7 Ways This Double Standard Impacts You
Here's a darkly funny thought experiment: Imagine a bank that sells safety deposit boxes. You rent one, lock your valuables inside, and the bank assures you that nobody—not even the staff—can open it without your key. Then you discover the bank manager has a master key. And he uses it. Every day. On every box in the vault.
That's essentially what's happening with Google Chrome.
The company has spent years telling users they can block third-party cookies to protect their privacy. It has built elaborate settings screens, published transparency reports, and made grand promises about a "Privacy Sandbox" that would reshape the web. But buried in Chrome's architecture is a quiet exception: Google's own domains—YouTube, Gmail, Search, Maps—are treated as first-party sites, which means they're exempt from the very restrictions users enable to protect themselves.
The Financial Times flagged this issue in 2023, and it has only grown more contentious since. Google's own properties account for roughly 40% of all web traffic, according to Statista. Chrome holds a 65% market share among browsers. Put those numbers together, and you have a staggering reality: the majority of internet users are subject to data collection policies they don't fully understand and can't fully control.
Here are seven ways this exemption impacts you, your privacy, and the broader digital economy.
Let's get technical for a moment, because the details matter.
Chrome's "user site data settings" include options like "Block third-party cookies." A third-party cookie is a tracker placed by a domain other than the one you're currently visiting. If you visit a news site and that site loads an ad from a separate ad network, that network's cookie is third-party. Blocking these cookies prevents cross-site tracking.
Google's own services, however, are classified as first-party. When you visit YouTube, Google is the site you're interacting with. When you use Gmail, Google is the host. When you search, Google is the destination.
Here's the problem: Google's services are so deeply interconnected that "first-party" becomes a conveniently broad umbrella. When you're logged into a Google account, the company can track your behavior across YouTube, Gmail, Search, Maps, and dozens of other properties—and it treats all of that as a single, unified first-party interaction.
Example: You enable "Block third-party cookies" in Chrome. You then watch a few videos on YouTube while logged in. Google records your watch history, your search queries, your dwell time, even your pause points. It uses this data to build a profile and serve you targeted ads. The cookie-blocking setting you enabled? It doesn't touch any of this, because YouTube is Google, and Google considers itself "first-party" to everything it owns.
Key Takeaway: Blocking third-party cookies in Chrome does not stop Google from tracking your activity across its own ecosystem. That's not a bug; it's by design.
It's easy to dismiss this as a niche technicality. It's not.
Chrome's market share sits at roughly 65% globally, according to StatCounter data from 2024. That means two out of every three internet users are browsing with a tool whose privacy settings have a built-in exception for the company that makes it.
Now layer in Google's reach. Statista estimates that Google's own sites account for approximately 40% of all web traffic. Think about that for a second. Nearly half of everything people do online happens on Google-owned properties. When you consider that Google also operates the most popular browser, the most popular search engine, the most popular video platform, and the most popular email service, the scale becomes almost incomprehensible.
A 2023 Pew Research survey found that 72% of internet users say they're concerned about their online privacy. Yet only 25% regularly adjust their browser privacy settings. Most people assume the default settings—or the settings they've enabled—are protecting them. They aren't, at least not from Google itself.
Example: A privacy-conscious user reads an article about cookie blocking, goes into Chrome's settings, and flips the switch to block third-party cookies. They feel virtuous. They feel protected. Meanwhile, Google continues to collect data on every search they perform, every video they watch, every email they send, and every map route they look up—all under the banner of "first-party" access.
Key Takeaway: The exemption isn't a minor edge case. It affects the vast majority of internet users, most of whom have no idea it exists.
Here's where the exemption stops being just a privacy issue and becomes a competition issue.
Google's advertising revenue reached $237.86 billion in 2023, according to Alphabet's annual report. Much of that revenue depends on the company's ability to target users with precision. Google's data advantage is its moat—the thing competitors can't replicate.
When Chrome blocks third-party cookies, it restricts what other companies can do. A news publisher can't track users across different sites to build advertising profiles. An e-commerce platform can't follow potential customers around the web. But Google can track users across its entire ecosystem without restriction, because those properties are all "first-party."
This creates a fundamental asymmetry. Competitors are playing with one hand tied behind their backs while Google runs the game, sets the rules, and referees the match.
Example: Consider a news website that relies on advertising revenue. Under Chrome's cookie restrictions, it cannot use third-party cookies to retarget visitors who read an article about hiking gear. Google, meanwhile, can track that same user's searches for hiking boots, their YouTube views of trail reviews, and their Gmail conversations about an upcoming trip—then serve them ads across Search and YouTube with surgical precision. The news site is locked out. Google is all-access.
