If you want to persist the cart for longer than the current session or a few hours, though, you need consent.

Of course they don't have to be stored, in fact they shouldn't be stored. They are session level naturally so belong in session level cookies not more permanent storage.

Also, while session tokens in cookies are usually fine to be defined as strictly essential for the main site, they are generally not for 3rd party cookies.

> localStorage/sessionStorage seems kind of like the same thing? Am I missing somehting?

No, those are more often used in equivalent ways to cookies though they don't do exactly the same job, extra logic is needed if your server-side needs to access the stored information. Cookie values are sent to the web server(s) with every request (except where certain flags are set), data in session/local storage needs to be explicitly read out and sent on in GET or POST parameters when needed.

That would fall on necessary cookies. If my cart is empty, you don't need to know what's in my cart.

Those are worse than cookies for a number of reasons but they are functionally equivalent.

Anyway, there is nothing wrong with cookies in general. Privacy-wise the problem are cookies used for tracking. Any other technology would have the same problems and would need an explicit consent from the user, if you are subject to GDPR and similar legislation.

LGTM!

FML...

Also GTM can get fucked.

Traditional retargeting is done discriminatory. You visited a site, got enrolled in a list, etc. and they start targeting that. Ad engagement retargeting on the other hand waits until you "engage" with the ad, meaning that you have explicitly showed interest. Is another explicit vs implicit.

It took awhile but I finished the article. I don't see much self-gratification in phrases like:

> we saw around a 30% increase in our cost per click (CPCs) in Google search.

Or this:

> This took a TON of back and forth, basically building logic that an out-of-the-box attribution solution already has in SQL, but we finally got to a place where we could salvage around 50% of attribution data.

The self congratulating I saw was

* they decided to try this before it was foisted on them by externalities.

* they worked their asses off to make it work.

* they have a competent BI team.

I don't understand why they also eliminated most first party cookies though. I respect that level of respect for user privacy but it goes beyond my personal expectation for privacy.

That’s why chat GPT is to produce marketing copy that is as good or better than the best ad people can do.

You will have a hard time browsing the web, including this site ;)

Unless you always browse with the network inspector open I don't really see how that would be the case.

[1] And yeah most of those useful snippets are for tracking, but actually several privacy solutions like cookie management platforms can be held inside a tag manager as well. To me it's still worth it because if I block those CMPs along with GTM it means no banner and no agreeing to any tracking.

You make it sound like we should all be grateful. Like ads are adding value to our lives. They don't. Outside of marketing, nobody cares about ads. We train our cognition to cancel out ads. We avoid them. The only people looking at ads and appreciating them are the ones, like yourself, who find them useful for things nobody asked for. I'd much rather you DON'T track me and --gasp-- DON'T show me an ad either. "But then you'll see worse ads!" Good. I'll ignore those too.

In my lifetime I've probably been shown $10,000 worth of ads on the internet, and I've probably spent $12 on them. Ironic that the only people who think that ads matter are the ones who's job it is to buy them with other people's money. Keep spending your bosses money, and I'll keep wasting it for you.

It's incredibly hard to tell. For us the goal of eliminating Cookies was important given the stance we have on privacy so everything went from there. The folks working in marketing for sure were not happy with the directive as it makes their job much harder.

But the world is still spinning, even without cookies. That's enough to call this a success.

(Spitballing: a standard way to implement CSRF protection with no cookies at all is when you generate the form you include a nonce. Then when the form is submitted you check whether it's a nonce you generated, which you do either by having stored it or generated it by hashing information you've stored. Implemented naively on a login form this would allow the attacker to fetch your page, extract the nonce, and include it in a cross-site request. But you could require it to be from the same IP. Alternatively I think you could fix this by having your login form set a custom header, which then browsers won't allow a cross-site POST for without a CORS preflight which you'd reject. But at this point I'm brainstorming and please don't take any of this very seriously!)

Laws like ePrivacy in the EU do indeed have specific provisions regarding cookies but e.g. the GDPR is much broader than that and would still apply. How truthful is it that eliminating cookies is motivated by a strong stance on privacy rather than just getting a head start in marketing instead of having to scramble when Google pulls the plug? It doesn't sound like you reduced the tracking and behavioral analysis beyond what was technically unavoidable?

I mean, based on my interactions with marketing people, they often don't really know if much of what they've done has helped the business at all, and the majority of their work (apart from actually creating marketing copy and interacting with customers) seems to revolve around figuring out how to attribute booms in business to their previous campaigns while building plausible deniability for inevitable busts. Don't get me wrong, not ALL of it is completely incomprehensible: email and referrer links are pretty straightforwardly calculable in terms of their impact; but things like "brand awareness" campaigns are nigh impossible to actually gauge the impact of.

But lets not forget, that we are all part of a human society. Almost no ones, if anyone's behavior has no effect on others. By using the Internet like I do, I am also acting in a responsible way regarding my effect on society. We need more people resisting big tech surveillance and daily violation of privacy. I hope some day more of us can look beyond immediate personal benefit.