The UK’s Competition and Markets Authority (“CMA”), Information Commissioner’s Office (“ICO”) and Google have agreed legally binding commitments from Google on the development of its Privacy Sandbox proposals.

These proposals relate to the removal of third-party cookies – to be phased out by 2023 – in the Chrome browser and Chromium browser engine, which will be replaced with the proposed “Privacy Sandbox” tools for targeted advertising. Google’s stated objectives in developing the Privacy Sandbox proposals are to make the web more private and secure for users, moving towards a more privacy-focused web browsing experience and to ensure that the new tools meet the requirements set out in the recent ICO’s Opinion on Data protection and privacy expectations for online advertising proposals.

However, Movement for an Open Web, which consists of tech businesses, advertisers and publishers, raised concerns that Google’s proposals could shut out competition publishers and ad tech providers, affecting their ability to generate revenue through targeted advertising and entrench Google’s market power. They raised a formal complaint to the CMA, which triggered consultations involving the CMA and ICO in 2021.

The CMA and ICO engaged in discussions with Google over its commitments to develop the Privacy Sandbox proposals, which can be enforced by the CMA under section 31A of the Competition Act 1998.

In early February 2022, it was announced that modified commitments have been agreed and accepted by the CMA and the ICO and they include:

• The CMA and ICO to be involved in developing and testing the Privacy Sandbox proposals;

• Google to increase the level of publicly available information and transparency in its development notably by consulting with third parties/stakeholders, publishing regular updates and test results (enabling publishers, advertisers and ad tech providers to influence the Privacy Sandbox and to adjust their business models), and addressing issues raised by the CMA and industry stakeholders;

• Google to inform the CMA in advance of its intention to remove third-party cookies and agree to wait (during a “standstill period” of several months) for their feedback on whether any competition law concerns remain;

• Google committing not to share, for advertising purposes, within its ecosystem, personal data collected for another purpose, after the end of support for third-party cookies, as well as not to track users to target or measure digital advertising on ad inventory on websites not owned and operated by Google;

• Google committing not to discriminate against competitors in favour of its advertising services; and

• Google to appoint a monitoring trustee to work alongside the CMA and monitor the commitments effectively.

The commitments will terminate six years from the date they are accepted by the CMA (i.e. February 2028), unless released at an earlier date.

Google’s Privacy Sandbox proposals are still in development and these commitments aim to reassure consumers and competitors that any changes will “protect competitors” and support a “competitive ad-funded web”.

Hannah-Mei Grisley also contributed to this article.