Google’s ambitious plan to reshape online advertising through its Privacy Sandbox proposal faces fresh obstacles from the UK’s Competition and Markets Authority (CMA). The multiyear project aimed at phasing out third-party tracking cookies now risks being delayed further, or even derailed, after the regulator expressed “competition concerns” about Google’s latest revisions.
A Long Road to Privacy-Sandboxed Ads
Since January 2021, the CMA has been investigating Google’s Privacy Sandbox, which seeks to replace third-party cookies with an alternative adtech solution that enhances user privacy. This regulatory scrutiny was prompted by a complaint in November 2020 from a coalition of digital marketing firms, leading to years of slow progress. Now, with the CMA’s recent intervention, the initiative looks like it could be on the brink of stalling.
In a case update released this week, the CMA stated that Google’s revised proposal does not fully address the regulator’s competition concerns. The tech giant has already committed not to end support for third-party cookies without CMA approval, meaning further delays for the Privacy Sandbox project.
The CMA’s latest move will delay Google’s migration to the Privacy Sandbox even further, with updates expected only in the last quarter of 2024. The regulator said it is in discussions with Google about necessary changes but has yet to specify which elements of the revised plan remain problematic.
Cookies: Staying or Going?
Initially, Google had planned to deprecate third-party tracking cookies in its Chrome browser. However, following widespread backlash from the advertising industry and concerns raised by regulators, the tech giant made a U-turn in July, indicating that cookies may remain for longer than expected. In a new proposal, Google suggested giving users a choice between traditional cookie-based ad targeting and Privacy Sandbox, a move that raised new competition concerns.
Under this proposal, Chrome users could either accept ads based on third-party tracking cookies or opt for ads targeted through Privacy Sandbox technology, which avoids tracking. Alternatively, users could choose to reject both methods in favor of contextual ads that don’t rely on personal data.
While this user-choice model could improve privacy by empowering users to opt out of tracking entirely, it presents a challenge to the digital marketing industry, which heavily relies on third-party data for personalized ads. Critics argue that Google’s Privacy Sandbox could entrench its dominance in the adtech market by controlling the shift away from cookies.
CMA: Balancing Privacy and Competition
The CMA’s assessment of Privacy Sandbox focuses on competition, not privacy, meaning the regulator must carefully navigate complaints from marketers worried about losing access to valuable tracking data. If Google’s alternative adtech stack leads to a significant reduction in third-party cookies, it could force advertisers to rely on Google’s tools, further consolidating its control over online ads.
The CMA has promised to update the public in the last quarter of 2024, outlining its views on the Privacy Sandbox tools and trial results. If Google’s changes fail to address competition concerns, the CMA could take further action, although it has yet to detail what that could entail.
ICO’s Role in Privacy Scrutiny
While the CMA focuses on competition, the Information Commissioner’s Office (ICO), the UK’s data protection authority, is responsible for ensuring Google’s Privacy Sandbox aligns with national privacy laws. The ICO has been working with the CMA throughout the investigation to evaluate user-choice design and privacy concerns. However, the ICO has previously faced criticism for its lack of enforcement within the adtech industry, which raises doubts about its ability to champion consumer privacy in this battle.
Recent ICO actions, such as clamping down on non-compliant cookie consent pop-ups, have inadvertently led to the rise of “consent or pay” mechanisms, where users must either accept tracking or pay to access content. This approach, which is under legal challenge in the EU, has further complicated the adtech landscape.
Industry Responses and Concerns
Google insists it is cooperating with regulators to ensure its new approach balances privacy and competition. “We are engaging with the CMA on Privacy Sandbox following the updated approach we’ve proposed, which lets people make an informed choice that applies across their web browsing,” said Google spokesperson Jo Ogunleye.
However, industry experts are becoming increasingly frustrated with the CMA’s handling of the project. Lukasz Olejnik, an independent consultant tracking Privacy Sandbox from its inception, expressed disappointment at the CMA’s apparent change in priorities. Olejnik warned that keeping third-party cookies could harm user privacy, adding that the CMA’s earlier stance aligned with privacy protections.
“It is difficult to explain why the regulator may have reconfigured its priorities,” he said. “Until now, the CMA had a full understanding that third-party cookies are problematic for privacy, data protection, and trust in digital advertising.”
The Future of Adtech in the UK
The CMA’s ongoing scrutiny leaves the future of adtech in the UK uncertain. While Google’s Privacy Sandbox promises a more privacy-respecting web, concerns over market dominance and competition continue to cloud the project’s path forward. For now, both advertisers and users must wait to see how this complex regulatory battle unfolds.
As the CMA gears up to provide its next update, the key question remains: Will Google’s Privacy Sandbox project survive the mounting regulatory pressure, or will the future of online advertising stay firmly in the grip of third-party cookies?
