The Privacy Sandbox initiative is the main vehicle through which Google is developing proposals for the replacement of third-party (3P) cookies, after initially pledging in January 2020 to phase out their use in its Chrome browser.
The technology giant has faced no shortage of obstacles in its quest to phase out 3P cookies, and has pushed back the deprecation deadline for cookies not once, but three times, most recently to early 2025. It has already dropped one tracking proposal, Federated Learning of Cohorts (or FLoC), in response to criticisms by privacy groups and other browsers as well as antitrust concerns.
Many concerns about Google’s Privacy Sandbox still remain, however – and given the advertising and marketing industry’s widespread reliance on cookies for measurement and tracking, and Google’s dominance of the ad market, the stakes are high.
Recently, Google concluded a period of industry testing that followed cookies being phased out for 1% of Chrome users, and the results have drawn attention to issues that ad publishers and regulatory bodies still have with Privacy Sandbox as it stands.
So, what are the issues that have been raised, and what do they mean for the future of measurement and tracking in Chrome, and for advertisers nervously anticipating the demise of third-party cookies?
“Publishers will lose an average of 60% of their revenue from Chrome”: Criteo
One major set of findings from the Privacy Sandbox test phase comes from ad platform Criteo, which is a development partner in the Sandbox project. Criteo conducted extensive testing of Privacy Sandbox across the majority of its 18,000 advertisers and 1,200 publishers between 18th March and 12th May, to the tune of more than 100 million ad impressions per week.
Following the conclusion of the testing period, Criteo assessed that if 3P cookies were deprecated today and Privacy Sandbox implemented as it stands, “publishers will lose an average of 60% of their revenue from Chrome”. Needless to say, this would be a huge issue.
Criteo’s testing also revealed some concerning issues with latency – the time it takes for an ad to load, which impacts on page loading speed. During testing, the ad platform “observed a median increase of more than 100% latency in publisher ad rendering on Privacy Sandbox traffic” – which would have a knock-on effect on consumer experience, viewability and click-through rates, the latter two of which would harm revenue.
It’s worth bearing in mind that Google itself ranks fast-loading websites higher in search – so there would be an impact to SEO, as well.
Criteo’s report concluded that, “if no further action is taken by Google to significantly improve the Privacy Sandbox … we believe publishers will struggle with lower yields and decreasing revenue, as well as inability to measure performance.”
“The Privacy Sandbox initiative… introduces significant hurdles for the digital ad economy”: The IAB Tech Lab
The Interactive Advertising Bureau (IAB) Tech Lab has been conducting its own analysis of how effectively Privacy Sandbox will plug the ‘gaps’ left by the departure of 3P cookies. This has been produced by the Privacy Sandbox Task Force: a group of industry product development leaders with direct experience of the Privacy Sandbox who have worked closely with Google’s teams to offer industry feedback and product update recommendations.
In February, the Task Force released a gap analysis based on its work on Privacy Sandbox, which lasted for six months and involved more than 65 participant companies. It concluded that, “several crucial functions within Sandbox – including frequency capping, video advertising, audience creation, and impression counting – … either lack support or face limitations”. The analysis also identified concerns with regard to audience management, auction dynamics, creative and rendering, reporting, and technology and interoperability.
Google responded to the IAB’s concerns by asserting that, “the analysis contains many misunderstandings and inaccuracies”, and that “the report appears to ignore the broader objective of Privacy Sandbox to enhance user privacy while supporting effective digital advertising.”
The gap analysis was open to industry comment from 6th February to 22nd March 2024, and in late June, a final version of the analysis was released, coinciding with the end of the Privacy Sandbox testing period. The analysis is still highly critical of Privacy Sandbox and its adequacy as a replacement for 3P cookies; it states, “The Privacy Sandbox initiative, while aimed at bolstering user privacy, introduces significant hurdles for the digital ad economy.”
Furthermore, the IAB Tech Lab believes that, “In its current form, the Privacy Sandbox may limit the industry’s ability to deliver relevant, effective advertising, placing smaller media companies and brands at a significant competitive disadvantage. The stringent requirements could throttle their ability to compete, ultimately impacting the industry’s growth.”
