> Are third party cookies a good thing?

Theoretically yes, they are intended to hold some piece of state that is relevant to or derived from your usage and that's not bad by itself. Third-parties aren't always ads either, you might embed maps or AI or countless other things that can use this.

In practice, they have been abused for tracking very widely and they support all these other uses so much that we expanded this idea to include local storage, session storage, indexed storage etc.

It depends on your POV. Privacy advocates would argue no, but basically all the major players (google, websites, and the rest of the ad ecosystem) except for truly independent web browser developers (of which... I don't know if there are any) want them because they're what makes ad targeting work.

Safari disables third party cookies, but I didn't call them independent because they have their own ad ecosystem (so of course they want to nerf web ads).

The interesting part to me is that you did not list consumers/individuals among your list of “all the major players” involved.

I would categorize them as either apathetic (almost all of them) or the privacy advocates.

My opinion: No, definitely not, regardless of whether or not what they said is true. What they suggest, however, is a strong argument for not allowing the same company to be both an ad-tech leader and the dominant browser vendor, because it gives them severe conflicts of interest in either direction. I don't know what we can or should actually do about this, but it's pretty obvious that it can't really work.

IMO the fact that any discerning user can easily browse the web without them by using Safari or otherwise disabling 3PC’s makes them pretty benign. I think the intense focus on them is a distraction from the much, much, worse instances of privacy violations being carried out by e.g. ISP’s selling PII-level location data to bounty hunters.

Also browser fingerprinting, as a way to prevent people from resetting things by clearing cookies and/or maintaining separate profiles.

Third-party cookies, as a naive identifier on their own, are comparatively straightforward and controllable. It's all the other tricks around them that make it worrisome.

Third-party cookies are not intrinsically good or bad, much like a hammer, or a knife, or a can of spray paint. is not good or bad. It's a tool. All depends on how people use it. And third-party cookies very certainly have a high potential for abuse, and are being abused heavily.

Lets say you have a corporate app that serves thousands of internal users that has its backend hosted on a separate webserver. This app can implement super simple auth by having the backend query the company's AD server to prove identity, then fetch what is allowed to be viewed and store the session in a third party cookie.

An app like this is probably not ideal for outward facing sites but I have seen apps like this serve its purpose very well as an internal app and the simplicity allows it to have less tech overhead.

This can be accomplished without third party cookies.

https://learn.microsoft.com/en-us/entra/identity-platform/v2...

> This can be accomplished without third party cookies [by using OAuth2].

You seem to have missed these important parts of the statement:

> This app can implement super simple auth...

> ...the simplicity allows it to have less tech overhead.

OAuth is not simple, and for something entirely internal, simple is fine.

It depends on your POV. Privacy advocates would argue no, but basically all the major players (google, websites, and the rest of the ad ecosystem) except for truly independent web browser developers (of which... I don't know if there are any) want them because they're what makes ad targeting work.