Investigation into Google’s ‘Privacy Sandbox’ browser changes

The CMA has accepted commitments offered by Google that address the CMA’s competition concerns resulting from investigating Google’s proposals to remove third-party cookies and other functionalities from its Chrome browser.

From:
Competition and Markets Authority
Published
8 January 2021
Last updated
20 December 2024 — See all updates
Case type:
CA98 and civil cartels
Case state:
Open
Market sector:
Communications
Opened:
7 January 2021

Latest case updates

December 2024

The CMA is continuing to engage in discussions with Google on changes to the commitments. The CMA now expects to provide a further update on these discussions, and the Privacy Sandbox more broadly, in the new year.

September 2024

On 22 July 2024, Google announced that it is changing its approach to Privacy Sandbox. Instead of removing third-party cookies from Chrome, it will allow users to choose whether to retain third party cookies [email protected]. The CMA invited stakeholders to share their initial views on Google’s revised approach, and possible implications for consumers and market outcomes, by 12 August 2024.

Based on careful consideration of the responses we received, the CMA’s view is that competition concerns remain under Google’s revised approach. The CMA wants to ensure that these changes are made in a way which supports continued competition in digital advertising. The current commitments would need to be updated to reflect the evolution in Google’s planned Privacy Sandbox browser changes and the CMA is discussing with Google what changes would be required to address the CMA’s competition concerns. If the CMA is not able to agree changes to the commitments with Google which address the competition concerns, then the CMA will consider what further action may be necessary.

The CMA will continue to work with the Information Commissioner’s Office (ICO) to consider privacy and user choice design concerns in relation to Google’s revised approach.

Quarterly reports

Q2/Q3 2024

On 11 November 2024, the CMA published its latest update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report sets out the CMA’s current views on the Privacy Sandbox tools. Also, it incorporates the Monitoring Trustee’s assessment of Google’s compliance with the relevant provisions of the commitments.

The CMA also published Google’s progress report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 April 2024 to 30 September 2024.

Under the commitments, Google is required to report on the progress of the Privacy Sandbox proposals, its interactions with the CMA and third parties, as well as the approach taken to address concerns raised. We are publishing the full report to inform third parties of developments on the Privacy Sandbox.

We have a role in supervising Google to ensure that the Privacy Sandbox is developed in a way that benefits consumers. As part of this role, we have continued to engage with Google on the design and development of the proposals.

The ICO has been closely involved in this process, given that the aim is to ensure that both competition and privacy are protected.

Q1 2024

On 26 April 2024, the CMA published its latest update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. This report sets out the progress made to date, including the CMA’s latest views on the potential impact of Google’s proposed Privacy Sandbox changes.

It summarises stakeholder responses to the call for input following our Q4 2023 report and highlights areas where competition concerns remain. The report also incorporates the findings from the Monitoring Trustee’s Q1 2024 report.

We’ve also published Google’s Q1 2024 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 January 2024 to 31 March 2024.

Q4 2023

On January 31 2024, the CMA published its update report for Q4 2023 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q4 2023 report.

We’ve also published Google’s Q4 2023 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 October 2023 to 31 December 2023.

Q3 2023

On 26 October 2023, the CMA published its update report for Q3 2023 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q3 2023 report.

We’ve also published Google’s Q3 2023 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 July 2023 to 30 September 2023.

Q2 2023

On 27 July 2023, the CMA published its update report for Q2 2023 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q2 2023 report.

We’ve also published Google’s Q2 2023 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 April 2023 to 30 June 2023.

Q1 2023

On 27 April 2023, the CMA published its update report for Q1 2023 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q1 2023 report.

We also published Google’s Q1 2023 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 January 2023 to 31 March 2023.

Q4 2022

On 31 January 2023, the CMA published its update report for Q4 2022 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q4 2022 report.

We also published Google’s Q4 2022 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 October 2022 to 31 December 2022.

Q3 2022

On 27 October 2022, the CMA published its Q3 2022 update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q3 2022 report.

We also published Google’s Q3 2022 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 July 2022 to 30 September 2022.

Q2 2022

On 28 July 2022, the CMA published its first update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report incorporates the findings from the Monitoring Trustee’s Q2 2022 report.

We also published Google’s Q2 2022 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 April 2022 to 30 June 2022.

First quarterly reports 2022

On 16 May 2022, Google provided us with its first report on its compliance with the binding commitments accepted by the CMA (PDF, 141KB) on 11 February 2022. The report covers the period from 11 February 2022 to 11 May 2022.