Key Takeaway: Google's exemption isn't just about privacy—it's about maintaining a competitive stranglehold on digital advertising by restricting what rivals can do while exempting itself from the same rules.
There's a cruel irony in the way Chrome presents its privacy controls. The settings screens suggest that blocking third-party cookies will stop unwanted tracking. Users who enable these settings believe they've taken meaningful action to protect their data. They haven't—at least not from Google.
A study from the University of Oxford found that Google's first-party cookies track users across 85% of the top 1 million websites, even when third-party cookies are blocked. How? Because Google's analytics, advertising scripts, and embedded services appear on countless sites. When you visit a site that uses Google Analytics, Google gets a first-party view of your behavior there—even though you're not on a Google-owned site.
The privacy paradox is this: users who take proactive steps to protect their privacy often feel safer without actually being safer. They've blocked third-party cookies, but Google's reach extends far beyond what those settings can contain.
Example: A user who has enabled "block third-party cookies" still sees eerily personalized ads on Google services. They search for a new laptop on Google, watch a review on YouTube, and suddenly every banner ad across Google's properties is about laptops. The user assumes they've done something wrong or that the blocking isn't working. In reality, the blocking is working exactly as designed—it just doesn't apply to Google itself.
Key Takeaway: Chrome's privacy settings create an illusion of control. Users who block third-party cookies are still tracked by Google across the vast majority of the web, undermining any sense of genuine privacy protection.
The UK's Competition and Markets Authority (CMA) has been investigating Google's Privacy Sandbox since 2021. The core concern: does Google's proposal to phase out third-party cookies actually level the playing field, or does it simply lock in Google's advantages under a new guise?
The CMA has pushed Google to make commitments. Google has agreed to various modifications, including giving third parties access to certain data and ensuring its own advertising systems don't get preferential treatment. But here's the sticking point: the exemption for Google's own sites has remained largely intact.
Regulators have nibbled around the edges. They've extracted concessions. They've demanded transparency. Yet the fundamental structure—where Google's properties are treated as first-party and therefore exempt from the restrictions imposed on everyone else—has survived multiple rounds of scrutiny.
The Financial Times reported that privacy advocates and competitors have repeatedly flagged this issue. The CMA has acknowledged concerns but has stopped short of requiring Google to treat its own domains the same way it treats third-party sites. Why? Because doing so would fundamentally disrupt how Google's services function. When you're logged into Gmail, Google needs to know who you are. The line between "necessary functionality" and "data collection advantage" is blurrier than regulators would like.
Example: In the UK, the CMA required Google to give third parties equal access to certain data within the Privacy Sandbox. But Google's own properties remained exempt from the cookie restrictions. Competitors argued this perpetuated the very distortion the CMA was supposed to address. The investigation continues, but the exemption remains a point of contention.
Key Takeaway: Regulatory scrutiny has produced concessions but not fundamental change. The CMA's investigation has been ongoing since 2021, yet Google's exemption for its own domains has survived multiple rounds of review.
In 2024, Google made a surprising announcement: it would not fully deprecate third-party cookies after all. Instead, users would be given a choice about whether to allow them.
This reversal was notable for several reasons. Google had spent years positioning the Privacy Sandbox as the future of web privacy. It had delayed the timeline multiple times. It had faced pushback from regulators, publishers, and advertisers. And then, rather than following through on its promise to eliminate third-party cookies, it punted.
Why? The exemption for Google's own sites is central to understanding this decision. If Google could maintain its data advantage through first-party access across its own ecosystem, why would it need to eliminate third-party cookies entirely? The cookie phase-out was always framed as a privacy initiative, but it also served Google's competitive interests by restricting what rivals could do. Once regulators and competitors began scrutinizing the details—including the exemption—the calculus changed.
By giving users a choice rather than eliminating third-party cookies outright, Google sidesteps the hardest questions. It can claim it's empowering users while maintaining its own first-party data collection. The exemption remains in place. The asymmetry persists. The only thing that changed is the framing.
Example: When Google announced it wouldn't fully deprecate third-party cookies, privacy advocates reacted with a mix of relief and suspicion. Relief that the web wouldn't become even more dependent on Google's infrastructure. Suspicion that Google was simply finding a way to preserve its advantages without the regulatory headache of a full deprecation.
