With testing of Google’s cookie-free ad platform underway on Chrome web browsers, some ad tech companies worry that rivals outside of the tests can still sneak their hands into the data cookie jar through alternative ad IDs. The concern is coming from demand-side platforms, which are trying Google’s new data-restricting platform to serve ads through Chrome, while some ad tech players use other data sources—such as IP addresses—from outside Google’s box to buy ads, which could skew the tests. Meanwhile, publishers are on the other side of the ad transaction, deploying ad IDs to maintain the value of their inventory on Chrome, offering diverging paths to the post-cookie web.

The issue was raised by Lukasz Wlodarczyk, VP of programmatic ecosystem growth and innovation at RTB House, which is trying Google’s Privacy Sandbox, the post-cookie ad platform. There is a debate about the cookieless future in internet advertising: Is the answer in Google’s sealed browser or IDs that still track IP addresses and similar web data? The IDs operate separately from Google’s Privacy Sandbox, by sharing data between publishers and ad tech companies. Privacy Sandbox participants are restricted to the information that comes through the Chrome browser, which hides consumers behind encryption and within groups that can’t be traced to an individual.

Also read: A guide to Google’s post-cookie ad tech

The IDs use tactics, such as “fingerprinting,” where they piece together data such as IP addresses, emails, location and timestamps to make an educated guess about the consumer, according to Wlodarczyk.

“The impact of solutions based on user graphs and deterministic fingerprints is definitely affecting the testing of solutions using privacy sandbox APIs,” Wlodarczyk said. “A test of 1% of traffic on the Chrome browser will expose the lack of a level playing field between providers using privacy-preserving targeting methods and those employing risky practices from the standpoint of user privacy and on the edge of legal compliance.”

Here is the crux of the dilemma: Last month, Google’s Chrome team officially launched the Privacy Sandbox tests by turning off cookies on 1% of traffic. Ad tech companies, such as RTB House, are testing Google’s APIs—application programming interfaces—that enable the auctions on cookieless traffic. But there are multiple market participants, not in Privacy Sandbox, that deploy alternative advertising identifiers—companies such as LiveRamp, Lotame and ID5. The alternative IDs have their own relationships with publishers to request permission from site visitors to collect and share data.

If some advertisers use the IDs and then bid on cookieless ad inventory on Chrome, that could alter the utility of the tests, Wlodarczyk said.

It’s a highly technical distinction between the ad tech companies inside Privacy Sandbox and those outside of it, but it speaks to a wider rift between Google and other parts of the industry. Google has said that it wants to move beyond identifiers that track consumers across the web, and it has plans to restrict how IP addresses get shared from Chrome, but that change won’t come until 2025. Google plans to deprecate 100% of cookies on Chrome by the end of this year, meaning alternative IDs and other solutions have time.

“The reality is advertisers are going to use a combination of signals and operate on cookies and IDs as long as they can,” said Eli Heath, head of identity at Lotame, a customer data management and identity firm. Lotame is not testing Privacy Sandbox and it works with publishers on alternative IDs.

Google did not immediately return a request for comment for this story.

Google could hit its mark to restrict IP addresses in 2025, but there are other tools publishers use to share signals through Google Ad Manager, Heath said, so long as the data is collected with consent and is treated like first-party data.

RTB House is right, though, “to really validate and really get an understanding of the efficacy of Sandbox you have to have a true baseline,” Heath said. But publishers are keeping ad IDs and other data sources in order to have a multi-layered approach to post-cookie advertising, Heath said.

The ad IDs have already been developed since Apple started killing cookies on Safari web browsers in 2017. Google’s Chrome is viewed as an even bigger change within the industry, because it accounts for more than 60% of browsers worldwide. Also, Privacy Sandbox is a complete retooling of ad tech, whereas Apple just ditched cookies, paving the way for IDs to act as an easy substitute. Many publishers have seen a decrease in ad value on Safari, but IDs have helped limit the fallout, according to ad tech leaders.

One of the drawbacks of Privacy Sandbox is that the participants can’t see which publishers are using IDs, Wlodarczyk of RTB House said. “It’s very difficult to identify the companies that do this and when they realistically impact the results of conducted auctions,” Wlodarczyk said. “That’s why it’s so important to introduce methods that … directly address the limitation of browser signals enabling these tracking and ad targeting techniques.”

Not everyone is concerned about the dynamics in Privacy Sandbox, saying it’s still too early to expect Google to implement every condition that advertisers will face once it deprecates all cookies.

It’s unrealistic to say, “In order to properly test the Privacy Sandbox in its entirety, the whole sandbox needs to be released and in use by the ecosystem, which is a very high bar,” said one ad tech expert from a third-party demand-side partner, who spoke on condition of anonymity because they were not authorized to discuss the tests publicly.