We also received an initial report from ING Bank, the Monitoring Trustee, with its assessment of Google’s compliance with those provisions of the commitments which relate to Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33).The report covers the period between 11 February 2022 and 16 May 2022.

ING Bank did not identify any reportable concerns to the CMA.

We are expecting to receive the future quarterly reports from Google and ING Bank to align with calendar quarters.

2022 case updates

In February 2022, the CMA accepted Google’s Privacy Sandbox commitments (PDF, 141KB) to address its competition concerns resulting from its CA98 investigation into Google’s proposals to remove third-party cookies and other functionalities from its Chrome browser. These commitments involve the CMA working with Google on the design and assessment of the Privacy Sandbox proposals before a final decision is taken to remove third-party cookies from Chrome. This page includes updates on implementation of the commitments, including regular update reports from the CMA and Google, and other relevant information for market participants.

Note: Google’s Android Privacy Sandbox proposals do not fall within the scope of these commitments

Industry testing

On 26 October 2023, the CMA published additional guidance for ad techs, publishers, and advertisers intending to test the Privacy Sandbox tools. This guidance provides detail on how market participants should use Google’s planned testing modes in Chrome in order to generate results which are comparable and informative to our assessment.

On 29 June 2023, the CMA published a further guidance note to advise ad techs, publishers, and advertisers on how they can test the Privacy Sandbox tools in a way that would contribute to our assessment of Google’s technologies. We envisage most testing taking place between Q4 2023 and Q2 2024. The note provides details of two preferred approaches to testing, the metrics we would like to capture, and information market participants can submit to the CMA so we can understand results of testing. The note also describes how the CMA’s preferred testing approaches align with Google’s testing framework.

On 3 November 2022, the CMA published a note which sets out the framework on how quantitative testing might inform our assessment of Google’s Privacy Sandbox proposals. We will be working with Google to further develop the ideas in this note and to design experiments which Google can carry out itself. Under the commitments, Google has committed to being transparent in reporting the results of its tests. At the same time, we also want to encourage other market participants to get involved in testing.

Monitoring Trustee

Appointment of Technical Expert

On 26 September 2022, the CMA approved the appointment of S-RM Intelligence and Risk Consulting Limited by the Monitoring Trustee (ING Bank N.V.) as an independent Technical Expert to support the Monitoring Trustee in monitoring compliance with the following provisions of the binding commitments accepted by the CMA on 11 February 2022: Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33). The role of the Technical Expert is to provide specialised knowledge to support the Monitoring Trustee, particularly in relation to monitoring of data flows, and understanding the possible impacts of the Privacy Sandbox changes on ad tech markets.

Appointment of Monitoring Trustee

On 23 March 2022, the CMA approved the appointment of ING Bank N.V. by Google as Monitoring Trustee to monitor compliance with those provisions of the binding commitments accepted by the CMA on 11 February 2022 which relate to Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33).

ING Bank also has a role in engaging with interested stakeholders, where they have questions about the nature and scope of the parts of the commitments which it is supervising. ING Bank be reached via the following contacts:

Case timetable

Date Action
11 February 2022 CMA commitments decision published and case closure. Implementation of commitments commences
December 2021 to February 2022 CMA consideration of representations received in response to the consultation on modified commitments
26 November 2021 to 17 December 2021 Modified commitments consultation period
26 November 2021 Consultation opened on modified commitments proposed by Google
October to November 2021 CMA consideration of possible modifications to the commitments offered by Google
June to September 2021 CMA consideration of representations received in response to the consultation on commitments
11 June 2021 to 8 July 2021 Commitments consultation period
11 June 2021 Consultation opened on commitments proposed by Google
January 2021 to July 2021 Initial investigation: information gathering, including issue of formal or informal information requests. CMA analysis and review of information gathered
January 2021 Investigation opened

Change log

The following changes have been made to the case timetable since it was first published in January 2021:

Date of change Reason for change Change made to timetable
26 November 2021 The CMA is consulting on modified commitments offered by Google Dates for modified commitments consultation period and estimated date for CMA’s consideration of representations received in response to the consultation on modified commitments
15 October 2021 Additional stage needed, to consider possible modifications to the commitments offered by Google Estimated time needed for correspondence with Google about possible modifications to the commitments offered by Google
30 July 2021 Additional time needed to analyse representations Estimated date for CMA’s consideration of representations received in response to the consultation on commitments
11 June 2021 The CMA is consulting on commitments offered by Google Date for commitments consultation period and estimated date for CMA’s consideration of representations received in response to the consultation on commitments

Decision to accept binding commitments

On 11 February 2022, the CMA published its decision to accept commitments from Google in relation to its proposals to remove third-party cookies (TPCs) on Chrome and develop its Privacy Sandbox tools.

