There is a new attribute for cookies called SameSite
that is by default set to allow Get
requests for cross-sites to prevent CSRF via other HTTP Verbs.
As far as I know all targeted ads are heavily relying on cross-site cookies. Now if browsers or a plugin for a browser would just intercept all the cookies and set them to SameSite
Strict
, would not that effectively mean end of targeted ads? (At least the cross-site type we are seeing all the time now, when you see something you recently checked on amazon being advertised "everywhere" after that).
No.
The SameSite
attribute is not new, what's new is the introduction of an explicit None
value and the adoption of new defaults described by the Incrementally Better Cookies draft. This means that instead of cookies being sent with all requests by default, they must be explicitly marked for cross-site transfer.
That's it. Mark cookies as SameSite=None; Secure
and they retain their legacy behaviour enabling them to be sent on cross-site requests as often utilised by advertising platforms.
You can read https://web.dev/samesite-cookies-explained for more context.