Search code examples
cookiescsrfadssamesite

Will the new SameSite cookie attribute effectively prevent all targeted ads?


There is a new attribute for cookies called SameSite that is by default set to allow Get requests for cross-sites to prevent CSRF via other HTTP Verbs.

As far as I know all targeted ads are heavily relying on cross-site cookies. Now if browsers or a plugin for a browser would just intercept all the cookies and set them to SameSite Strict, would not that effectively mean end of targeted ads? (At least the cross-site type we are seeing all the time now, when you see something you recently checked on amazon being advertised "everywhere" after that).


Solution

  • No.

    The SameSite attribute is not new, what's new is the introduction of an explicit None value and the adoption of new defaults described by the Incrementally Better Cookies draft. This means that instead of cookies being sent with all requests by default, they must be explicitly marked for cross-site transfer.

    That's it. Mark cookies as SameSite=None; Secure and they retain their legacy behaviour enabling them to be sent on cross-site requests as often utilised by advertising platforms.

    You can read https://web.dev/samesite-cookies-explained for more context.