I'm not sure I understand. In the year 2000, we let any domain get access to it's cookie. In this proposal, an entity can let domains it controls have access to a shared cookie, all others are still blocked. But fair point: if I am allowed to say that I have a "relationship" with eviltracker.com, then they could get the shared cookie... But it's easy to add requirements like ownership vs partnership, or purpose-based access, or other enhancements.

So, not really as bad as you suggest, but true, some problem cases can arise.

> But it's easy to add requirements like ownership vs partnership

Ah, yes. "Easy".

How exactly do you envision that?

- Is ownership/partnership info easily and immediately accessible?

- Who is going to verify ownership/partnership info?

- How is that applicable to First Party Sets?

- LVMH owns at least 75 different brands. Even though it owns them, for all intents and purposes these are different legal entities and (especially under GDPR, CCPA and any other privacy law in existence) they cannot be treated as a single entity.

- amazon.com and amazon.de are two separate legal entities with wildly different privacy requirements. Same goes to subdivisions in each of the 75 brands I mentioned for LVMH.

and so on.

Yes. Easy.

And google hosting everything under a google.com domain wouldn’t?

But they don't and it wouldn't be an easy step.

Huh? Amazon put prime under amazon.com. The domain doesn't mean you have to use the same servers, google already just proxy and load balances behind their existing domains. They could easily redirect youtube.com to yt.google.com, or serve assets on youtube.com from yt.google.com if they want to have cross domain tracking.