The Privacy Sandbox creates two parallel universes

After years of missed deadlines, Google has finally kicked off third-party cookie deprecation and convinced part of the ad tech industry to start testing its proposed replacement: the Privacy Sandbox. The idea behind this initiative is simple: make the browser the controller of a user’s personal data and the engine of all data processing operations. At first glance, turning the browser into an instrument of mass surveillance might not look like a net privacy improvement for consumers. And arguably the Privacy Sandbox is making some questionable privacy choices, like collecting data from across the entire web to target and measure ads, with or without the consent of the user. But the overall approach introduced by the Privacy Sandbox is a necessary step towards a more privacy-enhanced future: keeping as much personal data on the user’s device prevents data leakage, gives users more control and provides data protection guarantees which contractual obligations simply cannot provide (as the ICO said). Perhaps it’s a case of ‘good idea, wrong execution’.  

‍

The stakes are especially high because the Privacy Sandbox is not just a mere cookie replacement. To close off real and theoretical privacy loopholes, Google has moved the entire bidding process to the browser, creating a “walled garden lite” that favours advertisers, empowers DSPs, penalises publishers, makes SSPs superfluous and shuts off data providers. The industry will therefore have to operate on two parallel cookieless universes: independent ad servers and ad exchanges, and the Privacy Sandbox. 

‍

Unrealistic expectations hurt the industry

Google is optimistic that everything will work out well, but the advertising industry is not impressed. Last week, the IAB Tech Lab released a scathing assessment of the Privacy Sandbox, following a long string of criticisms that characterise its APIs as needlessly complicated, fundamentally opaque and largely ineffective. The concerns involve both the technology itself and the way in which it is governed. Of the forty-four advertising business cases considered, the IAB Tech Lab claims that the Privacy Sandbox APIs can only support a handful without creating a significant business impact for market participants (although Google has issued a detailed response to the report here). Moreover, running real time bidding in the browser gives Google even more control over the market, positioning it as an intermediary to every financial transaction and ad delivery on Chrome. The report calls for governance mechanisms that promote transparency and prevent unfair treatment, arbitrary changes, or vendor lock-in. 

‍

Regardless of the current development maturity, Google must address industry concerns to the extent possible if it wants the Privacy Sandbox to be a useful tool and not just a cudgel to hobble competitors. At the same time, Google’s efforts to improve user privacy should be encouraged, so long as they doen’t hamper the wider industry’s ability to do the same. I don’t think that Google can be expected to solve all the problems of digital advertising without disrupting the privacy free-for-all that is “business as usual”. The privacy changes that users and regulators demand will inevitably cause disruptions and it is not Google’s job to fix broken business models. The ad-tech industry will not survive this momentous shift by bargaining product tweaks with Google, it can only do so by building competing privacy-enhancing products that fill whatever gaps the Privacy Sandbox leaves open.

‍

Competing with the Privacy Sandbox is the way forward

There’s both a moral imperative and a massive market opportunity for the industry to stop relying on outdated technologies and mindsets and start providing privacy-enhanced advertising services. Companies like Anonymised are using privacy-enhancing technologies (PETs) like differential privacy and on-device data processing to meet data protection requirements. Others, like Clean Rooms, are applying PETs to server-side data operations. The IAB Tech Lab has been running a PETs Initiative since 2020, although these discussions have been largely driven by the likes of Google and Meta. 

‍

Market driven competition for new and innovative privacy-preserving services and privacy-enhancing technologies is the way forward. Changing tech stacks and business models that used personal data as a liquid commodity is hard. Google (and Apple) are helping move the market in a more privacy-focused direction, but alternatives like Anonymised are driving innovation, choice, and quality. That’s why the CMA’s oversight of the Privacy Sandbox is crucial. The CMA already guarantees competition from PEAS and ensures that privacy is not used as an excuse to prevent competitors from getting off the ground. It is important for other privacy-enhanced advertising service providers to keep an eye on Google’s conduct, and engage with the CMA if they are affected by anticompetitive behaviour. This will help regulators meet their goal of ensuring that publishers, advertisers and consumers continue to have choice in a competitive digital advertising market, with privacy guaranteed.

‍

Developing alternatives that complement and compete with the Privacy Sandbox is a great outcome for consumers, publishers and advertisers. It will focus creativity and innovation on ways to protect personal data, not on ways to circumvent data protection obligations. It will guarantee choice and competition in the open internet, preventing further market concentration. And it will protect journalists and content creators, keeping the internet largely free to use. For all those providing privacy-enhanced advertising services, now is the time to engage with the CMA. For anyone who claims to care about privacy but really just wants to maintain the status-quo, stop demanding that Google fix all of your problems and start building for privacy. No one company has the monopoly over innovation and ingenuity, the solution is competition.

‍