The UK’s Competition and Markets Authority (CMA) has said “concerns remain” over Google’s approach to the Privacy Sandbox (its set of tools initially designed to replace third-party cookies), in the watchdog’s latest update to an ongoing investigation into the five-year plan for privacy updates in Chrome.
After the tech giant scrapped plans to remove third-party cookies from Chrome in July, the CMA invited stakeholders to share their views on the new approach, which includes making the Privacy Sandbox optional instead of replacing third-party cookies altogether. Google said it would give Chrome users more privacy options, suggesting a browser-based consent mechanism would be introduced.
Further investigations
On Tuesday the regulator expressed misgivings over the new approach, and remains in discussion with Google on changes that should be implemented in order to assauge those concerns. The watchdog is also working with the Information Commissioner’s Office (ICO), the UK’s data regulator, in order to consider privacy and user choice design concerns stemming from Google’s revised approach.
“Based on careful consideration of the responses we received, the CMA’s view is that competition concerns remain under Google’s revised approach,” said the regulator. “The CMA wants to ensure that these changes are made in a way which supports continued competition in digital advertising.”
The CMA added that Google’s current commitments “would need to be updated” in light of the planned browser changes, and aims to make a decision on whether to accept any changes to the commitments in Q4 2024, following another public consultation.
“We are engaging with the CMA on Privacy Sandbox following the updated approach we’ve proposed, which lets people make an informed choice that applies across their web browsing,” Google said in a statement. “As we finalise this approach, we’ll continue to consult with the CMA, ICO and other regulators globally and look forward to continued collaboration with the ecosystem to build for a private, ad-supported internet.”
Persistent concerns
The Privacy Sandbox has been in the CMA’s crosshairs since January 2021, when the watchdog opened its investigation into the new set of tools. It raised a number of competition concerns related to the proposal to remove third-party cookies from Chrome, and in February 2022, the CMA accepted Google’s commitments to address those concerns – most crucially that cookie deprecation would not go ahead until the CMA was satisfied that Google had addressed its competition concerns.
In February 2024, the regulator provided an update that suggested approval remained a long way off, outlining 38 concerns around the parts of the Privacy Sandbox related to advertising. Google pushed the deadline to 2025, then scrapped the plans for cookie deprecation, instead giving Chrome users the choice to allow cookies to track them when browsing.
But the CMA’s latest update makes clear that its competition concerns persist under the new plans. And in July the ICO announced it was “disappointed that Google has changed its plans”, and continued to encourage the digital advertising industry to move to alternative forms of tracking.
“From the start of Google’s Sandbox project in 2019, it has been our view that blocking third-party cookies would be a positive step for consumers,” said Stephen Bonner, Deputy Commissioner at the ICO. “The new plan set out by Google is a significant change and we will reflect on this new course of action when more detail is available.”
