Google’s Privacy Sandbox commitments: Implementation and what comes next

Written by Chris Jenkins and Angela Nissyrios

We have published our?latest quarterly update?on the implementation of 谷歌 ’s Privacy Sandbox commitments.

Google plans to remove third-party cookies from its Chrome browser and replace them with new Privacy Sandbox tools.

These changes aim to reduce the sharing of personal data in the online advertising ecosystem. We welcome efforts to improve privacy where this would benefit consumers. However, the changes need to be made in a way which does not lead to a competitive advantage for Google.

Working with the Information Commissioner’s Office (ICO) we accepted commitments from Google in February 2022, creating a legally-binding framework to address our competition concerns.

Key features of the commitments:

• more transparency in the process of developing the Privacy Sandbox tools, with Google required to respond to market participants’ concerns
• a set of criteria for assessing the effectiveness of Google’s proposed changes, taking account of impacts on competition, publishers, advertisers and user privacy
• the CMA and the ICO working with Google to assess impacts and resolve concerns as the Privacy Sandbox tools are being developed, including through testing and trialling
• a standstill period before third-party cookies are removed, allowing the CMA to take further action if concerns remain
• ongoing commitments by Google not to design or implement the Privacy Sandbox in a way that favours its own activities, and not to use certain data – including Chrome browser data – in its advertising businesses. These obligations will continue to apply after third-party cookies have been removed and will remain in place until 2028

What have we achieved so far?

Since we accepted the commitments in February 2022, we have focused on three main priorities.

Scrutinising design

We have scrutinised the design of Google’s Privacy Sandbox tools and likely market impacts.?A key priority is engaging with market participants to understand their concerns – we have spoken to more than 40 firms and stakeholder groups, and highlighted issues they have raised with us to Google.

We have published regular quarterly update reports from Google , summarising stakeholder feedback and how this has been reflected in the Privacy Sandbox design. For example:

• Google is exploring ways of increasing the usefulness of the Topics API for supporting Interest Based Advertising
• Google has amended its approach to First Party Sets in response to feedback that smaller third parties might be disadvantaged
• we have required Google to monitor and publicly report on the impacts of User Agent Reduction, including effects on latency for third party ad techs

Testing and trialling

We have been developing a framework for assessing the likely impacts of the Privacy Sandbox changes including through testing and trialling the new tools before third-party cookies are removed.

In November last year, we published a summary of our proposed approach for Google?and third parties to test the impact of the Privacy Sandbox through experiments.??

Since then we have been working with Google on its own tests of the Privacy Sandbox tools (for example the recent test of the Topics API) and speaking to third parties who have started testing.

Monitoring compliance

We are monitoring Google’s compliance with its obligation not to design or operate Chrome in a way that favours its own activities, and Google’s approach to the restrictions on use of data within Google’s ecosystem which will take effect once third-party cookies are removed.

These parts of the commitments are overseen by an independent Monitoring Trustee, ING Bank, supported by a Technical Expert, S-RM.

We receive quarterly reports from the Monitoring Trustee and have been working closely with them throughout the period to ensure there are robust compliance processes in place.

What comes next?

Google plans to remove third-party cookies from Chrome in the second half of 2024. We do not want to see the deadline extended further, provided competition concerns are addressed.

We are aware that uncertainty over the timetable can deter investment by publishers and other market participants, not just in integrating the Privacy Sandbox tools but also in developing other alternatives to third-party cookies.

Participating in tests

The main Privacy Sandbox tools, including Topics, FLEDGE (now Protected Audience API), and the Attribution Reporting APIs are due to move to General Availability in the summer.

Between then and the middle of 2024, Google will carry out tests of the impacts of the Privacy Sandbox tools, working closely with us and the ICO.

We will also take account of tests carried out by other market participants.?We are keen to encourage firms to test the Privacy Sandbox tools and alternative technologies so that we can assess wider market impacts.

We are not planning a single, industry-wide test. Instead, we want to facilitate testing environments and provide guidance on metrics that are relevant to us.

We will publish further details on testing approaches over the coming months. In the meantime we encourage firms not to delay testing, and to get in touch if they would like to discuss their plans with us.

Gathering views

Alongside this testing work, Google will need to demonstrate the effectiveness of its Privacy Sandbox against the criteria set out in the commitments.

We will continue to gather views and evidence from market participants. The aim will be both to address concerns at the design stage, and build evidence of likely impacts of the removal of third-party cookies before the standstill period.

Ongoing monitoring

Finally, we will be continuing to work with the Monitoring Trustee to ensure that there is a robust framework for ensuring compliance with the commitments.

In all of this work our ambition is to be as open as possible with market participants, through our published quarterly updates, other publications and through talking directly to stakeholders.

We always welcome any views and comments on the Privacy Sandbox process, to [email protected].