Google has released<\/a> a new feature, First-Party Mode<\/strong> (FPM), into public beta.<\/p>\n <\/p>\n <\/a><\/p>\n<\/div>\n Image source<\/em><\/a><\/p>\n First-Party Mode seeks to make it easier to wrap Google\u2019s measurement and advertising technologies in a first-party, same-origin<\/em> context.<\/p>\n This means that the user\u2019s browser, when visiting a website running FPM, would no longer communicate directly with Google\u2019s domains when fetching measurement libraries such as Google Tag<\/strong> or Google Tag Manager<\/strong>.<\/p>\n Instead, the requests would be sent to a subfolder<\/strong> of the website itself. A server process would then take these requests, forward them to Google\u2019s servers, and finally return the response (typically a JavaScript file) back to the web browser.<\/p>\n This would also apply to analytics and advertising pings.<\/p>\n Here\u2019s the distinction:<\/p>\n With First-Party Mode services, (3) above, the browser only ever communicates with the domain of the website. Read on to understand why this can be significant.<\/p>\n This article is an overview of First-Party Mode, as well as a discussion starter on the (relative) benefits and (potential) risks involved.<\/p>\n If you want to jump over the technical stuff and go straight to my thoughts on the matter, follow this link<\/a>.<\/p>\n \n \n Subscribe to the Simmer newsletter<\/a> to get the latest news and content from Simo Ahava into your email inbox!\n <\/p>\n <\/span><\/p>\n With First-Party Mode, the website reserves a subfolder<\/strong> like For FPM to work, the website infrastructure itself should support rerouting specific requests and modifying their request headers.<\/p>\n This infrastructure could comprise a load balancer<\/a>, a CDN<\/a>, an edge service<\/a>, or a proxy server<\/a>, for example.<\/p>\n <\/p>\n <\/a><\/p>\n<\/div>\n This technology is then configured to route requests collected at a specific path (e.g. Google receives the request, processes it, and finally returns a response back to the browser using the same channel.<\/p>\n If you\u2019ve been using server-side Google Tag Manager<\/a>, you\u2019ll know that you have already had the capability to do something like this.<\/p>\n Loading Google dependencies<\/a> from your own server is baked into the application, and if you\u2019ve deployed with a same-origin setup<\/a>, you already have \u201cfirst-party mode\u201d in use.<\/p>\n <\/p>\n <\/a><\/p>\n<\/div>\n However, server-side GTM is a fully-fledged application service<\/strong> that is designed to do powerful data pipeline tasks. It\u2019s not necessarily best suited for transporting potentially large scripts and files. That\u2019s what a dedicated content distribution network (CDN) service is for.<\/p>\n You can actually combine<\/strong> First-Party Mode and server-side Google Tag Manager. Set up FPM for library requests, and use the <\/p>\n <\/a><\/p>\n<\/div>\n It\u2019s a pretty smooth setup. If you configure the Google Tag Manager web container<\/strong> to load through FPM, then any subsequent Google Tag library loads (Google Analytics 4, Google Ads, for example), will automatically<\/strong> load through FPM, too.<\/p>\n Google has detailed instructions for setting up FPM using Google Cloud load balancing<\/a> or Cloudflare<\/a>.<\/p>\n Note!<\/strong> If you want to use Cloudflare, you need an expensive Enterprise<\/strong> subscription to manage this setup.<\/p>\n<\/blockquote>\n Remember that the main requirement is that your website domain<\/strong> points to this service, too.<\/p>\n It\u2019s not enough to set up a load balancer just<\/em> for First-Party Mode. All of your website traffic needs to flow through this entry point \u2013\u00a0the routing rules then redirect the subfolder traffic to the Google host.<\/p>\n If your site uses some other CDN or load balancer than Google Cloud or Cloudflare, you can follow the steps outlined in the documentation<\/a>.<\/p>\n To test the setup, browse to <\/p>\n <\/a><\/p>\n<\/div>\n Advertisers, businesses, data companies, brokers, publishers, and hobby websites alike are facing data loss and quality degradation like never before.<\/p>\n Content Security Policies<\/a>, browser tracking protections<\/a>, and ad (and content) blockers all target third-party<\/em> services in an attempt to squash the data collection free-for-all that\u2019s been rampant over the past decades.<\/p>\n This is why First-Party Mode (and similar technologies) might sound tempting.