Formal acceptance of commitments by the CMA brought the investigation to an end, with no decision being made as to whether or not the Competition Act 1998 has been infringed.

Consultation on modified commitments

On 26 November 2021, the CMA published a notice of intention to accept the modified commitments offered by Google and has invited representations from interested third parties on these modified commitments.

Any person wishing to comment on the modifications to the commitments should submit written representations to:

Angela Nissyrios and Simon Deeble at [email protected] by 17 December 2021 at 5pm.

Please quote the case reference 50972 in all correspondence related to this matter. Any non-disclosure agreement a party may have in place with Google should not prevent them from responding to this consultation. Google has confirmed that it will not use any confidentiality provision with a party to prevent them from responding to this consultation.

As detailed more fully in the related notice, the modified commitments:

  • add obligations on Google regarding its transparency and consultation with third parties
  • put in place a more transparent process through which Google will develop and test the Privacy Sandbox Proposals
  • add commitments to address concerns about Google removing additional functionality or information before TPCs
  • provide for a mechanism for the CMA to monitor Google’s adherence to any resolutions reached under the commitments
  • clarify the internal limits on the data that Google is allowed to use for the purposes of targeting and measuring digital advertising
  • improve the approach to addressing concerns about the potential for Google self-preferencing
  • improve the provisions on reporting and compliance
  • provide for a longer duration for any commitments

Consultation on commitments

On 11 June 2021, the CMA published a notice of intention to accept the commitments offered by Google and has invited representations from interested third parties.

Any non-disclosure agreement a party may have in place with Google should not prevent them from responding to this consultation. Google has confirmed that it will not use any confidentiality provision with a party to prevent them from responding to this consultation.

The CMA is particularly interested to hear any views on whether the proposed commitments are sufficient to address the CMA’s competition concerns regarding:

  • unequal access to the functionality associated with user tracking
  • self-preferencing Google’s own ad tech providers and owned and operated ad inventory
  • imposition of unfair terms on Chrome’s web users

Case launch

On 7 January 2021, the CMA launched an investigation under Chapter II of the Competition Act 1998 into suspected breaches of competition law by Google. The investigation concerns Google’s proposals to remove third-party cookies (TPCs) on Chrome and replace TPCs functionality with a range of ‘Privacy Sandbox’ tools, while transferring key functionality to Chrome.

Notes

  • the investigation is under Chapter II of the Competition Act 1998
  • the CMA has not reached a view as to whether there is sufficient evidence of an infringement of competition law for it to issue a statement of objections to any party under investigation. Not all cases result in the CMA issuing a statement of objections
  • the CMA will consider any representations it receives before any decision is taken as to whether competition law has in fact been infringed
  • further detail of the CMA’s procedures in Competition Act 1998 cases is available in CMA8
  • changes to the timing of original entries in the case timetable will be made where the estimated timing changes

Personal data

The CMA may collect, use and share personal data for its investigations, including investigations under the Competition Act 1998. This includes processing personal data for the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018.

You can find more information about how the CMA handles personal information in the CMA’s Personal Information Charter.

Contacts

Updates to this page

Published 8 January 2021
Last updated 20 December 2024 + show all updates

  1. December 2024 progress update added.

  2. Latest progress update reports from the CMA and Google published.

  3. Updated statement regarding Google’s revised approach, and project manager contact details updated.

  4. Update on Google’s approach to Privacy Sandbox published.

  5. Q1 2024 update reports published.

  6. Q4 2023 update reports published.

  7. CMA Q3 2023 update report and additional guidance published

  8. Q2 2023 CMA report and Q2 2023 Google report published.

  9. Guidance note published

  10. Quarter 1 2023 progress report updated.

  11. Fourth quarterly reports for 2022 published.

  12. Update on proposals for testing published.

  13. CMA's second update report and Google's Q3 progress report published.

  14. Appointment of technical expert published.

  15. Google's Q2 report and CMA progress report published.

  16. Google’s quarterly report and monitoring trustee report published.

  17. Appointment of monitoring trustee published.

  18. Decision to accept binding commitments published.

  19. Notice of intention to accept modified commitments and link to consultation published on the page.

  20. Updates made to case timetable.

  21. Update to the administrative timetable published.

  22. Notice of intention to accept binding commitments published, link to public consultation on commitments added to the page.

  23. First published.

Contents

Related content