The UK’s Competition and Markets Authority (CMA) has released an update on its monitoring of the development of Google’s Privacy Sandbox tools, emphasising that Google’s decision not to completely remove third-party cookies on Chrome doesn’t defuse competition risks, and that there are still unresolved competition concerns relating to the Sandbox tools.
The CMA, as part of its oversight of the Privacy Sandbox negotiated with Google, had ensured that it would have the final say before Google removed third-party cookies from Chrome, under its previous plans, and said it would not give the green light until these issues were resolved.
Google changed its plans earlier this year, saying it won’t remove third-party cookies for all users, but will instead give users a choice at the browser level whether to opt in or out of third-party cookies. At the time, some questioned whether this might allow Google to sidestep the CMA’s oversight.
But the regulator maintains that even under these new plans, competition risks remain. The commitments provided by Google to the CMA may need to be updated, but Google has an ongoing obligation “not to design or implement the new Privacy Sandbox tools in a way which discriminates in favour of its advertising business”. Whatever the new cookie consent mechanism in Chrome looks like, Privacy Sandbox tools will likely be important for ad targeting and measurement for any traffic where third-party cookies are unavailable, meaning there’s still a risk that Google’s ad business could be favoured by the Sandbox. As such, the CMA will retain its oversight of the Sandbox.
The regulator says it has broad backing from the industry for this approach too. “Overall, industry stakeholders (particularly ad tech and publisher groups) were almost unanimously of the opinion that competition concerns remain, and that we should continue to oversee Google’s new approach,” said the report.
Google meanwhile emphasised discussions with the CMA are ongoing, in relation to which changes need to be made to the commitments in light of its new approach. “We believe our approach supports healthy competition across the industry while improving user privacy,” said a Google spokesperson. “This approach, which lets people make an informed choice that applies across their web browsing, is still being discussed with regulators and we will share more details at the appropriate time.”
Ironing out kinks, or fundamental problems?
The larger questions around Google’s change of approach, and the resulting impact on competition risk, remain unanswered, since we still don’t know much detail about what Google plans to do. However, Google has stated that it’s continuing to invest in the Privacy Sandbox and all the tools contained within it. In its report, the CMA outlined its ongoing concerns about these tools
The CMA lists out concerns relating to each of the Privacy Sandbox tools, and the report shows that there are still plenty of unresolved issues. The regulator lists over 60 different issues, some of which have been informed by input from the Information Commissioner’s Office, the UK’s data regulator.
Not all of these issues are make-or-break. In some cases, the CMA says it’s soliciting industry feedback on changes which Google has offered to make, and in others it’s still ironing out details with the tech giant. Notably, the CMA says that a lot of issues may be solved by an updated governance framework, which would give industry participants more power to contest changes made to the Privacy Sandbox which they feel are unfair, and provide more third-party oversight over the running of the Sandbox.
But not all issues fall into this category. One recurring concern is that fundamentally, any deprecation of third-party cookies hands more of an advantage to businesses which have plenty of first-party data, one of which is Google. Google itself wouldn’t be as reliant on Sandbox tools as others in the market, and so could hold a significant advantage over ad tech competitors which might find themselves more reliant on the sandbox. On this front, the CMA simply says it is “continuing to discuss the issue with Google”.