<\/p>\n First of all, routing traffic through an upstream service point that you control<\/strong> is potentially a huge net positive for your compliance and data validation practices.<\/p>\n This is my<\/em> main justification for server-side tagging<\/strong> \u2013 it gives you an incredible amount of control to prevent data-hungry vendors from leeching data from the user without restriction.<\/p>\n FPM gives control, too, but not to this extent. Many CDNs and Load Balancers allow you to remove information from the forwarded request, such as the user\u2019s original IP address<\/a>.<\/p>\n Dropping the user\u2019s IP address is particularly important if using Google\u2019s Advanced Consent Mode<\/a>, as the IP address is considered personal data in the European Union.<\/p>\n <\/p>\n <\/a><\/p>\n<\/div>\n But that\u2019s about it \u2013 they don\u2019t let you selectively strip personal data from the request, and doing conditional blocking when the request lacks consent signals might be difficult to do.<\/p>\n So while FPM does give you some<\/em> control, it\u2019s not the same as a fully-fledged application service like server-side Google Tag Manager.<\/p>\n There\u2019s also a big risk<\/strong> involved with forwarding all<\/em> cookies to the Google host. There\u2019s a lot<\/em> of information stored in browser cookies that a third party should not have access to, ranging from the innocuous but privacy-sensitive (e.g. vendor IDs) to data security risks (e.g. incorrectly stored authentication tokens).<\/p>\n I received word from Google that they already have internal filters in place, automatically dropping non-Google cookies from the data that is processed. They are working on making this more transparent to users and audit trails.<\/p>\n<\/blockquote>\n First-Party Mode addresses the \u201cproblem\u201d (see below<\/a> why I put this word in quotes) of data loss<\/strong> due to ad blockers<\/strong>. Many ad blockers still rely on blocklists that have domain-matching<\/strong> patterns as their main heuristic.<\/p>\n Google\u2019s domains are invariably<\/em> in these blocklists, as they are so deeply entrenched in the world of advertising technologies.<\/p>\n Since the browser no longer communicates with Google\u2019s domains directly, ad blockers have a tougher time blocking these requests.<\/p>\n However<\/em>, ad blockers aren\u2019t stupid. Some lists evolve at a glacial pace, but others are quicker to make a note of domain masking<\/em> as a blocker workaround.<\/p>\n For example, EasyPrivacy<\/a> looks at paths (\/gtm.js<\/em>) and even query parameters (.js?id=GTM-<\/em>) to determine blockable requests.<\/p>\n <\/p>\n <\/a><\/p>\n<\/div>\n In this case, just switching the domain from Unless your first-party serving completely obfuscates the request path and query parameters so that they no longer resemble the original, ad blockers will<\/em> catch up sooner rather than later.<\/p>\n Another \u201cbenefit\u201d that FPM introduces is a lifeline for first-party cookies<\/em> whose expiration the WebKit browser engine has tried to cap<\/a>. WebKit runs the Safari browser and (still) many iOS and iPadOS browser apps.<\/p>\n <\/p>\n <\/a><\/p>\n<\/div>\n With First-Party Mode, the tracking requests share the exact same domain<\/strong> as the website itself. They are, in fact, same-origin<\/strong> requests relative to the website. This means that WebKit\u2019s tracking protections do not apply<\/em>, as they require at least a whiff<\/em> of third-party in the request chain.<\/p>\n FPM moves the logic of data transfer (between the user and Google) from the browser to the web server, and web browsers do not have visibility to what goes on in the server.<\/p>\n Yet another benefit of First-Party Mode: by communicating with the website instead of with Google\u2019s domains, the Content Security Policy (CSP) of the website can be made stricter.<\/p>\n This is because origins like While a stricter CSP is definitely a good thing, this benefit can be considered largely superficial.<\/p>\n Even though the browser no longer communicates with Google\u2019s services directly, it still ends up loading them \u2013\u00a0just via the website\u2019s domain rather than Google\u2019s CDN. So while cross-site scripting (XSS)<\/a> risks are mitigated, the issue of loading unreliable content is largely left unaddressed.