/GS14IqCOAQAJ> > for third-party cookies. > > Our proposed timelines for this trial remain unchanged: > > Registration opens the week of January 15, 2024 [1] > > The trial will end on December 27, 2024 > > Effective in Chrome versions M120 through M132 > > [1] As communicated previously, the grace period > <https://developers.google.com/privacy-sandbox/blog/third-party-cookie-deprecation-trial#:~:text=We%20acknowledge%20that,the%20grace%20period> > that we are providing for the third-party deprecation trial also applies to > the first-party deprecation trial. Additionally, to minimize user impact > before registration for the trial opens, Chrome will provide temporary > access to third-party cookies for sites with reported > <http://goo.gle/report-3pc-broken> user-facing breakage during this grace > period. > > On Tuesday, December 5, 2023 at 3:53:04 PM UTC-5 Ben Kelly wrote: > >> FYI, we are also planning to provide a grace period for sites registered >> and approved for the deprecation trial to give them time to deploy trial >> tokens. See this updated section of the blog post: >> >> >> https://developers.google.com/privacy-sandbox/blog/third-party-cookie-deprecation-trial#:~:text=We%20acknowledge%20that,the%20grace%20period >> . >> >> On Tue, Dec 5, 2023 at 12:22 PM Ben Kelly <wande...@chromium.org> wrote: >> >>> The deprecation trial is now open for registrations: >>> >>> >>> https://developer.chrome.com/origintrials/#/view_trial/3315212275698106369 >>> >>> Again, please be aware this trial will require a review process as >>> outlined in the blog pos >>> <https://developer.chrome.com/blog/third-party-cookie-deprecation-trial/> >>> t. >>> >>> On Tue, Nov 21, 2023 at 2:53 PM Ben Kelly <wande...@chromium.org> wrote: >>> >>>> FYI, please see this blog post for more information on this deprecation >>>> trial: >>>> >>>> https://developer.chrome.com/blog/third-party-cookie-deprecation-trial/ >>>> >>>> On Fri, Nov 17, 2023 at 7:52 PM Mike Taylor <mike...@chromium.org> >>>> wrote: >>>> >>>>> LGTM for a deprecation trial from M120 to M132. For those of you who >>>>> have followed my career (all 2 of you), it shouldn't come as a surprise >>>>> that I appreciate the desire and efforts to minimize the compat >>>>> implications for sites that are earnestly moving towards this brave new >>>>> post-3rd-party cookies world. >>>>> >>>>> (Note: I don't work on third-party cookie deprecation but I would have >>>>> landed on a similarly recommended timeline for migration/deprecation. >>>>> Thanks for being accommodating and realistic to the complicated demands of >>>>> web development and deployment of different use-cases.) >>>>> >>>>> On 11/17/23 1:21 PM, Ben Kelly wrote: >>>>> >>>>> Contact emails >>>>> >>>>> joha...@chromium.org, wande...@chromium.org >>>>> >>>>> Explainer >>>>> >>>>> None >>>>> >>>>> Specification >>>>> >>>>> >>>>> https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-12#name-the-cookie-header-field >>>>> >>>>> Summary >>>>> >>>>> We intend to deprecate and remove default access to third-party (aka >>>>> cross-site) cookies as part of the Privacy Sandbox Timeline for the Web, >>>>> starting with an initial 1% testing period in Q1 2024, followed by a >>>>> gradual phaseout planned to begin in Q3 2024 after consultation with the >>>>> CMA. (The gradual phaseout is subject to addressing any remaining >>>>> competition concerns of the UK’s Competition and Markets Authority.) >>>>> >>>>> Phasing out third-party cookies (3PCs) is a central effort to the >>>>> Privacy Sandbox initiative, which aims to responsibly reduce cross-site >>>>> tracking on the web (and beyond) while supporting key use cases through >>>>> new >>>>> technologies. Our phaseout plan was developed with the UK's Competition >>>>> and >>>>> Markets Authority, in line with the commitments we offered for Privacy >>>>> Sandbox for the web. >>>>> >>>>> To support this effort we would like to run a deprecation trial for >>>>> third-party embedded content. Qualified third-parties participating in >>>>> the >>>>> trial can supply a token via an iframe or third-party script in order to >>>>> continue receiving third-party cookies on requests to that origin. >>>>> >>>>> Goals for experimentation >>>>> >>>>> The primary goal of the deprecation trial is to reduce the amount of >>>>> broken user-visible experiences as third-party cookies are phased out. >>>>> Third-party embedded content or services with these kinds of experiences >>>>> can use the trial to continue to receive third-party cookies while they >>>>> work on long term solutions for their users based on CHIPS, Storage Access >>>>> API, Related Website Sets, FedCM, etc. >>>>> >>>>> To meet this goal, requests to register for the deprecation trial will >>>>> be reviewed to confirm eligibility. Specifically, third-party providers >>>>> will need to demonstrate functional breakage in user journeys to be >>>>> eligible. Because the deprecation trial is not intended to support >>>>> cross-site tracking for advertising purposes, third-party embeds and >>>>> services used for advertising will not be eligible. The ineligibility of >>>>> advertising use cases will also help to ensure the deprecation trial does >>>>> not interfere with the industry testing planned for the start of 2024 as >>>>> described by the CMA >>>>> <https://www.gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes#industry-testing> >>>>> . >>>>> >>>>> Experiment timeline >>>>> >>>>> Registration opens the week of November 27, 2023. >>>>> >>>>> The trial will end on December 27, 2024. >>>>> >>>>> Effective in Chrome versions M120 through M132 >>>>> >>>>> Blink component >>>>> >>>>> Internals>Network>Cookies >>>>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Internals%3ENetwork%3ECookies> >>>>> >>>>> Search tags >>>>> >>>>> 3pcd <https://chromestatus.com/features#tags:3pcd> >>>>> >>>>> TAG review >>>>> >>>>> None >>>>> >>>>> TAG review status >>>>> >>>>> Not applicable >>>>> >>>>> Risks >>>>> Interoperability and Compatibility >>>>> >>>>> Web Compatibility: >>>>> >>>>> Despite 3PCs already being blocked in Firefox and Safari and developer >>>>> outreach efforts to raise awareness and encourage developers to prepare >>>>> for >>>>> the deprecation, we currently estimate that a non-trivial number of sites >>>>> are still relying on third-party cookies for some user-facing >>>>> functionality. See Intent to Deprecate and Remove for more information: >>>>> https://groups.google.com/a/chromium.org/g/blink-dev/c/RG0oLYQ0f2I/m/xMSdsEAzBwAJ >>>>> >>>>> >>>>> Interoperability: >>>>> >>>>> Both Firefox and Safari have removed default access to third-party >>>>> cookies already, though there are small differences in how browsers treat >>>>> SameSite=None cookies in so called “ABA” scenarios (site A embeds site B, >>>>> which embeds site A again). Chrome ships the more secure and more >>>>> restrictive variant, and from initial conversations we are optimistic that >>>>> other browsers will adopt it as well. There are also subtle differences in >>>>> how browsers restore access to third-party cookies through mechanisms such >>>>> as heuristics or custom quirks. Where Chrome implements similar measures >>>>> (such as the heuristics), we try to follow the launch and standards >>>>> processes to achieve as much interop as we can, given other requirements >>>>> such as privacy and security. >>>>> >>>>> >>>>> Gecko: Shipped/Shipping >>>>> >>>>> WebKit: Shipped/Shipping >>>>> >>>>> Web developers: Mixed signals ( >>>>> https://privacysandbox.com/news/privacy-sandbox-for-the-web-reaches-general-availability/#:~:text=The%20Benefits%20of%20Collaboration) >>>>> As one of the most impactful changes to the web platform in a long time, >>>>> the deprecation of 3rd party cookies and the introduction of alternative >>>>> APIs have received a lot of helpful feedback from web developers to an >>>>> extent impossible to summarize in a few sentences. As described in the >>>>> summary, the Privacy Sandbox wants to ensure that a vibrant, freely >>>>> accessible web can exist even as we roll out strong user protections and >>>>> we >>>>> will continue to work with web developers to understand their use cases >>>>> and >>>>> ship the right (privacy-enhancing) APIs. And we’ve received feedback that >>>>> gives us confidence that we’re on the right track. >>>>> >>>>> Other signals: >>>>> >>>>> Activation >>>>> >>>>> Impact on the Ads ecosystem: >>>>> >>>>> A