Google has reached an agreement with the UK CMA to strengthen the monitoring of the Privacy Sandbox.

The Adtech giant has agreed to another set of commitments linked to the review of its planned migration away from tracking cookies as part of an ongoing antitrust inquiry into Google's UK intelligence agency's secrecy box, the regulator revealed today. Google has also posted a blog post about the changes, stating that they are intended to "underline our obligation to ensure that the progress we make in Chrome applies similarly to Google's external marketing products, and that the Privacy Sandbox APIs will be designed, developed and implemented with regulatory oversight and input from the CMA [Competition and Markets Authority] and the ICO [Information Commissioner's Office]. "

Google announced its intention to abolish third-party tracking cookie support used to target individuals in its Chrome browser as early as 2019 - and has since worked on what they claim are less intrusive alternative ad targeting techniques (called "Privacy Box"). ").

The basic idea is to move away from ads that are targeted at individuals (which is terrible for the privacy of Internet users) and towards targeting methods that place Internet users in interest-based buckets and show ads to so-called "cohorts" of users (aka, FloCs), which can be smaller individually intrusive - but it is important to note that Google's proposed alternatives still have many detractors (EFF, for example, has suggested that it could even exacerbate problems such as discrimination and incredible advertising targeting).

In addition, many privacy advocates argue that pure content targeting does the least harm to the rights of Internet users while allowing advertisers to reach relevant audiences and publishers to monetize their content.

Advertisers and publishers, who would be directly affected by the changes, have been the loudest in their opposition to Google's Sandbox proposal. Some have expressed concern that the transition from monitoring cookies will only increase Google's market dominance, prompting the Competition and Marketing Authority (CMA) to launch an antitrust inquiry into the strategy in January.

As part of that review, the CMA had in fact been given a bunch of responsibilities from Google as to how to proceed with the change, including agreeing to end each transition to degrading goodies provided the controller was not met that progress could occur such as applies to both rivalry and protection, just as agreements on self-preference, in addition to other things. 

A market conference on the underlying division of responsibilities provoked reactions from over 40 outsiders, including, as indicated by TechCrunch, contributions from global auditors (some of whom are also exploring Google's Sandbox, such as the European Commission, which sent its own review of Google's adtech in June).

Subsequently, the first list of proposed commitments was broadened and tightened with additional criteria (see below for a summary, and here for more information from the CMA's "Notice of intent to accept the updated commitments").

The CMA will now conduct a consultation on the extended set, with a deadline of 17.00 on 17 December 2021, to receive new input.

It is then determined whether the enhanced package has sufficient controls and balances to ensure that Google implements the change from tracking cookies with the least possible impact on competition and least harm to users' privacy (although the latter item will ultimately be monitored by the UK ICO) .

If the CMA is satisfied with the responses to the updated promises, it will close the request and initiate a new period of active monitoring, as described in the details of the agreement it proposes with Google.

A possible date for this is early 2022, although nothing has been verified yet.

CMA CEO Andrea Coscelli said in a statement:

"" We have for some time been confident that Google's efforts to protect customer protection should not be to the detriment of limited rivalry. "

That is why throughout this process we have worked with the Information Commissioner's offices, CMA's overseas colleagues and stakeholders from across the industry to ensure a successful solution for all.

We appreciate Google's cooperation and are grateful to everyone who participated in the consultation.

If approved by Google, Google's obligations will become legally binding, increasing competition in digital marketplaces, helping online publishers raise money through advertising, and protecting users' privacy. "

More market assurance

In general, the new promises appear to be designed to give the market greater certainty that Google will not be able to exploit vulnerabilities in regulatory monitoring of the sandbox to undo the intended effect of resolving competition and privacy issues.

In particular, Google has agreed to designate a CMA-approved monitoring manager as one of the additional measures proposed to strengthen reporting and compliance procedures.

It will also increase reporting requirements, as well as agree to include the CMA's role and the ongoing regulatory process - which the CMA now proposes to last for six years - in its "key public announcements", as well as regular (quarterly) reporting to the CMA on how it takes into account third party opinions as it continues to expand the technology package.

Transparency around testing is also expanded.

In this regard, there have been occasions in recent months where Google employees have been less careful about expressing the nuances of comments linked to the Origin Trial of its FloCs technology to the market, for example. As a result, another major change forces Google to advise its employees not to make promises to consumers who break their promises.

Another concern reflected in the revisions is market participants' fears that Google will remove functionality or information before the full changes to the Privacy Sandbox are implemented - which is why they have offered to postpone the implementation of their draft privacy budget and made commitments to implement measures for to reduce access to IP addresses.

We realize that market participants were concerned that Google would eliminate additional features, such as the user agent string, and that the stronger commitments are also intended to address these broader issues.

The conditions for self-preference have also been expanded. The updated promises also include explanations of the internal limitations of data that Google may use - and the administrator will closely monitor these parts.

The CMA's active monitoring period has also been extended compared to the previous proposal, to six years from the date of a decision to accept Google's updated obligations (up from about five).

This means that if the CMA approves the commitments next year, they could last until 2028. And the UK intends to have changed the competition rules around the tech giant by then - which

In its own blog post, Google then collects the updated responsibilities:

Monitoring and reporting are crucial. We have voluntarily appointed an impartial monitoring manager with the necessary access and technical expertise to guarantee compliance.

Consultation and testing We have provided CMA with more comprehensive test promises, as well as a more open method for collecting market comments on the Privacy Sandbox ideas.

More clarification on how we use data. We reiterate our commitment not to use Google's first-person data to monitor users for the purpose of targeting and measuring advertising displayed on non-Google websites. Our promises would similarly restrict the use of Chrome browser history and Analytics data for this purpose on Google and non-Google websites.

It has promised to implement the extra promises internationally, as it did with the latest set of promises, if the package is approved by the UK regulator.

As a result, the UK regulator continues to play an important role in defining the growth of online infrastructure.

Google's blog also mentions an opinion given yesterday by the UK Information Commission, which advised the adtech sector to abandon current ad targeting and profiling methods.

"" We also support the goals set yesterday in the ICO's

Assessing data security and protection assumptions for web-based marketing recommendations, "Google said." This includes the importance of supporting and creating secure marketing devices that ensure the protection of individuals and prevent covert tracking. "

This summer, Google announced a postponement of the phasing out of tracking cookies, stating that support will not be phased out in Chrome until the second half of 2023.

So far, the technical titan has not mentioned any more delays in that schedule - provided it receives regulatory approval to continue.