What Changed
On December 18, 2024, Google told partners that its ad platform policies would change on February 16, 2025. The update, it said, would be "less prescriptive with partners in how they target and measure ads", reflecting advances in privacy-enhancing technologies such as on-device processing, trusted execution environments and secure multi-party computation, and the wider range of places ads now appear, including connected TVs and games consoles. Partners would still have to be transparent with users.1
Google's notice didn't use the word, but the change removed a prohibition on using device fingerprints from the policies.2 Fingerprinting recognizes a device by combining details of its software and hardware, such as the browser, screen, fonts and network, instead of storing an ID in a cookie. Unlike a cookie, people can't see or clear it.
The UK's Information Commissioner's Office (ICO) responded the next day. It called the change irresponsible, said fingerprinting was not a fair means of tracking people because it reduces their choice and control, and noted that Google itself had said so.3 In 2019, setting out the plan that led to the Privacy Sandbox, Google had written that because people can't clear their fingerprint, the technique "subverts user choice and is wrong."4
Why It Mattered
The change came from the same company that had pledged not to build alternative identifiers for its ads, and that had kept third-party cookies in Chrome a few months earlier. Fingerprinting was the technique the Privacy Sandbox had been meant to head off.
For advertisers it changed what Google's platforms allow, not what the law allows. The ICO said fingerprinting for advertising is subject to the same rules as cookies: in the UK, that generally means consent, along with transparency and people's right to have their data erased, a bar it said would be hard to meet.3 In the EU, the data protection regulators' joint guidance confirms that fingerprinting falls under the same ePrivacy rule as cookies, so a vendor offering fingerprint-based targeting or measurement doesn't remove the need for consent.5,2
Browsers moved the other way. Apple, for example, blinds known fingerprinting scripts in every Safari tab from iOS 26, so fingerprint-based IDs are least reliable on the devices where cookie-based tracking was already weakest.
Notes
- “Upcoming February Update to the Platforms Program Policies,” Platforms Policies Help, Google, December 18, 2024, https://support.google.com/platformspolicy/answer/15610408. ↩
- Mark Hersey, “Google Adopts New Stance on Device Fingerprinting,” Lewis Silkin, January 16, 2025, https://www.lewissilkin.com/en/insights/2025/01/16/google-adopts-new-stance-on-device-fingerprinting-102ju7b. ab
- Information Commissioner’s Office, “Our Response to Google’s Policy Change on Fingerprinting,” Information Commissioner’s Office, December 19, 2024, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/our-response-to-google-s-policy-change-on-fingerprinting. ab
- Justin Schuh, “Building a More Private Web,” The Keyword, Google, August 22, 2019, https://blog.google/products-and-platforms/products/chrome/building-a-more-private-web/. ↩
- “Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive,” European Data Protection Board, October 7, 2024, https://edpb.europa.eu/system/files/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf. Version 2.0. ↩