The final gap analysis outlines several outstanding concerns and questions for the Chrome team on key areas including: fragmented documentation, a lack of consideration for commercial requirements, an absence of third-party audits, a lack of standard industry accreditation, scalability and performance, Chrome transparency, and future governance.
“Further progress is needed by Google to resolve our competition concerns”: the CMA
The UK’s Competition and Markets Authority (CMA) opened an investigation into Google’s Privacy Sandbox in 2021 on grounds of possible infringement of competition law, and in July 2022 began publishing quarterly reports tracking Google’s progress with the commitments it has made to address the CMA’s concerns.
The CMA’s Q4 2023 report, published in January 2024, contained a stark declaration that “Google cannot proceed with third-party cookie deprecation until our concerns have been resolved”. At the time, Google was still aiming for a H2 2024 deprecation deadline, but just ahead of the CMA releasing its Q1 2024 report in April, it revealed that the deadline would be pushed back again to early 2025.
The CMA’s most recent report, published in April, affirmed that “Google has followed the required process set out in the Commitments and is engaging with us (and the ICO) to resolve our remaining concerns ahead of third-party cookie deprecation.” However, it added that, “further progress is needed by Google to resolve our competition concerns ahead of deprecation.”
Key concerns raised by the CMA about Privacy Sandbox include:
- The potential for Google to design or develop Privacy Sandbox tools in such a way as to privilege the market position of Google’s advertising products, such as Google Ad Manager (GAM)
- Long-term governance arrangements for Privacy Sandbox and a lack of independent governance; the CMA is keen that stakeholders have the chance to engage with Google about Privacy Sandbox on an ongoing basis
- Google’s use of first-party data to target and measure ads on its Owned & Operated (O&O) inventory, and the risk that ad spend could move away from open display and into O&O inventory
- Restrictions to cross-site tracking that could harm tools that compete with Privacy Sandbox: the CMA highlights that “Google’s market position allows it to have a significant impact on the viability of alternative technologies that may compete with the Privacy Sandbox tools following the removal of third-party cookies.”
The UK’s main privacy authority, the Information Commissioner’s Office (ICO), has also raised concerns about loopholes in the Privacy Sandbox framework that could be used to track users and compromise their anonymity, according to documentation obtained by the Wall Street Journal. The ICO shared its findings with the CMA, and reportedly urged Google to reinforce the privacy safeguards within Privacy Sandbox.
What does all of this mean for advertisers?
In developing Privacy Sandbox and its associated tools, Google is walking something of a tightrope, needing to satisfy advertisers on the one hand with the same levels of visibility and reporting that they’ve come to expect from cookies (and maintain its own advertising business), and needing to assure consumers and regulators of its respect for privacy on the other.
All of this matters because Chrome has more than 65% market share worldwide, according to GlobalStats, which represents a huge portion of online browsing time and attention.
However, in emailed comments to Digiday, Google pointed out that “it’s not possible to predict publisher performance based on effectiveness of a single buying platform, as publishers typically work with dozens of demand sources,” and added that performance numbers can’t reflect how the ecosystem will perform “in a true marketplace” unless adoption expands.
Criteo’s testing report noted that fewer than 55% of publishers overall have adopted Privacy Sandbox – which may be due to justified caution around the tool, but also affects the extent to which findings can be generalised. Ultimately, advertisers need to take any figures that come out of Privacy Sandbox testing with at least a little bit of salt, remembering that this won’t represent real-world conditions exactly.
Moreover, Privacy Sandbox and its associated solutions can’t be a 1:1 replacement for 3P cookies. The way that 3P cookies work, and the level of insight that they offer, has been deemed too intrusive to user privacy – which is why they’ve been progressively phased out by browsers, and are being discontinued by Chrome.
Industry bodies and regulators should engage with Google’s initiative and hold Privacy Sandbox to account – but advertisers should also make sure that they aren’t expecting Privacy Sandbox to be a silver bullet.
Econsultancy’s Future of Marketing Report 2023 showed that marketers are already dealing with a loss of signal when it comes to tracking and targeting – and so tackling these challenges in the present will also shore them up against any changes when Chrome switches off cookies, whether that’s in early 2025 or a yet-to-be-determined future date.