Google, through a blogpost shared an updated timeline for its Privacy Sandbox milestones, including a fresh set of dates for phasing out third-party cookies.
Launched by Chrome in 2019, the Privacy Sandbox is supposed to be a collaborative, open source effort to develop a new set of standards to define an Open Web Platform that replaces legacy and data-intensive mechanisms with safer solutions that protect the consumer's privacy.
It is important to note that the Privacy Sandbox initiative covers preventing covert tracking, verifying consumers' authenticity, showing relevant content and advertising, and more importantly, measuring digital ads in an anonymized way. A very tall order.
Despite offering more than 30 proposals, along with active engagement with all the industry bodies across brands, platforms and publishers, the reality is that the Privacy Sandbox failed to reach admissible consensus from industry for total deployment. And this falls across two broad areas:
1) On March 23, Google’s FLoC tests were declared non-compliant as per the general data protection regulation (GDPR) standards. FLoC stands for Federated Learning of Cohorts.
Questions were raised about whether a browser assigning users into cohorts counts as a use of personal data without consent, and therefore may be a privacy violation.
Testing of FLoCs was stopped across EU nations, and Google could run its tests only in USA and APAC (Asia-Pacific). Till now, there are no plans around when testing will begin in Europe.
2) The United Kingdom’s Competition and Markets Authority (CMA) announced a formal investigation into Privacy Sandbox in January; we welcomed the opportunity to engage with a regulator with the mandate to promote competition for the benefit of consumers. These commitments include zero self-preferencing and no data advantage for Google advertising products apart from involving the industry for a much deeper consultation and collaboration. This would not have concluded before the end of 2021.
Privacy Sandbox needs more work to gain industry acceptance and adoption. It requires more discussion, more testing, and be ready for scaled up adoption. This is also now linked to a satisfactory clearance from the CMA, UK, before anything can be rolled out.
What does this mean for the industry?
1) This does not mean that the industry will have to wait for the next 24 months and watch Google launch the new Privacy Sandbox through another blog. This is an active industry and regulatory engagement, starting now for the next two years.
2) Once the testing is complete, publishers and the advertising industry will get nine months to migrate their services. Google will then, over a period of three months phase out the support of third-party cookies in late 2023.
Industry must take this opportunity to prepare itself well. The objectives of Privacy Sandbox cannot be faulted. It is just that the path to get there requires more collaboration and consultation. Should Google prefer to avoid the same mistakes again and accelerate the roll out, in my view, it has two steps to take.
1) Browser-based cohorts is a non-starter. We need to move to universally codified cohorts for acceptance and adoption. Industry need to spend a lot more time on this to standardise it.
2) ANA has recently launched an advertiser-to-audience programmatic transparency audit. Perhaps a deeper discussion is required on how there can be zero self-preferencing and no unfair advantage for Google’s advertising products.
And now we have a good 24 months to do this properly. In partnership with Google.