A First Look at Cookies Having Independent Partitioned State

Abstract

The introduction of Cookies Having Independent Partitioned State (CHIPS) marks a significant step toward balancing user privacy with essential web functionalities. CHIPS isolates data within specific contexts, preventing cross-site tracking while maintaining the functionality of websites. However, the adoption of CHIPS in real-world web usage remains largely unexplored. In this paper, we investigate the state of CHIPS deployment, providing an overview of how CHIPS has been integrated into web ecosystems since its introduction. Leveraging the HTTP Archive dataset, we first find that the adoption of partitioned cookies remains slow, with most domains still relying on non-partitioned cookies, though a slight increase in both types is observed starting in early 2024, coinciding with Google’s phase-out of third-party cookies for 1% of users. This sudden onset of the third-party cookie phase-out has resulted in a haphazard way of adoption for some domains, which caused them to overlook important configuration requirements, resulting in improper settings due to limited awareness of the specific guidelines such as SameSite=None and Secure. In addition, we observe a positive signal for privacy as third-party trackers begin adopting partitioned cookies, with a noticeable increase starting in early 2024. However, as of September 2024, only a small number of trackers have fully transitioned to using partitioned cookies (up to 0.5% of tracking domains), while some continue to rely on both partitioned and non-partitioned cookies (up to 3.1% of tracking domains), highlighting that the shift is still in its early stages, especially for tracking domains. Finally, we observe stark asymmetry among the early adopter tracking domains: some have already added some partitioned cookies to all sites with a presence, while others, notably Google’s doubleclick.com has only deployed partitioned cookies to around 5% of pages where it is present.

Appendix

Table 1. List of tracking domains deploying partitioned cookies consistently over time. The red line represents domains that set only partitioned tracking cookies.

Table 1 details third-party tracking domains that consistently deploy partitioned cookies, categorized by their first observed appearance. The domains are organized by month, to showcase the development of CHIPS-using domains over time. Domains highlighted in red represent those that exclusively rely on partitioned cookies, underscoring a specific subset of trackers that have committed to this cookie technology alone. Early adopters, such as ladsp.com in December 2022, doubleclick.net in May 2023, and taboola.com in September 2023, demonstrate the initial, slow uptake of partitioned cookies. Notably, doubleclick.net, which belongs to Google, is still in the early phase of partitioned cookie adoption, as its cookies use both partitioned and non-partitioned types. From early 2024, some domains—highlighted in red, such as digitalthrottle.com and mmondi.com in March, and gayadnetwork.com in April were observed setting only partitioned cookies. However, as of September, no other trackers continue this trend.