CMA secures final Privacy Sandbox guarantees from Google

The Competition and Markets Authority (CMA) says it will keep a “close eye” on Google as it finalises a series of commitments from the search giant that will supposedly help address competition concerns over its Privacy Sandbox proposals to remove third-party cookies from its Chrome browser.

The agreement caps off a lengthy period of investigation and negotiation stemming from a consultation that began in January 2021, over concerns that Google’s proposals would have the effect of concentrating online ad spending in its hands, damaging competition and harming consumers. The CMA had also been concerned that the proposals would undermine the ability of online publishers to generate revenue and produce content.

“Our intervention in this case demonstrates our commitment to protecting competition in digital markets and our global role in shaping the behaviour of world-leading tech firms,” said CMA chief executive Andrea Coscelli. “The commitments we have obtained from Google will promote competition, help to protect the ability of online publishers to raise money through advertising and safeguard users’ privacy.

“While this is an important step, we are under no illusions that our work is done,” he said. “We now move into a new phase where we will keep a close eye on Google as it continues to develop these proposals. We will engage with all market participants in this process in order to ensure that Google is taking account of concerns and suggestions raised.”

Google has now formally undertaken to involve both the CMA and the Information Commissioner’s Office (ICO) in how it tests and develops the Privacy Sandbox proposals to ensure effective outcomes that protect competition and privacy; to make the process more transparent, including engaging with third parties and publishing test results; to not remove third-party cookies until the CMA is satisfied its competition concerns are addressed, and the CMA may take further action if it is not satisfied; to restrict the sharing of data in its ecosystem to ensure it doesn’t gain an edge on competitors when cookies are removed; and to appoint a monitoring trustee to work alongside the CME on monitoring and compliance.

The CMA has also secured a number of mechanisms to hold Google to account, including oversight of how whatever replaces third-party cookies are tested; a standstill period of at least 60 days before third-party cookies are withdrawn; and a mechanism for Google to resolve any new concerns in a timely manner.

These commitments will run for a period of six years from 11 February 2022, unless released earlier under the terms of existing UK competition law. Going forward, the CMA said it would now “move into the next phase”, supervising Google to ensure Privacy Sandbox is developed in such a way that it benefits consumers.

In a statement, Google’s legal director of privacy for EMEA, William Malcolm, and legal director Oliver Bethell, said the commitments developed alongside the UK regulators would be applied on a global basis, “because we believe that they provide a roadmap for how to address both privacy and competition concerns in this evolving sector”.

“We believe that these commitments will ensure that competition continues to thrive while providing flexibility in designing the Privacy Sandbox APIs in a way that will improve peoples’ privacy online,” they said. “Helping businesses adapt to a privacy-safe web, through invention and collaboration, we can help provide the foundation for long-term economic sustainability and growth.

“This process requires close engagement with competition and privacy regulators and new ways of working together,” added Google’s representatives. “We hope these commitments can contribute to that new framework.”

The full set of commitments relating to the removal of third-party cookies from Google Chrome can be read here.