Google rolling back Chrome’s cookie security measure in light of COVID-19

Abner Li | Apr 3 2020 - 12:58 pm PT

Last month, the Chrome team postponed the latest browser release to make sure the application remains stable as more people work from home. Google today announced that it’s temporarily rolling back SameSite cookie changes in Chrome due to COVID-19.

With version 80 in February, Chrome began enforcing secure-by-default handling of third-party cookies to limit tracking and increase privacy. The rollout has been gradual with close monitoring of the impact on the web. For more, read our explainer on the changes.

First-party cookies match the domain of the site you’re currently visiting. Chrome 80 is now restricting cookies to first-party access by default, with developers required to explicitly mark cookies for third-party usage.

Cookies with no declared SameSite value will be designated SameSite=Lax and restricted to first-party usage. Third-party cookies, like for logins, are only available if designated SameSite=None; Secure and sent over HTTPS.

Google announced today that it’s temporarily rolling back cookie enforcement in Chrome given the “extraordinary global circumstances” of COVID-19. It wants to ensure that online services — at a time of increased usage — remain stable.

While most of the web ecosystem was prepared for this change, we want to ensure stability for websites providing essential services including banking, online groceries, government services and healthcare that facilitate our daily life during this time. As we roll back enforcement, organizations, users and sites should see no disruption.

These Chrome measures will be re-implemented over the summer, with Google providing advance notice before any changes.