I’ve been hearing rumblings this week to the extent of “Firefox hates marketers and is coming for all of our data!”. This post, in particular, caught my attention, so the post that follows is my attempt to clear things up and, hopefully, lay some fears to rest.
In Mozilla’s announcement, they convey that “For new users who install and download Firefox for the first time, Enhanced Tracking Protection will automatically be set on by default as part of the ‘Standard’ setting in the browser and will block known ‘third-party tracking cookies’” according to the Disconnect list.”
Sounds like a scary development (pun intended) for people who rely on web analytics data for their careers and livelihoods. Before we go any further, let’s take a minute to break down browser cookies and the critical differences between first and third-party cookies.
A browser cookie is a tiny bit of data that is stored in your browser when you visit a website. This isn’t a post on Cookies 101, but suffice it to say that cookies are a vital component of modern web functionality and power everything from GA tracking to simple login functionality. There are two types of cookies to be aware of.
- First-party cookies are created and set in your browser’s storage by the site you’re visiting, and are scoped so that they can only be used on that domain. That means a first-party cookie created by upbuild.io will not come in to play on any site other than the website that created it.
- Third-party cookies are ones created and scoped in such a way that they can be used and can collect data at any point along your browsing journey. When you log into Facebook, a third-party cookie is set. It records which websites you visit, and when you return to Facebook, that third-party cookie tells Facebook’s ad system to show you those delightful reminders that “WE KNOW EVERY WEBSITE YOU’VE BEEN TO AND DON’T YOU WANT TO BUY THINGS FROM THEM?”
Google Analytics is built upon a foundation of first-party cookies. When you copy and paste the Google Analytics tracking snippet into your website’s source code, that script creates and sets a first-party cookie scoped to your domain only so that it can collect anonymous and aggregate data about how your website is being used.
However, Google also uses third-party cookies for their ad network/DoubleClick/remarketing and even for some specific features of Google Analytics, like demographic data collection. It’s these third-party cookies that are being blocked by default by the latest version of Firefox.
Blocking vs. Disallowing
As a brief aside, I’d wager to say that what Firefox is doing here shouldn’t even be considered “blocking” in the traditional sense. It blocks cookie setting, sure, but it doesn’t, in fact, block actual requests to specific servers and services. Many true advertising and tracking blockers (think uBlock Origin, AdBlock Plus, etc.), however, do indeed block any outgoing requests from your browser to specific sets of websites and/or servers. That’s not what Firefox is doing.
Firefox’s behavior — which, by the way, isn’t really all that new or novel — disallows the setting of third-party cookies. This means that an ad network such as Facebook’s or Google’s won’t be able to tell you from a hole in the ground as you make your journey around the web. You visit website A, then website B, then website C, and they have no idea who you are.
Verifying that Firefox Doesn’t Block GA Data Collection
You don’t need to trust me about any of this. You can test it yourself.
First, download the new version of Firefox — Firefox Quantum 67.
Now, open up a different browser (to ensure it’s an “uncontaminated” window). Let’s use Chrome; that way I can just say “in Chrome” vs. “in Firefox” rather than “Browser A” vs. “Browser B”.
Anyway, in Chrome, head to the Google Analytics Property > View for a website of your choosing. I’m going to use the one I have for mikearnesen.com, since it’s low traffic and one that I’m comfortable throwing test data at.
Head to the Realtime report by navigating to Realtime > Overview. If you’re lucky, you’ll see a big fat zero which is a great blank slate to start from.
Now go ahead and visit the website itself in a new Chrome Tab. I had to turn off uBlock Origin first (see the section above on Blocking vs. Disallowing), but once I did, my visit immediately showed up in the Realtime report. Google Chrome sends data to Google Analytics! Duh.
In Firefox, visit the same site. Since Firefox isn’t my primary browser, I’m working with a fresh, completely uncustomized install. The very first website I’m visiting is my testing ground: mikearnesen.com. Type the URL, hit enter, and boom! There I am as a second user in my Google Analytics Realtime report.