Key Takeaway: Google's 2024 decision to abandon full third-party cookie deprecation doesn't resolve the exemption issue—it complicates it. Users get a choice, but Google's own data collection remains untouched.
The situation is frustrating, but it's not hopeless. You have options—they just require more effort than flipping a single switch in Chrome's settings.
First, use Google's separate privacy controls. Chrome's cookie settings are distinct from Google's account privacy settings. Visit myaccount.google.com and review what data Google collects. You can pause location history, limit ad personalization, and control what YouTube remembers. These settings won't stop all data collection, but they give you more control than Chrome's cookie options alone.
Second, consider alternative browsers. Firefox, Brave, and DuckDuckGo's browser all offer stronger privacy protections without Google's built-in exemptions. If you're serious about limiting Google's data collection, using a browser that isn't made by Google is the most direct solution.
Third, log out of Google services. When you're not logged in, Google can't tie your activity to a unified profile. This is inconvenient—you lose access to personalized features—but it significantly reduces what Google can learn about you.
Fourth, use incognito mode for sensitive browsing. Incognito doesn't make you invisible, but it does prevent your browsing history from being saved to your account. For sensitive searches—health questions, financial planning, personal concerns—this adds a layer of separation.
Fifth, diversify your tools. Use a different search engine (DuckDuckGo, Startpage, Brave Search). Use a different email provider for sensitive communications. Use a different browser for activities you want to keep separate from Google's ecosystem.
Finally, advocate for change. Support organizations pushing for stronger privacy regulation. Write to your representatives. Support the CMA's continued investigation. The exemption persists partly because the public doesn't know about it. Awareness is the first step toward accountability.
Key Takeaway: You can't fully escape Google's data collection while using its services, but you can significantly reduce it. Diversifying your tools and reviewing Google's separate privacy controls are the most effective steps you can take.
What does it mean that Chrome exempts Google from user site data settings?
It means Google's own domains—YouTube, Gmail, Search, and others—are treated as first-party sites. This allows Google to collect data on user activity across its properties even when users have enabled Chrome settings that block third-party cookies.
Is this exemption new?
No. It has been part of Chrome's design since cookie controls were introduced. However, it gained renewed attention as Google's third-party cookie phase-out approached and regulators began scrutinizing the details.
Why does Google need this exemption?
Google says it's necessary for core functionality and security, such as preventing fraud and ensuring smooth user experience. Privacy advocates argue it's primarily about preserving Google's data advantage.
Does this mean Google can track me even if I block third-party cookies?
Yes. Blocking third-party cookies doesn't stop Google from tracking your activity across its own properties. When you're logged into Google services, the company can build a unified profile of your behavior regardless of Chrome's cookie settings.
How does this affect competition?
Competitors can't track users across websites when third-party cookies are blocked, but Google can track users across its ecosystem without restriction. This gives Google a significant advantage in advertising targeting.
What has the UK's CMA said about this?
The CMA has been investigating Google's Privacy Sandbox since 2021 and has expressed concerns about potential competitive distortions. Google has made commitments to address some issues, but the exemption for its own domains remains.
Can I prevent Google from collecting my data?
You can reduce Google's data collection by using its separate privacy controls, logging out of Google services, using alternative browsers and search engines, and being mindful of what you access while logged in.
Is this related to the end of third-party cookies?
Yes. Google's 2024 decision not to fully deprecate third-party cookies complicates the issue. The exemption for Google's own sites remains in place regardless of what happens with third-party cookies.
What are the privacy implications for users?
Users who believe they're protected by Chrome's cookie settings are still tracked by Google across most of the web. This undermines user autonomy and creates a false sense of security.
What can regulators do about this?
Regulators could require Google to treat its own domains the same as third-party domains, mandate clearer disclosures about data collection, or impose structural remedies that separate Google's browser from its advertising business.
Google's exemption from Chrome's user site data settings isn't a technical footnote. It's a fundamental contradiction at the heart of the company's privacy promises. Google tells users they can control their data while quietly exempting itself from the very controls it provides.
The seven impacts we've explored—the scope of the exemption, its effect on competition, the illusion of privacy, the limits of regulation, the 2024 reversal, and your limited options for protection—paint a picture of a company that has mastered the art of appearing privacy-conscious while preserving its data empire.
You don't have to accept this passively. Review your Google privacy settings today. Consider diversifying your tools. Share this article to raise awareness. The exemption persists because most users don't know it exists. The more people understand how Chrome actually works—and who it works for—the harder it becomes for Google to maintain this double standard.
Your data is yours. It's time to act like it.