Investigation into Google’s ‘Privacy Sandbox’ browser changes
The CMA has accepted commitments offered by Google that address the CMA’s competition concerns resulting from investigating Google’s proposals to remove third-party cookies and other functionalities from its Chrome browser.
Case timetable
Date | Action |
---|---|
11 February 2022 | CMA commitments decision published and case closure. Implementation of commitments commences |
December 2021 to February 2022 | CMA consideration of representations received in response to the consultation on modified commitments |
26 November 2021 to 17 December 2021 | Modified commitments consultation period |
26 November 2021 | Consultation opened on modified commitments proposed by Google |
October to November 2021 | CMA consideration of possible modifications to the commitments offered by Google |
June to September 2021 | CMA consideration of representations received in response to the consultation on commitments |
11 June 2021 to 8 July 2021 | Commitments consultation period |
11 June 2021 | Consultation opened on commitments proposed by Google |
January 2021 to July 2021 | Initial investigation: information gathering, including issue of formal or informal information requests. CMA analysis and review of information gathered |
January 2021 | Investigation opened |
Change log
The following changes have been made to the case timetable since it was first published in January 2021:
Date of change | Reason for change | Change made to timetable |
---|---|---|
26 November 2021 | The CMA is consulting on modified commitments offered by Google | Dates for modified commitments consultation period and estimated date for CMA’s consideration of representations received in response to the consultation on modified commitments |
15 October 2021 | Additional stage needed, to consider possible modifications to the commitments offered by Google | Estimated time needed for correspondence with Google about possible modifications to the commitments offered by Google |
30 July 2021 | Additional time needed to analyse representations | Estimated date for CMA’s consideration of representations received in response to the consultation on commitments |
11 June 2021 | The CMA is consulting on commitments offered by Google | Date for commitments consultation period and estimated date for CMA’s consideration of representations received in response to the consultation on commitments |
Case information
In February 2022, the CMA accepted commitments from Google (PDF, 141KB) to address its competition concerns resulting from its CA98 investigation into Google’s proposals to remove third-party cookies and other functionalities from its Chrome browser. These commitments involve the CMA working with Google on the design and assessment of the Privacy Sandbox proposals before a final decision is taken to remove third-party cookies from Chrome. This page includes updates on implementation of the commitments, including regular update reports from the CMA and Google, and other relevant information for market participants.
Note: Google’s Android Privacy Sandbox proposals do not fall within the scope of these commitments
Progress reports
Fourth quarterly reports 2022
On 31 January 2023, the CMA published its latest update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. This report sets out the progress made to date and highlights areas of focus where potential concerns have been raised, including through feedback from the wider industry.
- (31.1.23)
The report incorporates the findings from the Monitoring Trustee’s Q4 report, and includes a number of specific questions where we would most value input from interested third parties. We can be reached by email at privacysandbox@cma.gov.uk.
We’ve also published Google’s Q4 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 October 2022 to 31 December 2022.
- (31.1.23)
Under the commitments, Google is required to report on the progress of the Privacy Sandbox proposals, updated timing expectations, its interactions with the CMA and third parties, including on the testing of proposals, as well as the approach taken to address concerns raised. We are publishing the full report to inform third parties of developments on the Privacy Sandbox and progress in implementing the commitments. The commitments put in place a framework within which Google will develop and test the Privacy Sandbox proposals.
We have a role in supervising Google to ensure that the Privacy Sandbox is developed in a way that benefits consumers. As part of this role, we have continued to engage with Google on the design and development of the proposals, raising concerns as appropriate and ensuring that these are addressed in a timely manner.
The Information Commissioner’s Office has been closely involved in this process, given that the aim is to ensure that both competition and privacy are protected. We have also engaged with industry stakeholders who are playing an important part in shaping the development of the proposals.
Third quarterly reports 2022
On 27 October 2022, the CMA published its second update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report incorporates the findings from the Monitoring Trustee’s Q3 report.
