Q2/Q3 2024: Update from CMA & Google on Privacy Sandbox

What’s the context? 

In July 2024, Google announced a new direction for Privacy Sandbox, stating that it would no longer be removing third-party cookies on Chrome in 2024 as planned. Instead, it proposed to “introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time. We're discussing this new path with regulators, and will engage with the industry as we roll this out." You can read more here. 

In response to this, the CMA asked the industry to share its views on the updated approach. IAB UK made a submission setting out the potential issues/risks of centralised/browser-based controls in general, based on our existing policy position developed in the context of the DPDI Bill in the last Parliament. 

What does the CMA’s latest update say? 

The CMA has released its quarterly update for Q2 and Q3 - the first report since Google announced the change in approach. It states that: 

• Google has complied with the CMA’s existing Commitments during the period 1 April - 2 September 2024. The update says: “This means that in our view Google has followed the required process set out in the Commitments and is engaging with us (and the ICO) to resolve our concerns relating to the development and implementation of the Privacy Sandbox tools.”
• In relation to Google’s change in approach, the CMA states: “Google’s proposal to replace third-party cookie deprecation with a new user choice experience is likely to change the scale of the impact on the ad tech ecosystem in relation to the issues we describe in this report, because third-party cookies will continue to be available for some users depending on their choice. However, for the proportion of traffic where third-party cookies are unavailable, the Privacy Sandbox tools will remain important for the ad tech ecosystem to target and measure advertising.”
• The CMA details how it is working with the Information Commissioner's Office (ICO) on aspects relating to privacy and data protection: “Where the ICO has identified a possible issue with Google’s current proposals, its view is also informed by the risk and likelihood of misuse (ie using the Privacy Sandbox tools in ways that create risks for privacy outcomes and compliance with data protection principles as set out in Applicable Data Protection Legislation) by parties, such as publishers, advertisers and ad techs.”
• The CMA says that the responses it has received from the industry about the new direction for Privacy Sandbox show that privacy concerns remain: “Overall, industry stakeholders (particularly ad tech and publisher groups) were almost unanimously of the opinion that competition concerns remain, and that we should continue to oversee Google’s new approach.” 
• The CMA wants to ensure that changes are made in a way which supports continued competition in digital advertising. The current commitments (which were agreed in February 2022) would therefore need to be updated to reflect the evolution in Google’s planned Privacy Sandbox browser changes and the CMA is discussing with Google what changes would be required to address the CMA’s competition concerns. The CMA will publicly consult before taking any decision on whether to accept changes to the commitments, and is aiming to do this in Q4 2024

What does Google say? 

At the same time as publishing its own report, the CMA has also released Google’s latest report that sets out the approach it has taken over the same time period to address concerns raised by the CMA or other third parties. This includes a summary of revisions made to Privacy Sandbox timelines. You can find the report here. 

How can you contact the CMA & Google? 

The CMA is continuing to engage with market participants across the industry to ensure that it is aware of, and understands, concerns about the Privacy Sandbox tools and their impact. Given the global nature of Google’s developments, it welcomes feedback from organisations both within and outside the UK. It is also encouraging businesses to continue engaging with and feeding back to Google directly. 

The relevant contact details are:

• CMA: [email protected]; [email protected] [email protected]: and [email protected]
• Monitoring Trustee (including communications for the Technical Expert): [email protected]; [email protected]; and [email protected] 
• Google: Feedback - Chrome Developers