Google’s replacement of publisher cookies with its Privacy Sandbox is going to have a seismic impact on the web, in particular on advertising-funded news publishers.
Everyone thinks that third-party cookies are going to be blocked by Google, but far fewer understand why, how, and what it means for businesses on the web.
Even fewer understand what they can do about it.
What is Google’s Privacy Sandbox?
Google plans to remove third-party cookies from their Chrome browser by the end of 2024. This is as part of their Privacy Sandbox project, a technology platform that was billed as creating a more private web.
As well as cookies, Privacy Sandbox promises to degrade a far broader group of digital signals (such as IP addresses, User Agent Strings, web addresses, storage, and more) that website owners have traditionally used to help personalise and optimise their websites. Google then intends to replace these technologies with their own, proprietary solutions that – it claims – will work just as well. They won’t.
Google had intended to implement Privacy Sandbox far earlier but was stopped by the UK’s Competition and Markets Authority (CMA) who, following a competition complaint by my organisation, the Movement for an Open Web, agreed a worldwide set of voluntary commitments with Google that must be met before Google can deploy the Privacy Sandbox.
Problems with the Google Privacy Sandbox
There are some major issues with the Privacy Sandbox initiative, some conceptual and some more practical.
Interoperability
Privacy Sandbox removes or degrades a group of open and interoperable technologies and replaces them with closed, proprietary and Google-owned protocols.
Anyone can use a cookie and exchange that information with their business partners (with appropriate consent and legal compliance) without needing to ask another business for permission.
Under Privacy Sandbox this freedom to choose your technology stack and business partners disappears. If you want to reach the majority of web users who use Chrome you have to use Google’s technologies.
Competition
Whether you measure it by advertising revenue share, browser usage or any other factor Google is a monopolist. Google doesn’t deny this. Privacy Sandbox further entrenches this monopolist status by inserting their business into every advertising interaction on Chrome. This is not good for competition on any level.
The market and regulators should be looking at how to lessen Google’s dominance, not unwittingly bless even more monopoly.
Functionality
A more practical issue with the Sandbox is that it fundamentally degrades the functionality that publishers rely on.
Google itself has admitted that the Sandbox protocols are evolving and not stable. Even if they did work perfectly, it will perform less well than existing solutions, with some predicting a hit of 30-50% on digital advertising compared to the current technology approaches.
A simple example is its ad targeting feature, Topics. Currently, an advertiser or website owner can choose to personalise advertising on their site using any number of partners or approaches where the user has provided consent. Under Sandbox you will be forced to use Google-defined ‘topics’, which allocate coarsely-defined interest areas to each user. As well as lacking any nuance, Google will deliberately insert random topics into user profiles, further degrading the ad experience.
Privacy
Ironically, one of the areas where Sandbox really underperforms is in improving user privacy. Cookies themselves are not personal information, they are alphanumeric codes that help a website to provide the best user experience. They don’t generally contain names, emails or other meaningfully personal information.
By significantly degrading the ability of publishers to connect with website users, it will force more and more towards email logins or – even worse – ‘Sign in with Google’-type registrations. These capture far more actual personal information than current technologies, leading to a worse privacy outcome.
So-called “first-party” data strategies neglect to mention the significant increase in privacy risk to publishers and people. Only the largest publishers will be able to make the strategy work, and even then, less profitably than existing cookies.
Why the end of cookies is not inevitable
The good news is that the above is not – as many seem to think – inevitable. Google’s commitments on Sandbox, made to the UK Competition and Markets Authority in February 2022, mean that Google cannot block cookies or degrade further features until it has satisfied the regulator that its alternative solutions deliver broadly equivalent capabilities and that they preserve competition. They do not. I expect that the regulator will act on this once testing advances.
More broadly, Sandbox has to be seen in terms of the wider discussions about Google’s place in the market currently underway in the EU and the US. Both of these organisations have stated plans to regulate Google, potentially through a breakup of the business or more. It would seem counterintuitive for Google to be allowed to enact a massive land grab just before it is broken up on competition grounds so there is also potential for these regulators to prevent its rollout until they have made their decisions.
What publishers can do about it
As a publisher you can play a part in these processes, either through making your own submissions to the regulators about the impact of Sandbox or through joining groups such as MOW which can help you to engage in the US, EU, and UK, as well as possess the latest information to inform complex C-suite decisions.
The CMA is continuing to consult and gauge industry reaction and says: “Market participants who have any outstanding concerns about the design and implementation of the Privacy Sandbox should get in touch with us. We can be reached by email at privacysandbox@cma.gov.uk.”
Email pged@pressgazette.co.uk to point out mistakes, provide story tips or send in a letter for publication on our "Letters Page" blog
