CMA secures final Privacy Sandbox commitments from Google: blog by Will Hayter

We have now accepted legally binding commitments from Google on its plans to remove third-party cookies from Chrome and replace them with alternative ‘Privacy Sandbox’ tools. Our decision is a significant milestone, but in many ways marks the start, rather than the end of our work.

We now have the important job of implementing the commitments and overseeing Google’s development of its Privacy Sandbox initiative. To make sure that these changes benefit consumers through greater competition, choice and protection of privacy, we need to do this in an open and transparent way. We will also draw on the knowledge and views of market participants and other experts.?

Addressing our concerns

An important part of making sure the digital advertising ecosystem works in everyone’s interests involves increasing consumers’ control over their data.

Google’s stated aim in developing the Privacy Sandbox is to address concerns about privacy impacts of tracking users through third-party cookies. These are commonly used in digital advertising to target users and measure ad effectiveness.

While these may be legitimate objectives, Google must not use them as a smokescreen for anti-competitive behaviour. Google has a strong position as the biggest provider of digital advertising services and through its Chrome browser.

Google is still designing and testing the different Privacy Sandbox tools, so the market impacts will depend on:

• how these tools are designed
• which additional measures are implemented to mitigate any remaining concerns

This is reflected in the forward-looking design of the commitments.

The commitments

Google has committed to include us in the development of the Privacy Sandbox tools, including through close involvement in Google’s planned testing programme to evaluate the likely impacts on consumers and competition. The commitments give us formal levers to make sure this works well, including to:

• raise concerns and issues with Google and require Google to respond
• require Google to publish regular updates and respond to concerns raised by market participants

We are also working closely with the Information Commissioner’s Office (ICO) to inform our assessment of the likely privacy impacts of Google’s proposed new tools.

Third-party cookies will only be removed from Chrome following a standstill period: once Google has demonstrated to us that the Privacy Sandbox changes are in consumers’ interests, protecting both competition and privacy. If we’re not satisfied that Google has demonstrated its proposals will be effective, we can intervene to prevent them from happening.

Finally, the commitments ensure that changes through the Privacy Sandbox won’t reinforce Google’s market power. These commitments prevent Google from using its first-party user data to enable its advertising businesses to continue tracking users after removing third-party cookies. They also require Google not to use Chrome in a way that discriminates in favour of its own advertising services.

To ensure compliance, we’re working with Google to appoint a Monitoring Trustee which we will announce shortly. In doing so we are taking account of consultation respondents’ views on the knowledge, skills and capabilities required to carry out the role. The Monitoring Trustee will provide us with quarterly reports on Google’s compliance with its commitments.

Implementing the commitments: involving third parties

A key theme across the commitments is transparency and openness in developing and assessing the Privacy Sandbox tools. We encourage market participants and other interested parties to share their ideas and concerns with us, so we can draw on the widest possible range of external expertise in scrutinising Google’s proposals.

Under the commitments, Google must demonstrate how it has taken account of stakeholder views through detailed reporting. Find more information on how Google will engage with third parties.

Alongside the commitments, we intend to:

• publish regular updates setting out how the commitments have been implemented
• provide updates on the testing of different Privacy Sandbox tools, and how Google has responded to the concerns that have been raised
• be as transparent as possible in involving third parties in assessing the Privacy Sandbox changes
• bring in external expertise to help scrutinise Google’s proposals
• speak regularly to our international counterparts, as Google intends to apply the commitments globally

Next steps

Interested parties can contact us by email at [email protected].

Further information and updates will be published regularly on our Investigation into Google’s ‘Privacy Sandbox’ browser changes case page.

The commitments which we’ve accepted from Google show that we will take action to tackle competition issues raised by the big tech firms, and that we’re willing to do this in an innovative way.

Our involvement in supervising the development and implementation of Google’s Privacy Sandbox is an ideal opportunity to test the way that we want our Digital Markets Unit (DMU) to run. We are keen to adopt a collaborative and inclusive approach, engaging with tech firms as well as consumers on an ongoing basis. We look forward to receiving your input as we continue our work.??????????