Investigation into Google’s ‘Privacy Sandbox’ browser changes

The CMA has accepted commitments offered by Google that address the CMA’s competition concerns resulting from investigating Google’s proposals to remove third-party cookies and other functionalities from its Chrome browser.

From:
Competition and Markets Authority
Published
8 January 2021
Last updated
31 January 2023 — See all updates
Case type:
CA98 and civil cartels
Case state:
Open
Market sector:
Communications
Opened:
7 January 2021

Case timetable

Date Action
11 February 2022 CMA commitments decision published and case closure. Implementation of commitments commences
December 2021 to February 2022 CMA consideration of representations received in response to the consultation on modified commitments
26 November 2021 to 17 December 2021 Modified commitments consultation period
26 November 2021 Consultation opened on modified commitments proposed by Google
October to November 2021 CMA consideration of possible modifications to the commitments offered by Google
June to September 2021 CMA consideration of representations received in response to the consultation on commitments
11 June 2021 to 8 July 2021 Commitments consultation period
11 June 2021 Consultation opened on commitments proposed by Google
January 2021 to July 2021 Initial investigation: information gathering, including issue of formal or informal information requests. CMA analysis and review of information gathered
January 2021 Investigation opened

Change log

The following changes have been made to the case timetable since it was first published in January 2021:

Date of change Reason for change Change made to timetable
26 November 2021 The CMA is consulting on modified commitments offered by Google Dates for modified commitments consultation period and estimated date for CMA’s consideration of representations received in response to the consultation on modified commitments
15 October 2021 Additional stage needed, to consider possible modifications to the commitments offered by Google Estimated time needed for correspondence with Google about possible modifications to the commitments offered by Google
30 July 2021 Additional time needed to analyse representations Estimated date for CMA’s consideration of representations received in response to the consultation on commitments
11 June 2021 The CMA is consulting on commitments offered by Google Date for commitments consultation period and estimated date for CMA’s consideration of representations received in response to the consultation on commitments

Case information

In February 2022, the CMA accepted commitments from Google (PDF, 141KB) to address its competition concerns resulting from its CA98 investigation into Google’s proposals to remove third-party cookies and other functionalities from its Chrome browser. These commitments involve the CMA working with Google on the design and assessment of the Privacy Sandbox proposals before a final decision is taken to remove third-party cookies from Chrome. This page includes updates on implementation of the commitments, including regular update reports from the CMA and Google, and other relevant information for market participants.

Note: Google’s Android Privacy Sandbox proposals do not fall within the scope of these commitments

Progress reports

Fourth quarterly reports 2022

On 31 January 2023, the CMA published its latest update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. This report sets out the progress made to date and highlights areas of focus where potential concerns have been raised, including through feedback from the wider industry.

The report incorporates the findings from the Monitoring Trustee’s Q4 report, and includes a number of specific questions where we would most value input from interested third parties. We can be reached by email at privacysandbox@cma.gov.uk.

We’ve also published Google’s Q4 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 October 2022 to 31 December 2022.

Under the commitments, Google is required to report on the progress of the Privacy Sandbox proposals, updated timing expectations, its interactions with the CMA and third parties, including on the testing of proposals, as well as the approach taken to address concerns raised. We are publishing the full report to inform third parties of developments on the Privacy Sandbox and progress in implementing the commitments. The commitments put in place a framework within which Google will develop and test the Privacy Sandbox proposals.

We have a role in supervising Google to ensure that the Privacy Sandbox is developed in a way that benefits consumers. As part of this role, we have continued to engage with Google on the design and development of the proposals, raising concerns as appropriate and ensuring that these are addressed in a timely manner.

The Information Commissioner’s Office has been closely involved in this process, given that the aim is to ensure that both competition and privacy are protected. We have also engaged with industry stakeholders who are playing an important part in shaping the development of the proposals.

Third quarterly reports 2022

On 27 October 2022, the CMA published its second update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report incorporates the findings from the Monitoring Trustee’s Q3 report.

We also published Google’s Q3 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 July 2022 to 30 September 2022.

Second quarterly reports 2022

On 28 July 2022, the CMA published its first update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report incorporates the findings from the Monitoring Trustee’s Q2 report.

We’ve also published Google’s Q2 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 April 2022 to 30 June 2022.

First quarterly reports 2022

On 16 May 2022, Google provided us with its first report on its compliance with the binding commitments accepted by the CMA (PDF, 141KB) on 11 February 2022. The report covers the period from 11 February 2022 to 11 May 2022.

We also received an initial report from ING Bank, the Monitoring Trustee, with its assessment of Google’s compliance with those provisions of the commitments which relate to Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33).The report covers the period between 11 February 2022 and 16 May 2022.

ING Bank did not identify any reportable concerns to the CMA.

We are expecting to receive the future quarterly reports from Google and ING Bank to align with calendar quarters.

Note on quantitative testing

On 3 November 2022, the CMA published a note which sets out the framework on how quantitative testing might inform our assessment of Google’s Privacy Sandbox proposals. We will be working with Google to further develop the ideas in this note and to design experiments which Google can carry out itself. Under the commitments, Google has committed to being transparent in reporting the results of its tests. At the same time, we also want to encourage other market participants to get involved in testing.

