Google's latest Privacy Sandbox gambit could pit user choice against tracking

In a material development that will likely have a big impact on online business models, Google is no longer proposing to deprecate third-party tracking cookies in its Chrome browser. Instead, it appears to be suggesting that users should be given a choice to accept or deny ad tracking at the browser level.

Google’s move will be subject to regulatory oversight in the U.K., so it is not yet confirmed. Still, it could cast doubt on the uptake of Privacy Sandbox, its long-brewing alternative tech stack for personalized ad targeting that does not use cookies to track and profile users.

“[W]e are proposing an updated approach that elevates user choice. Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time. We’re discussing this new path with regulators, and will engage with the industry as we roll this out,” Google’s VP of Privacy Sandbox, Anthony Chavez, wrote in a blog post on Monday.

The adtech giant has been pitching Privacy Sandbox as a less privacy-hostile alternative to third-party cookies. But if Google isn’t ending support for tracking cookies after all, there’s no obvious hard stop or deadline to force advertisers to switch en masse to a less intrusive alternative.

It’s notable the search and advertising giant is not pulling the plug on Privacy Sandbox itself, though. On the contrary, Google’s blog post says it will keep working on the tech stack — Chavez asserted it “remains important for developers to have privacy-preserving alternatives.”

“We’ll continue to make the Privacy Sandbox APIs available and invest in them to further improve privacy and utility. We also intend to offer additional privacy controls, so we plan to introduce IP Protection into Chrome’s Incognito mode,” he wrote, adding: “We’re grateful to all the organizations and individuals who have worked with us over the last four years to develop, test and adopt the Privacy Sandbox.”

An unexpected development

On the one hand, Google’s announcement is a surprise, as it has been working toward this stated aim for at least four years in response to rising concern (and reputational risk) over tracking-based privacy risks. The company actually began talking about building a “Privacy Sandbox” for ad targeting all the way back in 2019.

On the other hand, something had to give. The company’s plan to kill support for tracking cookies has faced heavy and sustained pushback from advertisers and publishers from the get go. Their complaints triggered close regulatory scrutiny in early 2021, principally from the U.K.’s competition regulator, the CMA. The U.K.’s data protection watchdog, the ICO, has also been involved in oversight of Google’s Privacy Sandbox proposal.

The saga is particularly interesting, as it offers a microcosm of arguments that seek to frame competition and privacy as opposing forces that are perpetually and fatally in tension. In practice, so far the upshot has been a much slowed/delayed transition — Google has been forced to consult and take industry feedback on proposed changes to its ad-serving and tracking mechanism after it agreed to let the CMA monitor the design and implementation of its alternative adtech stack.

The relative weakness of the U.K.’s privacy oversight versus competition enforcement is a key strand here — one that the ad industry has sought to leverage to their advantage via competition complaints against Privacy Sandbox.

The ICO has been infamously weak at standing up to tracking by the ads industry, despite the regulator’s public acknowledgement (since 2019) that cookie-based tracking and profiling violates privacy laws. By pitting competition complaints against privacy rights, the ad industry has been banking on the CMA to prevail as the regulatory champion and deal Google’s Privacy Sandbox a knock-out blow.

In particular, advertisers claim Privacy Sandbox would further entrench Google’s dominance in the adtech space, as it would then become the owner and operator of reconfigured targeting infrastructure designed to shield user data from third-party access. In turn, that would make advertisers and publishers even more reliant on Google, even as (they claim) the resulting non-cookie-based ad targeting would be less lucrative for them.

Some publishers have said their revenue had declined by about a third during early tests of Google’s Sandbox. However, if cookie tracking is unlawful because it violates people’s privacy, some might say the industry needs to be OK with earning a lot less. (Breaking the law might be great business, but it’s not legal business, yo.)

The ICO told TechCrunch it’s “disappointed” that Google no longer intends to deprecate third-party cookies in Chrome.

“From the start of Google’s Sandbox project in 2019, it has been our view that blocking third-party cookies would be a positive step for consumers,” said the ICO’s deputy commissioner, Stephen Bonner, in a statement. “The new plan set out by Google is a significant change and we will reflect on this new course of action when more detail is available.

“Our ambition to support the creation of a more privacy-friendly internet continues. Despite Google’s decision, we continue to encourage the digital advertising industry to move to more private alternatives to third-party cookies — and not to resort to more opaque forms of tracking.”

“We will monitor how the industry responds and consider regulatory action where systemic non-compliance is identified for all companies including Google,” Bonner added.

We also reached out to the CMA about Google’s move, but it declined to respond to questions about whether it would accept a proposal to let Chrome users deny tracking. Instead, it said in a statement: “We will need to carefully consider Google’s new approach to Privacy Sandbox, working closely with the ICO in this regard, and welcome views on Google’s revised approach — including possible implications for consumers and market outcomes.”

“We intervened and put in place commitments in 2022 because of concerns that Google’s Privacy Sandbox proposals could distort competition by causing advertising spend to become even more concentrated on Google’s ecosystem at the expense of its competitors,” the CMA added, emphasizing that competition concerns are its mainstay.

So what happens next?

With the future of Privacy Sandbox (and much more) hanging in the balance, Google’s proposal of a third way that hinges on centering consumer choice could offer the two U.K. regulators an elegantly simple — if ironic — way out of this competition versus privacy impasse: Just let the users decide!

It’s ironic because had the ICO actually enforced data protection laws on the adtech industry in the first place, the industry would already have had to ask and obtain people’s consent to track and profile them.

Instead, we’ve had years of consent theater, where the web has been flooded with annoying (and illegal) pop-ups that employ deceptive mechanisms to confuse, manipulate or simply steal consent — doing everything except presenting users with the clear and informed choice U.K. and EU laws require.

All these years of adtech privacy outrages are essentially water under the bridge at this point, but the future direction of the web (and the business models it supports) is still up for grabs. The next few months — and what this pair of U.K. regulators decide — will be important.

In a blog post discussing Google’s gambit, privacy and security researcher Lukasz Olejnik has sketched a mock-up of a potential choice screen Chrome could present to users. Does he think the CMA would accept Google implementing such a choice?

“That depends on the developments in the next two months, but I can’t imagine regulators not giving users an option of choice,” he told TechCrunch. “That would be bizarre. And perhaps this is why Google maintains, at least today, that Privacy Sandbox is here to stay. But there must be an incentive to shift to the use of PS. If there is none, why keep it?”

But would an unblockable prompt in Chrome that asks users to choose whether they see ads based on their web activity (or not), or deny ad tracking altogether by disabling third-party cookies, constitute a win for consumers hoping for more privacy? “I hope so,” Olejnik said, suggesting that there’s a chance “user choice may thusly steer the future.”