<\/p>\n This means that if the purpose of the CSP is to prevent potentially harmful scripts from being loaded in the browser, FPM doesn\u2019t really change this risk profile at all. The scripts are still loaded, just through a more obscure pathway than before.<\/p>\n Many discussions around First-Party Mode revolve around misunderstandings and knee-jerk reactions. I\u2019m often guilty of these, too.<\/p>\n Here\u2019s my attempt to address some of these comments that have been circulating online<\/a>.<\/p>\n A subdomain<\/strong> setup such as that often used with server-side Google Tag Manager is much easier to configure than a subfolder<\/strong> setup.<\/p>\n This is because a subdomain can be mapped with just DNS \u2013 the website itself can use a completely different technology stack.<\/p>\n A subfolder<\/em> needs the website itself to be running through the same service that does the routing. You can\u2019t configure DNS for a subfolder \u2013 the \u201cD\u201d in DNS stands for \u201cDomain\u201d.<\/p>\n A subdomain is same-site<\/em> and cross-origin<\/em>. A subfolder is same-site<\/em> and same-origin<\/em>. This is the main distinction.<\/p>\n This is not new technology. Reverse proxies have existed for ages, and the aforementioned server-side Google Tag Manager<\/strong> has supported first-party serving for years.<\/p>\n Similarly, it\u2019s been trivial to configure transparent request forwarding with Cloudflare Workers<\/a>.<\/p>\n First-Party Mode wasn\u2019t introduced as a novelty<\/strong> or a game-changing technology paradigm<\/strong>. Google released FPM to make it easier<\/strong> to configure first-party serving without having to invest in more complicated (and expensive) tech like server-side Google Tag Manager.<\/p>\n Google\u2019s goal is to level the playing field for all their customers, not just those who have the resources to build complicated machinery for data pipelines.<\/p>\n Even though FPM is out of reach for many of Google\u2019s customers due to lack of access to the kind of technology that request routing requires, it\u2019s likely that they will add even more support for different hosting and CMS systems in the future.<\/p>\n Using FPM to get longer cookie lifetimes in WebKit browsers is, for lack of a better expression, totally lame<\/strong>. It\u2019s boring. It\u2019s unreliable. It lacks vision. It\u2019s a waste of time and money. It can even be downright risky.<\/p>\n Why unreliable? Well, WebKit has been known to make bold moves<\/a>. If WebKit notices that a significant number of sites are circumventing their CNAME cloaking mitigation with a same-origin workaround, they\u2019ll do something about this.<\/p>\n However, what<\/em> they can do about it remains unclear. As it\u2019s same-origin, the browser can\u2019t distinguish between tracking requests and \u201cnormal\u201d website requests, at least on the DNS level.<\/p>\n WebKit would need to start doing pattern matching against a list of known tracking patterns, perhaps using Tracker Radar<\/a> as they already do in private browsing mode.<\/p>\n <\/p>\n <\/a><\/p>\n<\/div>\n But this would be trivial to circumvent by encoding the path and query string patterns and decoding them before the request is routed.<\/p>\n If I had to place my bets on a bold<\/em> move, I\u2019d imagine WebKit would shift towards capping all<\/strong> first-party storage access without exception<\/strong>. This would certainly prevent workarounds.<\/p>\n Or perhaps as a compromise they\u2019ll revitalize the discussion around the isLoggedIn API<\/a>, allowing some<\/em> first-party storage access, if it can be proved that the user is logged in to the website.<\/p>\n If using FPM to circumvent WebKit\u2019s protections is lame, then using first-party setups to circumvent ad blockers is even more so. It\u2019s also ethically questionable.<\/p>\n Users have the right to block whatever resources they like<\/strong>. It\u2019s their browser. It\u2019s their agency. Some users might use ad blockers to prevent data harvesting, some might use them for data security, and some might use blockers to enjoy a faster browsing experience. It\u2019s their right, and you can never know what the user\u2019s motivation for using a blocker was.<\/p>\n If you want to start a debate with me about an advertising-fuelled open web being at risk, then take it elsewhere. Recalibrate your argument to be about the broken state of ad tech<\/strong> rather than about users taking back control.