Monitoring Trustee

Appointment of Technical Expert

On 26 September 2022, the CMA approved the appointment of S-RM Intelligence and Risk Consulting Limited by the Monitoring Trustee (ING Bank N.V.) as an independent Technical Expert to support the Monitoring Trustee in monitoring compliance with the following provisions of the binding commitments accepted by the CMA on 11 February 2022: Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33). The role of the Technical Expert is to provide specialised knowledge to support the Monitoring Trustee, particularly in relation to monitoring of data flows, and understanding the possible impacts of the Privacy Sandbox changes on ad tech markets.

Appointment of Monitoring Trustee

On 23 March 2022, the CMA approved the appointment of ING Bank N.V. by Google as Monitoring Trustee to monitor compliance with those provisions of the binding commitments accepted by the CMA on 11 February 2022 which relate to Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33).

ING Bank also has a role in engaging with interested stakeholders, where they have questions about the nature and scope of the parts of the commitments which it is supervising. ING Bank be reached via the following contacts:

Decision to accept binding commitments

On 11 February 2022, the CMA published its decision to accept commitments from Google in relation to its proposals to remove third-party cookies (TPCs) on Chrome and develop its Privacy Sandbox tools.

Formal acceptance of commitments by the CMA brought the investigation to an end, with no decision being made as to whether or not the Competition Act 1998 has been infringed.

Consultation on modified commitments

On 26 November 2021, the CMA published a notice of intention to accept the modified commitments offered by Google and has invited representations from interested third parties on these modified commitments.

Any person wishing to comment on the modifications to the commitments should submit written representations to:

Angela Nissyrios and Simon Deeble at 50972-Consultation@cma.gov.uk by 17 December 2021 at 5pm.

Please quote the case reference 50972 in all correspondence related to this matter. Any non-disclosure agreement a party may have in place with Google should not prevent them from responding to this consultation. Google has confirmed that it will not use any confidentiality provision with a party to prevent them from responding to this consultation.

As detailed more fully in the related notice, the modified commitments:

  • add obligations on Google regarding its transparency and consultation with third parties
  • put in place a more transparent process through which Google will develop and test the Privacy Sandbox Proposals
  • add commitments to address concerns about Google removing additional functionality or information before TPCs
  • provide for a mechanism for the CMA to monitor Google’s adherence to any resolutions reached under the commitments
  • clarify the internal limits on the data that Google is allowed to use for the purposes of targeting and measuring digital advertising
  • improve the approach to addressing concerns about the potential for Google self-preferencing
  • improve the provisions on reporting and compliance
  • provide for a longer duration for any commitments

Consultation on commitments

On 11 June 2021, the CMA published a notice of intention to accept the commitments offered by Google and has invited representations from interested third parties.

Any non-disclosure agreement a party may have in place with Google should not prevent them from responding to this consultation. Google has confirmed that it will not use any confidentiality provision with a party to prevent them from responding to this consultation.

The CMA is particularly interested to hear any views on whether the proposed commitments are sufficient to address the CMA’s competition concerns regarding:

  • unequal access to the functionality associated with user tracking
  • self-preferencing Google’s own ad tech providers and owned and operated ad inventory
  • imposition of unfair terms on Chrome’s web users

Case launch

On 7 January 2021, the CMA launched an investigation under Chapter II of the Competition Act 1998 into suspected breaches of competition law by Google. The investigation concerns Google’s proposals to remove third-party cookies (TPCs) on Chrome and replace TPCs functionality with a range of ‘Privacy Sandbox’ tools, while transferring key functionality to Chrome.

Notes

  • the investigation is under Chapter II of the Competition Act 1998
  • the CMA has not reached a view as to whether there is sufficient evidence of an infringement of competition law for it to issue a statement of objections to any party under investigation. Not all cases result in the CMA issuing a statement of objections
  • the CMA will consider any representations it receives before any decision is taken as to whether competition law has in fact been infringed
  • further detail of the CMA’s procedures in Competition Act 1998 cases is available in CMA8
  • changes to the timing of original entries in the case timetable will be made where the estimated timing changes

Personal data

The CMA may collect, use and share personal data for its investigations, including investigations under the Competition Act 1998. This includes processing personal data for the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018.

You can find more information about how the CMA handles personal information in the CMA’s Personal Information Charter.

Contacts

Published 8 January 2021
Last updated 31 January 2023 + show all updates

  1. Fourth quarterly reports for 2022 published.

  2. Update on proposals for testing published.

  3. CMA's second update report and Google's Q3 progress report published.

  4. Appointment of technical expert published.

  5. Google's Q2 report and CMA progress report published.

  6. Google’s quarterly report and monitoring trustee report published.

  7. Appointment of monitoring trustee published.

  8. Decision to accept binding commitments published.

  9. Notice of intention to accept modified commitments and link to consultation published on the page.

  10. Updates made to case timetable.

  11. Update to the administrative timetable published.

  12. Notice of intention to accept binding commitments published, link to public consultation on commitments added to the page.

  13. First published.

Contents

Related content