- (27.10.22)
We also published Google’s Q3 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 July 2022 to 30 September 2022.
- (27.10.22)
Second quarterly reports 2022
On 28 July 2022, the CMA published its first update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report incorporates the findings from the Monitoring Trustee’s Q2 report.
- (28.7.22)
We’ve also published Google’s Q2 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 April 2022 to 30 June 2022.
- (28.7.22)
First quarterly reports 2022
On 16 May 2022, Google provided us with its first report on its compliance with the binding commitments accepted by the CMA (PDF, 141KB) on 11 February 2022. The report covers the period from 11 February 2022 to 11 May 2022.
- (17.5.22)
We also received an initial report from ING Bank, the Monitoring Trustee, with its assessment of Google’s compliance with those provisions of the commitments which relate to Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33).The report covers the period between 11 February 2022 and 16 May 2022.
ING Bank did not identify any reportable concerns to the CMA.
We are expecting to receive the future quarterly reports from Google and ING Bank to align with calendar quarters.
Note on quantitative testing
On 3 November 2022, the CMA published a note which sets out the framework on how quantitative testing might inform our assessment of Google’s Privacy Sandbox proposals. We will be working with Google to further develop the ideas in this note and to design experiments which Google can carry out itself. Under the commitments, Google has committed to being transparent in reporting the results of its tests. At the same time, we also want to encourage other market participants to get involved in testing.
- (3.11.22)
Monitoring Trustee
Appointment of Technical Expert
On 26 September 2022, the CMA approved the appointment of S-RM Intelligence and Risk Consulting Limited by the Monitoring Trustee (ING Bank N.V.) as an independent Technical Expert to support the Monitoring Trustee in monitoring compliance with the following provisions of the binding commitments accepted by the CMA on 11 February 2022: Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33). The role of the Technical Expert is to provide specialised knowledge to support the Monitoring Trustee, particularly in relation to monitoring of data flows, and understanding the possible impacts of the Privacy Sandbox changes on ad tech markets.
Appointment of Monitoring Trustee
On 23 March 2022, the CMA approved the appointment of ING Bank N.V. by Google as Monitoring Trustee to monitor compliance with those provisions of the binding commitments accepted by the CMA on 11 February 2022 which relate to Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33).
- (23.3.22)
ING Bank also has a role in engaging with interested stakeholders, where they have questions about the nature and scope of the parts of the commitments which it is supervising. ING Bank be reached via the following contacts:
-
ING Trustee Services trustee.services@ing.com
-
Matthew Hancox (Managing Director, Head of Trustee Services, matthew.hancox@ing.com)
-
David Verroken (Director, Trustee Services, david.verroken@ing.com)
Decision to accept binding commitments
On 11 February 2022, the CMA published its decision to accept commitments from Google in relation to its proposals to remove third-party cookies (TPCs) on Chrome and develop its Privacy Sandbox tools.
Formal acceptance of commitments by the CMA brought the investigation to an end, with no decision being made as to whether or not the Competition Act 1998 has been infringed.
- (11.2.22)
- (11.2.22)
- (11.2.22)
- (11.2.22)
- Press release: CMA to keep ‘close eye’ on Google as it secures final Privacy Sandbox commitments (11.2.22)
Consultation on modified commitments
On 26 November 2021, the CMA published a notice of intention to accept the modified commitments offered by Google and has invited representations from interested third parties on these modified commitments.
- Notice of intention to accept modified commitments offered by Google (PDF, 2.04MB) (26.11.21)
- Consultation on modified commitments in respect of Google’s ‘Privacy Sandbox’ browser changes (26.11.21)
- Press release: CMA secures improved commitments on Google’s Privacy Sandbox (26.11.21)
Any person wishing to comment on the modifications to the commitments should submit written representations to:
Angela Nissyrios and Simon Deeble at 50972-Consultation@cma.gov.uk by 17 December 2021 at 5pm.
