Google’s Privacy Sandbox to Get Regulatory Oversight

Google has agreed to create its upcoming Privacy Sandbox “with regulatory oversight and input” from the UK Competition and Markets Authority (CMA). The CMA had previously announced that it was investigating the Privacy Sandbox, which Google designed to keep its advertising empire intact amidst calls for privacy protections, for antitrust violations.

“The Privacy Sandbox APIs will be designed, developed, and implemented with regulatory oversight and input from the CMA and the UK Information Commissioner’s Office (ICO),” a new post to the Google Keyword blog explains. “We also support the objectives set out yesterday in the ICO’s Opinion on Data protection and privacy expectations for online advertising proposals, including the importance of supporting and developing privacy-safe advertising tools that protect people’s privacy and prevent covert tracking.”

Google announced its Privacy Sandbox this past March because the proliferation of advertising-based tracking on the web had eroded the trust of its users. The goal of the technology is to keep Google’s advertising engine rolling while reducing the online tracking of its users, two completely contradictory aims. As a result, the controversial change immediately came under fire from competitors and privacy advocates. And the UK is investigating this change because of its antitrust implications.

Google has since delayed the implementation of the Privacy Sandbox twice, in June and then July, in order to address the complaints and stave off more antitrust troubles. But it has been working with the UK’s CMA and ISO behind the scenes as well. And now it is offering the following changes to the Privacy Sandbox, which Google says will “apply in the same way to Google’s ad tech products as to any third party”:

• As noted above, the Privacy Sandbox APIs will be designed, developed, and implemented with regulatory oversight and input from the CMA and the ICO.
• Google will appoint an independent Monitoring Trustee who will have the access and technical expertise needed to ensure compliance with the ICO’s Opinion on Data protection and privacy expectations.
• It will provide the CMA with more extensive testing commitments and a more transparent process for getting feedback on these proposals.
• And it will commit to not using “Google first-party personal data to track users for targeting and measurement of ads shown on non-Google websites”; this would also restrict the use of Chrome browsing history and Analytics data to do this on Google or non-Google websites.

If these proposals are accepted by the CMA, Google will apply them globally.

“We continue to appreciate the thoughtful approach and engagement from the CMA and ICO as we develop our Privacy Sandbox proposals,” Google concludes. “We welcome, and will carefully consider, any comments that people provide during the consultation process.”

Google doesn’t note whether these changes will require another delay for the Privacy Sandbox, which is currently scheduled to start rolling out in a two-stage transition that starts in Q4 2022 and concludes in Q3 2023.