suite of APIs for delivering relevant ads, measuring ad performance, >>>>> and preventing fraud and abuse are now generally available in Chrome to >>>>> continue to facilitate ad-supported content on the web. We continue to >>>>> work >>>>> closely with the UK Competition and Markets Authority (CMA) on evaluating >>>>> the impact of this change on the ads ecosystem. >>>>> >>>>> >>>>> WebView application risks >>>>> >>>>> Does this intent deprecate or change behavior of existing APIs, such >>>>> that it has potentially high risk for Android WebView-based applications? >>>>> >>>>> None >>>>> >>>>> >>>>> >>>>> Ongoing technical constraints >>>>> >>>>> None >>>>> >>>>> >>>>> Debuggability >>>>> >>>>> Developers may use the command-line testing switch >>>>> --test-third-party-cookie-phaseout (available starting Chrome 115) or >>>>> enable chrome://flags#test-third-party-cookie-phaseout (available >>>>> starting Chrome 117), to simulate browser behavior with default access to >>>>> third-party cookies removed. We also started reporting DevTools issues for >>>>> cookies impacted by the deprecation starting in Chrome 117 to help >>>>> identify >>>>> potentially impacted workflows. We are continuing to improve our developer >>>>> documentation on debugging third-party cookies usage, and guidance on >>>>> migration to new APIs. >>>>> >>>>> https://developer.chrome.com/blog/cookie-countdown-2023oct/ >>>>> >>>>> >>>>> Will this feature be supported on all six Blink platforms (Windows, >>>>> Mac, Linux, Chrome OS, Android, and Android WebView)? >>>>> >>>>> No >>>>> >>>>> Third-Party Cookies will be deprecated on Windows, Mac, Linux, Chrome >>>>> OS, Android. The deprecation will not affect Android WebView for the time >>>>> being, where 3PCs are already blocked by default, but can be re-enabled by >>>>> the embedding application. >>>>> >>>>> >>>>> Is this feature fully tested by web-platform-tests >>>>> <https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md> >>>>> ? >>>>> >>>>> Yes >>>>> >>>>> Yes. We have put together a set of WPTs which cover third-party cookie >>>>> blocking for subresource requests. It is not yet comprehensive, we are >>>>> working on adding additional tests to support our standardization efforts. >>>>> >>>>> >>>>> https://wpt.fyi/results/cookies/third-party-cookies/third-party-cookies.tentative.https.html?label=experimental&label=master&aligned >>>>> >>>>> >>>>> Flag name on chrome://flags >>>>> >>>>> test-third-party-cookie-phaseout >>>>> >>>>> Finch feature name >>>>> >>>>> None >>>>> >>>>> Non-finch justification >>>>> >>>>> None >>>>> >>>>> Requires code in //chrome? >>>>> >>>>> False >>>>> >>>>> Launch bug >>>>> >>>>> https://launch.corp.google.com/4276016 >>>>> >>>>> Estimated milestones >>>>> >>>>> DevTrial on desktop >>>>> >>>>> 117 >>>>> >>>>> DevTrial on Android >>>>> >>>>> 117 >>>>> >>>>> >>>>> Link to entry on the Chrome Platform Status >>>>> >>>>> https://chromestatus.com/feature/5133113939722240 >>>>> >>>>> Links to previous Intent discussions >>>>> -- >>>>> You received this message because you are subscribed to the Google >>>>> Groups "blink-dev" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send >>>>> an email to blink-dev+...@chromium.org. >>>>> To view this discussion on the web visit >>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAK7rkMgacVy4YDA4T6z72mEPfwGst3O1_GbB8jF_W5kBwPyAXA%40mail.gmail.com >>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAK7rkMgacVy4YDA4T6z72mEPfwGst3O1_GbB8jF_W5kBwPyAXA%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>> . >>>>> >>>>> -- > You received this message because you are subscribed to the Google Groups > "blink-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to blink-dev+unsubscr...@chromium.org. > To view this discussion on the web visit > https://groups.google.com/a/chromium.org/d/msgid/blink-dev/4e6f1196-440e-4212-bf88-8bc68cd700b2n%40chromium.org > <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/4e6f1196-440e-4212-bf88-8bc68cd700b2n%40chromium.org?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscr...@chromium.org. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAOMQ%2Bw9wHa6O6VPRX5GtfTuhx5whJ1DUt2EAUrfLU650Gaet8w%40mail.gmail.com.
