The path forward with the Privacy Sandbox

Google’s aim with the Privacy Sandbox is to improve web privacy for people around the world, while also giving publishers, creators and other developers the tools they need to build thriving businesses. This includes building new digital advertising tools, in collaboration with the wider industry, to replace third-party cookies with alternatives that better protect consumer privacy and preserve peoples’ access to free content online.

Since announcing the Privacy Sandbox we have been in open dialogue with the industry, consumer advocates and regulators to gather feedback on this initiative. Over the past year, we have also worked closely with the UK’s Competition and Markets Authority (CMA) and Information Commissioner’s Office (ICO), including on a set of legally-binding commitments to address the CMA’s competition concerns over the Privacy Sandbox which will govern how we will design and implement this initiative. The aim, through this regulatory oversight and supervision, is to provide reassurance that the Privacy Sandbox will protect consumers and support a competitive ad-funded web, and not favor Google.

The commitments address these concerns through three main principles. First, the changes we will make in Chrome in the context of the Privacy Sandbox initiative will apply in the same way to Google’s advertising products as to products from other companies. Second, we will design, develop and implement Privacy Sandbox with regulatory oversight and input from the CMA and the ICO. And third, we will inform the CMA in advance of our intention to remove third-party cookies and agree to wait for their feedback on whether any competition law concerns remain.

Privacy by design and by default have been at the heart of the Privacy Sandbox from the outset, and we are also intent on ensuring that the new tools meet the requirements set out in the recent ICO’s Opinion on Data protection and privacy expectations for online advertising proposals. To that end, we are designing these new tools to avoid cross-site tracking, provide people with better transparency and control, and result in better outcomes for people and businesses on the web. We look forward to further engagement with data protection authorities as we continue to iterate and improve on the proposals.

We’re pleased that today the CMA has accepted these commitments, which now go into immediate effect. The development and implementation criteria that underpin these commitments are summarized below, and can be found in full on the CMA’s website. We will apply the commitments globally because we believe that they provide a roadmap for how to address both privacy and competition concerns in this evolving sector.

Respecting user privacy while maintaining a well functioning ad-funded web

Google’s objectives in developing the Privacy Sandbox proposals are to make the web more private and secure for people, while:

1. Supporting the ability of publishers to generate revenue from advertising inventory and the ability of advertisers to secure value for money from advertising spend;
2. Supporting a good user experience when navigating the web, including in relation to digital advertising;
3. Providing users with substantial transparency and control in relation to their data as they browse the web; and
4. Not distorting competition between Google’s own advertising products and services and those of other market participants.

We recognize that many publishers and advertisers rely on online advertising to fund their websites and reach new customers. So building tools which aim to improve people’s privacy, while continuing to support advertising, is key to keeping the web open and accessible to everyone and allowing businesses of all sizes to succeed.

Developing the Privacy Sandbox

To achieve the objectives above, Google is committing to designing, developing and implementing the Privacy Sandbox proposals taking into account specific criteria agreed with the CMA:

1. The impact on privacy outcomes and compliance with privacy laws;
2. The impact on competition in digital advertising between Google and other market participants, and, in particular, the risk of distortion to competition;
3. The impact on publishers (including their ability to generate revenue from ad inventory) and advertisers;
4. The impact on user experience (e.g. relevance of advertising and transparency over the use of personal data); and
5. The technical feasibility, complexity and cost involved for Google.

Building on many months of open consultation by Google — and the CMA — with the wider industry, Google will be consulting with the CMA and ICO on a regular basis in relation to the design, development and implementation of the Privacy Sandbox (including testing and public announcements). Google will also increase its engagement with industry stakeholders (including publishers, advertisers and ad tech providers) by providing a systematic feedback process to take on board reasonable views and suggestions. This continues our previous engagement with web community members, who are encouraged to participate in the development and testing of the proposed new technologies through public discussion forums like the W3C, developer channels such as GitHub, industry groups and origin trials. We will also establish a dedicated microsite, available from privacysandbox.com, explaining these channels in more detail and offering a new feedback form to submit suggested use cases and API feature requests, by the end of February 2022.

Ensuring compliance

Google will work with the CMA to resolve concerns without delay and consult and update the CMA and the ICO on an ongoing basis. Google has also committed to appoint an independent Monitoring Trustee who will have the access and technical expertise needed to ensure compliance, having consulted with the CMA. The Monitoring Trustee will work directly with the CMA, and will be central in ensuring compliance with the data and non-discrimination commitments offered by Google.

We believe that these commitments will ensure that competition continues to thrive while providing flexibility in designing the Privacy Sandbox APIs in a way that will improve peoples’ privacy online. Helping businesses adapt to a privacy-safe web, through invention and collaboration, can help provide the foundation for long-term economic sustainability and growth.

This process requires close engagement with competition and privacy regulators and new ways of working together. We hope these commitments can contribute to that new framework.