CMA releases update report on the implementation of Google’s Privacy Sandbox commitments

The Competition and Markets Authority (CMA) has today published its first update report on the implementation of Google’s Privacy Sandbox commitments, first accepted by the CMA in February 2022.

In the report, the CMA considers that from April 2022 to June 2022 Google complied with the commitments it made, although recognises that there is still a lot of work to be done. It also sets out the progress made to date, highlights areas of focus where potential concerns have been raised and includes a number of specific questions where input from interested third parties would be most valued.

Laying out their current priorities, the CMA commits to ensuring that all Google’s public statement are accurate and give market participants sufficient information to understand and engage with the proposals; ensuring Google designs a robust testing framework for its proposed new tools and APIs; reviewing Google’s internal processes to ensure that strong firewalls are in place to prevent the Google Ads services accessing data that they should not; and understanding concerns that are being raised by market participants about different elements of the Privacy Sandbox proposals.

The update report comes one day after Google announced it is delaying the phase-out of third-party cookies in Chrome until the second half of 2024.

The CMA has begun to reach out to market participants already but says that it and the Monitoring Trustee, ING Bank, welcome further views from industry, in particular around the following key questions:

1. Where should the CMA focus its efforts in engaging with Google on the design of the Privacy Sandbox APIs?
2. What steps should the CMA take to plan for the testing and assessment of the APIs, and what would help stakeholders to engage with the testing Process?
3. Are there concerns about specific aspects of the Privacy Sandbox APIs which are not covered in Google's quarterly feedback report and which Google should take into account? 
4. Any there any instances where Google has mischaracterised elements of the Privacy Sandbox or otherwise failed to meet its obligations under the Commitments?

The CMA and Monitoring Trustee also welcome continued engagement, input and feedback about experiences engaging with Google on testing and trialling of proposals, as well as the extent to which Google has taken account of views and suggestions as part of its development process. Members can reach the case team on [email protected] and further contact information is available at the end of the update report. 

Read the full case report of the investigation into Google’s ‘Privacy Sandbox’ browser changes on the CMA’s website here, and read IAB UK’s statement in response to Google announcement of delay to phase-out of third-party cookies here.