<\/p>\n<\/blockquote>\n There\u2019s also a tangible risk with a same-origin setup. Ad blockers might flag your website domain<\/strong> as a tracking domain if it\u2019s prominent enough and if it clearly and visibly circumvents ad blockers with a same-origin workaround.<\/p>\n It wouldn\u2019t be nice to have your website blocked globally.<\/p>\n From a legal or regulatory point-of-view, at least in the European Union, FPM doesn\u2019t really change anything.<\/p>\n You still<\/em> need a legal basis to process the user\u2019s personal data (GDPR). You still<\/em> need consent to access storage on the user\u2019s device (ePrivacy Directive).<\/p>\n First-Party Mode is about organizing the technology stack of the website to act as an upstream router for marketing signals. Vendors still end up receiving the same data they would receive without FPM in use. The compliance requirements, the applicable legal frameworks, the responsibilities of involved parties \u2013\u00a0they all remain the same.<\/p>\n First-Party Mode is quite obviously a first step in a more comprehensive collection pipeline overhaul that Google is planning. What the next steps are remains uncertain, but it\u2019s clear this isn\u2019t the last we\u2019ll hear about FPM.<\/p>\n In its current shape, it\u2019s still out of reach for many of Google\u2019s customers. Same as a same-origin setup for server-side Google Tag Manager<\/a>, it requires a certain type of website infrastructure to already be in place.<\/p>\n Not all websites are hosted on (or behind) a service that allows you to create additional routing and origin rules.<\/p>\n As such, it\u2019s an interesting proposition by Google. It\u2019s also quite a bit of work (and potentially expensive) for just a few benefits.<\/p>\n![\"First-party](\"https:\/\/www.simoahava.com\/images\/2024\/07\/first-party-mode-diagram.jpg#ZgotmplZ\")
<\/p>\n\n
https:\/\/www.simoahava.com\/<\/code>; requests are sent to https:\/\/www.googletagmanager.com\/<\/code>.<\/li>\nhttps:\/\/www.simoahava.com\/<\/code>; requests are sent to https:\/\/sst.simoahava.com\/<\/code>.<\/li>\nhttps:\/\/www.simoahava.com\/<\/code>; requests are sent to https:\/\/www.simoahava.com\/metrics\/<\/code>.<\/li>\n<\/ol>\n
\n X<\/span><\/p>\n
\n The Simmer Newsletter<\/strong>\n <\/p>\nHow does it work?<\/h2>\n
\/metrics<\/code> that is not used for any other purpose<\/em> (this is important!).<\/p>\n![\"Routing](\"https:\/\/www.simoahava.com\/images\/2024\/07\/routing-rules.jpg#ZgotmplZ\")
<\/p>\n\/metrics<\/code>) to a Google host reserved for the tagging container of the website.<\/p>\nServer-side Google Tag Manager<\/h3>\n
![\"GTM](\"https:\/\/www.simoahava.com\/images\/2024\/07\/gtm-client.jpg#ZgotmplZ\")
<\/p>\nserver_container_url<\/code> field in Google Tag<\/a> to collect analytics and measurement pings to server-side GTM.<\/p>\n![\"SGTM](\"https:\/\/www.simoahava.com\/images\/2024\/07\/s-gtm-setup.jpg#ZgotmplZ\")
<\/p>\nHow to set it up<\/h3>\n
\n
\n
Host<\/code> header to be equal to \/metrics<\/code> traffic to this backend.<\/li>\nhttps:\/\/www.yoursite.com\/metrics\/<\/code> rather than from Google\u2019s domain.<\/li>\n<\/ol>\nhttps:\/\/www.yoursite.com\/metrics\/healthy<\/code>. If the page shows the text ok<\/code>, it means that First-Party Mode is working.<\/p>\n![\"Healthy](\"https:\/\/www.simoahava.com\/images\/2024\/07\/healthy-response.jpg#ZgotmplZ\")
<\/p>\nSo, what\u2019s the point?<\/h2>\n
Additional layer of control<\/h3>\n
![\"Cloudflare](\"https:\/\/www.simoahava.com\/images\/2024\/07\/cloudflare-transform.jpg#ZgotmplZ\")
<\/p>\n\n
Circumvent ad blockers<\/h3>\n
![\"EasyPrivacy\"\/](\"https:\/\/www.simoahava.com\/images\/2024\/07\/easyprivacy.jpg#ZgotmplZ\")
<\/p>\nhttps:\/\/www.googletagmanager.com\/<\/code> to https:\/\/www.yoursite.com\/<\/code> isn\u2019t enough, because the request path<\/em> and query string<\/em> is still matched by the blocklist.<\/p>\nWebKit\u2019s first-party cookie expiration<\/h3>\n
![\"WebKit](\"https:\/\/www.simoahava.com\/images\/2024\/07\/webkit-protections.jpg#ZgotmplZ\")
<\/p>\nContent Security Policy<\/h3>\n
https:\/\/www.googletagmanager.com<\/code> can now be added to the CSP, as the browser no longer needs to send data to them.<\/p>\nSame-site vs. same-origin<\/h3>\n
This has been done before<\/h3>\n
Cat and mouse game<\/h3>\n
![\"Privacy](\"https:\/\/www.simoahava.com\/images\/2024\/07\/privacy-report.jpg#ZgotmplZ\")
<\/p>\nAd blocker heuristics<\/h3>\n
\n
Legal and regulatory context<\/h3>\n
My summary review of First-Party Mode<\/h2>\n