Privacy Sandbox saga continues: UK watchdog extracts more commitments from Google over ad tech

November 26, 2021 TH Author

The torrid tale of Google’s Privacy Sandbox took another turn today with the UK’s Competitions and Markets Authority (CMA) saying it has “secured improved commitments” from the ad giant over the cookie crushing tech.

The CMA’s claims come in the wake of yesterday’s call by the UK’s data watchdog, the Information Commissioner’s Office (ICO), for Google and co to sort out the privacy risks posed by ads. The ICO continues to work with the CMA to review the plans of the Mountain View gang.

The investigation by the competition regulator kicked off in January amid worries that Google’s intention to change its Chrome browser and phase out third party cookies in favour of a so-called Privacy Sandbox would, in fact, strengthen the megacorp’s grip on the online ad ecosystem.

In June the CMA consulted on initial commitments offered by Google and the feedback from third parties was… they needed a bit of work.

That feedback included calls for Google to be more transparent; to bolster the monitoring of compliance; and to improve “the provisions on Google self-preferencing its advertising products and services.”

Google’s response to the concerns, according to the CMA (which reckons the revisions addresses its worries), has been to offer to:

ensure that the CMA’s role and the ongoing CMA process are mentioned in Google’s key public announcements;
instruct its staff not to make claims to customers which contradict the commitments;
report regularly to the CMA on how Google has taken account of third party views;
address concerns about Google removing functionality or information before the full Privacy Sandbox changes, including by delaying enforcement of its Privacy Budget proposal, and offering commitments around the introduction of measures to reduce access to IP addresses;
clarify the internal limits on the data that Google can use;
provide greater certainty to third parties developing alternative technologies;
improve the provisions on reporting and compliance, including by appointing a CMA-approved monitoring trustee; and
provide for a longer duration of six years from the date of any decision to accept Google’s modified commitments.

Independent privacy researcher and consultant, Lukasz Olejnik, said of the penultimate point: “I am prepared to volunteer to be the ‘trustee’. So, where do I send my application?”

New Google commitment. It will be ABSOLUTELY CRITICAL who will that person be. Will that be someone with technology and appropriate policy skills, obviously independent? Can we trust the process? https://t.co/hedYaKHdlO pic.twitter.com/uKRRVoCZVy

— Lukasz Olejnik (@lukOlejnik) November 26, 2021

Quoting the modification notice posted by the CMA [PDF], he told The Register: “Four respondents objected to paragraph 11(a) of the Initial Commitments, citing Google’s stated aim of making the web ‘more private and secure for users.'”

“On a similar theme,” the Modification Notice continues, “another respondent suggested that Google should publicise that its technology is neither ‘more privacy-friendly’ than others’ technology, nor ‘certified’ by the CMA or the ICO.”

Olejnik also highlighted Google’s promise not to use a user’s browsing history once Chrome ends support for third-party cookies.

‘Beware Black Friday offers – read the small print’

The Movement for an Open Web, formerly Marketers for an Open Web (MOW), which has repeatedly expressed concerned at Google’s plans to, in its words, “effectively create a Google-owned walled garden” around third-party cookies, sounded a note of caution regarding the CMA’s claims and said: “Beware Black Friday offers – read the small print.”

It is a hefty document [PDF] after all, weighing in at 125 pages.

Timothy Cowen, MOW’s legal advisor and chair of the antitrust practice at Preiskel & Co LLP, said: “We will be looking closely at these commitments – like any Black Friday offer they may be good but they may also be too good to be true.”

That said, James Rosewell, founder and director of MOW, said: “Should the commitments avoid the need for an injunction to prevent the digital market being controlled by trillion-dollar US companies then we would welcome them.”

The CMA is now consulting on these new commitments until 17:00 BST on 17 December. If accepted, the investigation will be closed and the next phase of oversight kick off. A very merry Christmas indeed for all the inhabitants of the Chocolate Factory.

As for Google, it said: “We continue to appreciate the thoughtful approach and engagement from the CMA and ICO as we develop our Privacy Sandbox proposals.

“We welcome, and will carefully consider, any comments that people provide during the consultation process.”

Google’s ad business turned over $148.25bn in sales for the nine months ended 30 September [PDF], up from $100.72bn in the corresponding period in the prior year. In total, Google turned over $182.3bn, up from $125.6bn. ®