Please quote the case reference 50972 in all correspondence related to this matter. Any non-disclosure agreement a party may have in place with Google should not prevent them from responding to this consultation. Google has confirmed that it will not use any confidentiality provision with a party to prevent them from responding to this consultation.
As detailed more fully in the related notice, the modified commitments:
- add obligations on Google regarding its transparency and consultation with third parties
- put in place a more transparent process through which Google will develop and test the Privacy Sandbox Proposals
- add commitments to address concerns about Google removing additional functionality or information before TPCs
- provide for a mechanism for the CMA to monitor Google’s adherence to any resolutions reached under the commitments
- clarify the internal limits on the data that Google is allowed to use for the purposes of targeting and measuring digital advertising
- improve the approach to addressing concerns about the potential for Google self-preferencing
- improve the provisions on reporting and compliance
- provide for a longer duration for any commitments
Consultation on commitments
On 11 June 2021, the CMA published a notice of intention to accept the commitments offered by Google and has invited representations from interested third parties.
- (11.6.21)
- Consultation on proposed commitments in respect of Google’s ‘Privacy Sandbox’ browser changes (11.6.21)
- News story: CMA to have key oversight role over Google’s planned removal of third-party cookies (11.6.21)
Any non-disclosure agreement a party may have in place with Google should not prevent them from responding to this consultation. Google has confirmed that it will not use any confidentiality provision with a party to prevent them from responding to this consultation.
The CMA is particularly interested to hear any views on whether the proposed commitments are sufficient to address the CMA’s competition concerns regarding:
- unequal access to the functionality associated with user tracking
- self-preferencing Google’s own ad tech providers and owned and operated ad inventory
- imposition of unfair terms on Chrome’s web users
Case launch
On 7 January 2021, the CMA launched an investigation under Chapter II of the Competition Act 1998 into suspected breaches of competition law by Google. The investigation concerns Google’s proposals to remove third-party cookies (TPCs) on Chrome and replace TPCs functionality with a range of ‘Privacy Sandbox’ tools, while transferring key functionality to Chrome.
- Press release: CMA to investigate Google’s ‘Privacy Sandbox’ browser changes (8.1.21)
Notes
- the investigation is under Chapter II of the Competition Act 1998
- the CMA has not reached a view as to whether there is sufficient evidence of an infringement of competition law for it to issue a statement of objections to any party under investigation. Not all cases result in the CMA issuing a statement of objections
- the CMA will consider any representations it receives before any decision is taken as to whether competition law has in fact been infringed
- further detail of the CMA’s procedures in Competition Act 1998 cases is available in CMA8
- changes to the timing of original entries in the case timetable will be made where the estimated timing changes
Personal data
The CMA may collect, use and share personal data for its investigations, including investigations under the Competition Act 1998. This includes processing personal data for the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018.
You can find more information about how the CMA handles personal information in the CMA’s Personal Information Charter.
Contacts
- Team email privacysandbox@cma.gov.uk
- Project Manager: Matthew Allsop (020 3738 6375, matthew.allsop@cma.gov.uk)
- Assistant Director: Angela Nissyrios (020 3738 6821, angela.nissyrios@cma.gov.uk)
- Director: Chris Jenkins (020 3738 6559, chris.jenkins@cma.gov.uk)
- Senior Responsible Officer: Will Hayter (020 3738 6728, will.hayter@cma.gov.uk)
Last updated 31 January 2023 + show all updates
-
Fourth quarterly reports for 2022 published.
-
Update on proposals for testing published.
-
CMA's second update report and Google's Q3 progress report published.
-
Appointment of technical expert published.
-
Google's Q2 report and CMA progress report published.
-
Google’s quarterly report and monitoring trustee report published.
-
Appointment of monitoring trustee published.
-
Decision to accept binding commitments published.
-
Notice of intention to accept modified commitments and link to consultation published on the page.
-
Updates made to case timetable.
-
Update to the administrative timetable published.
-
Notice of intention to accept binding commitments published, link to public consultation on commitments added to the page.
-
First published.