Q1 2024: Update from CMA & Google on Privacy Sandbox

The latest quarterly report from the Competition and Markets Authority (CMA) sets out the progress made to date, including the CMA’s latest views on the potential impact of Google’s proposed Privacy Sandbox changes. It follows the announcement made earlier this week that Google will not be phasing out third-party cookies on Chrome in Q4 2024.  

What does the CMA's report say?  

The CMA’s report states: “Although there are a number of concerns to work through, based on the available evidence, we consider that from 1 January 2024 to 31 March 2024 (the relevant reporting period), Google has complied with the Commitments. This means that in our view Google has followed the required process set out in the Commitments and is engaging with us (and the ICO) to resolve our remaining concerns ahead of third-party cookie deprecation. However, further progress is needed by Google to resolve our competition concerns ahead of deprecation.” 

On the pre-announced delay to the deprecation of third-party cookies, the CMA continues: “Given the time needed to resolve outstanding issues and take account of testing results, we have agreed with Google that there should be a limited delay to third-party cookie deprecation. Subject to resolving our remaining competition concerns, Google is now aiming to proceed with third-party cookie deprecation starting in early 2025.”  

The report also takes into account the Information Commissioner’s Office’s provisional views and reflects its outstanding concerns “to ensure that both competition and privacy are protected”. See page 89 of the CMA’s report for more detail on this.  
 

What does Google’s report say?  

The CMA has also released a report from Google that sets out the approach it has taken over the last quarter to address any concerns raised by the CMA or other third parties. As well as detailing timeline updates and responding to industry feedback on Privacy Sandbox, the report includes reference to the deprecation delay.  

Google states: “We recognize that there are ongoing challenges related to reconciling divergent feedback from the industry, regulators and developers, and will continue to engage closely with the entire ecosystem. It's also critical that the CMA has sufficient time to review all evidence including results from industry tests, which the CMA has asked market participants to provide by the end of June.  

“Given both of these significant considerations, we will not complete third-party cookie deprecation during the second half of Q4. We remain committed to engaging closely with the CMA and ICO and we hope to conclude that process this year. Assuming we can reach an agreement, we envision proceeding with third-party cookie deprecation starting early next year.” 
 

What is the CMA asking the industry to do?  

The CMA is asking market participants taking part in testing to submit their results directly to it by the end of June deadline. It has said that also welcomes any additional feedback from stakeholders on the concerns identified in its report. Here are the relevant contact details:  

CMA

[email protected] 
[email protected] 
[email protected] 
[email protected]

Monitoring Trustee (including communications for the Technical Expert)

[email protected] 
[email protected] 
[email protected]   

Google

You can also provide feedback directly to Google’s Chrome developers here. 
 

What’s are the CMA’s next steps?  

Over the next three months, the CMA will focus on working with Google to resolve the concerns it has identified in the report ahead of the ‘Standstill Period’ (as part of the legally binding commitments Google has agreed to, it must allow for a Standstill Period of at least 60 days before third-party cookies can be removed – which can be extended to 120 days).  

The CMA is planning to publish its next update report and Google’s progress report in July 2024.