“But what if I don’t have GA access for a site as devoid of user activity as mikearnesen.com?”, I hear you saying. Well, here’s a more bulletproof way of going about it.
We can use campaign parameters (i.e., UTM codes). Here’s what I’m going to test with.
mikearnesen.com/?utm_campaign=tracking%20test&utm_medium=direct&utm_source=mike
Prior to the publication of this post, no one but me knew about this make-believe campaign so, of course, a visit coming from this UTM-tagged URL could only be me. It stands to reason that, even on a busy and high-traffic website, a user session appearing in Google Analytics with the campaign name “tracking test” could mean only one thing — the latest version of Firefox, unaltered and out of the box, does indeed send data to Google Analytics without any issue.
Well, look at that. I’m showing up in Realtime, but it’s not me beyond a shadow of a doubt. All I see is that there’s a visitor from my geographic area from “direct” with a source of “mike”.
Okay, well, that’s plainly my visit, but just to be doubly sure I’m going to head over to the Campaign report by navigating to Acquisition > Campaigns > All Campaigns. Once I adjust the date range to show today only (GA initially only shows you up until the last full day, i.e. yesterday, unless you modify the date range), my custom and completely unique campaign name is there. As clear as day.
A More Technical Verification of Google Analytics Cookie Setting & Tracking
In case there’s any lingering doubt, we can just look to see if cookies are allowed for mikearnesen.com. Note that this is where first-party GA cookies will be set (on the website that delivers and uses the website tracking functionality); there are other GA cookies, notably the blocked cookie you see for google-analytics.com in the screenshot below. However, this is unrelated to collecting the anonymized aggregated data we rely on as marketers; this is the third-party cookie used to collect demographic data, etc.
As a final step, we can go under the hood with Firefox and just check to see if the cookie is there or not. While in Firefox, hit Shift + F9 to bring up the Storage Inspector. This will let you see any cookies, local variables, caches, etc.. If you click on mikearnesen.com (or your own test domain) under cookies, we can see that the GA cookie has been successfully set.
What’s more, we can see when that cookie was created — Friday at 17:18 Greenwich Mean Time. To test the cookie’s persistence, I left the site, went to Google.com, then Twitter.com, and finally came back to my own site via Google Organic search. We can see that my cookie (above) was last accessed on Friday at 17:50 GMT, 32 minutes after it was created. Thus, we’ve established that the cookie can not only be set in the Firefox browser, but that it persists and won’t be wiped out immediately upon leaving the site and can, in fact, be accessed by Google Analytics at a later time to link multiple sessions from a single user together.
So What’s All the Fuss About?
You know those Twitter bio disclaimers some folks use to convey that “All opinions and statements are my own and do not represent those of {Employer}”? Mozilla employees might want to use those because I think our industry immediately read way too much into what certain Mozilla employees were saying in Tweets. During the backlash that followed Mozilla’s announcement of Enhanced Tracking Protection, a few Mozilla folks took to Twitter to argue against marketers’ assertions that the new behavior was overstepping and would hamstring analysts. This discussion added fuel to the fire and gave marketers something to point to and say, “See! Mozilla hates Google Analytics and all the good things we want to do with the data it gives us.”
Well, both sides were kind of right. Mozilla is making admirable moves to protect user privacy, and marketers deserve to have anonymous aggregated user data concerning website usage. Thing is, these aren’t mutually exclusive — but I think that fact was lost on all parties. Either the Mozilla folks actually didn’t understand that our collective concern was around the possibility of first-party GA cookies being blocked (which FF explicitly allows), or it might have been that each side in the debate was using similar terminology to talk about things that were completely different. A misunderstanding on the Internet?! You don’t say! 🙂
TL;DR
Mozilla is making admirable effort to protect user privacy and safeguard data. At the same time, marketers need and will continue to have access to Google Analytics data that is made possible through the magic of first-party cookies which are, in fact, not blocked by Firefox Quantum.
