THOUGHT LEADERSHIP

Unboxing the Sandbox:

Looking at the role of the CMA in holding Google accountable

Julien Delhommeau, Chief Operating Officer, France

This year, all eyes are on Google’s announced deprecation of third-party cookies in Chrome, the last major browser supporting them and currently holding the lion’s share of open web advertising budgets. The question now is: what factors will influence whether Google sticks to its proposed timeline?

The pivotal decision-maker in this scenario is the UK’s Competition and Markets Authority (CMA). Why the CMA? Because following the launch of an investigation into Google and the Privacy Sandbox by the CMA in 2021, Google proactively made binding commitments. These commitments included implementing a standstill period (initially set at 60 days, extendable to 120 days by the CMA) for the CMA to assess the Privacy Sandbox’s state and potential industry impacts. Google pledged to address all concerns raised by the CMA during this period before proceeding with the deprecation.

So, what’s the CMA’s current stance on the Privacy Sandbox, and is it likely to give a favorable opinion at the end of the standstill period, which kicks off in early July following a six-month industry testing phase?

The latest CMA report, released quarterly, outlines concerns raised by the industry regarding the Privacy Sandbox proposals and the CMA’s perspective on them. Of the 72 concerns surfaced, many focus on the three main APIs: Topics, Protected Audience (PAAPI), and Attribution Reporting (ATA). While the CMA rejects some concerns, emphasizing that the Privacy Sandbox won’t replicate all current functionality and acknowledging potential business impacts, others still need addressing by Google.

Specifically, the CMA expects Google to:

– Outline a plan and timeline for transferring some of the governance of the Privacy Sandbox to an independent third party.
– Provide guidance on maintaining discussions with stakeholders and improving the Privacy Sandbox over time, especially concerning unfinished components (fenced frames, interoperability with other browsers’ API, etc.).
– Address issues with GAM’s approach to the Protected Audience API and concerns regarding ad verification.

None of these challenges seem insurmountable for Google in the coming months, so will the current timeline be met? Two main factors could sway the CMA’s position:

Firstly, the timeline itself, with a potential 120-day standstill period, would place the end of third-party cookies smack in the middle of Q4, a critical quarter for the industry. This could prompt Google to delay the timeline, possibly to Q1 2025, a more suitable period for such a significant industry shift.

Secondly, ongoing industry tests may unearth new concerns not yet foreseen by the CMA. Recently, the IAB TechLab published a report evaluating the Privacy Sandbox against 45 “foundational” industry use cases, revealing several shortcomings. This report stands as the most comprehensive feedback gathered from the industry on the Privacy Sandbox to date. Undoubtedly, the CMA will meticulously analyze this report, as it promises to shed new light on the capabilities of the Privacy Sandbox and its alignment with specific industry use cases.

The next CMA report, expected in late April, will be crucial in determining whether current concerns have been addressed by Google and if any new issues have emerged. Stay tuned for updates on the fate of the third-party cookie deprecation timeline.