Competition advocates urge further Privacy Sandbox delays

Such parties highlight how Google’s proposals within Privacy Sandbox effectively equate to the Chrome browser fulfilling the role of ad server and supply-side platform. For example, if Google’s proposals receive full approval from the U.K.’s Competition Markets Authority, effectively the global lead regulator on Privacy Sandbox, they argue, it could nullify any potential remedies sought by antitrust authorities in the U.S.   

Meanwhile, privacy lobbyists cite legislation such as the European Union’s General Data Protection Regulations and the California Privacy Rights Act as models. Even as ad tech independents argue that Big Tech is exploiting loopholes in such laws to entrench its dominance further consumer advocates remind them it’s important not to remain true to the initial spirit of the legislation.

Some wonder if the two regulatory ideals are at odds with one another.

International lawmakers look to bolster privacy… 

Both independent ad tech and Big Tech were targeted by international regulatory bodies in early 2024, with headlines centering on the former’s surveillance techniques. 

In fact, privacy watchdogs have expressed concern at the conduct of all constituents of the ad tech sector. In early March, the Federal Trade Commission furthered its crackdown on data brokers, asserting that consumers’ browsing and location data are sensitive. 

“Firms do not have a free license to market, sell, and monetize people’s information beyond purposes to provide their requested product or service,” read its March 4 statement, which further underlined earlier enforcement proposals against Avast, InMarket, and X-Mode for the mishandling of consumer data. 

In the same week, the Court of Justice of the European Union dealt the industry a blow, ruling the industry’s proposed model for passing consumer consent signals to third parties under GDPR, i.e., the Transparency Consent Framework, contains PII.

Furthermore, the ruling asserted IAB Europe — the trade org is the steward of TCF — is jointly responsible for the consent strings generated under the framework along with the companies participating in such a transaction. 

IAB Europe contests CJEU’s conclusion, and the Belgian Market Court will resume its examination of IAB Europe’s appeal of a February 2022 decision by the Belgian Data Protection Authority, which ruled that TCF did not comply with GDPR. 

… while regulators seek to boost competition

In parallel, Big Tech — and in the ad tech sector, this primarily means Google — remains in the crosshairs of competition authorities on either side of the Atlantic Ocean, with the March 7 enforcement of the EU’s Digital Markets Act a prime example.

Google is at the epicenter of this storm, and in recent weeks, over 30 European publishers filed suit against the largest player in internet advertising, further aggravating its antitrust woes which span both sides of the Atlantic.

On February 28, a $2.3 billion suit was filed in a Netherlands court. The plaintiffs, which include Axel Springer and publishers from across the continent, allege they, “incurred losses due to a less competitive market, which is a direct result of Google’s misconduct,” according to a statement from their legal representatives, Geradin Partners.

However, Google, arguably, faces the most peril on the homefront with the Justice Department’s case against its search empire kicking off in late 2023 — a judgment is pending and expected toward mid-2024.

Meanwhile, a separate antitrust case concerning its suite of ad tech tools led by more than a dozen state attorneys general in conjunction with the DOJ, will commence later in the year. Google denies all such allegations of monopolistic practices and is defending itself against all such legal charges in each authority.

However, some believe the groundswell of antitrust scrutiny in the U.S. could actually lead to a break-up of Google’s online advertising business, either forced or voluntarily, in its current guise. A scenario that would have profound consequences for every tier of the advertising industry. 

The Gordian Knot of competition and privacy 

As mentioned, some question if it is possible to achieve an equilibrium between the public’s growing demand for better privacy assurances and the industry’s for a more equitable distribution of ad revenue. 

At this juncture, the conversation around the deprecation of third-party cookies — the foundational software used by the online ad industry for user targeting and tracking — takes center stage.  

In particular, the Privacy Sandbox initiative led by Google’s Chrome team; a project that has dominated industry debate for several years, since the online ad giant confirmed it would ape other web browsers in early 2020. 

The Privacy Sandbox constitutes Google’s proposed means of continuing ad targeting, measurement, and fraud prevention within its market-leading Chrome browser by using several application programming interfaces instead of third-party cookies. 

However, despite Google developing the program with input from outside ad tech companies, concerns abound. Indeed, some express outright suspicion the proposals will further entrench its dominance of the ad industry as the mechanics of online advertising transactions will occur within Chrome with little in the way of outside scrutiny. 

These concerns were laid bare in the IAB Tech Labs’ February analysis, where members claimed that approximately three-quarters of its use cases were not fit for purpose in their current form. This is an alarming concern considering Google Chrome is on course to retire support for third-party cookies at the end of 2024. 

Wayne Blodwell, CEO of Impact Media, explained the complexities of the situation to Digiday, adding that some believe that degrading third-party cookies could “level the playing field” but that others just believe Privacy Sandbox is a means of entrenching the status quo. 

“Google had so much presence [with third-party cookies] across the web, and now [under Sandbox proposals] everyone has access to the same APIs,” he said, claiming there is now a tacit admission among many in the industry that third-party cookies are not privacy-safe. 

Blodwell added, “So if you’re a third-party player like Criteo, Magnite, or The Trade Desk then your targeting or measurement should be the same as Google. Where people think Sandbox will favor Google is that they have such a logged-in base of users across its domain that no one can compete with that… whereas Criteo can’t do that if you’re a large first-party, then you just stand to benefit.” 

Speaking with Digiday in February 2024, Victor Wong, senior of product management at Google, explained how the Privacy Sandbox team would continue to engage with the wider industry, to address their concerns. 

“We provided corrections to the assumptions around the APIs [outlined in the IAB Tech Lab’s earlier assessment],” he said. “We are very supportive of education around how the APIs work.” 

Anthony Katsur, CEO of IAB Tech Lab, informed Digiday that the standards body’s Privacy Sandbox Task Force has taken on board Google’s feedback and invited its further participation, pending the (expected) publication of its full assessment in April 2024.    

Should there be (another) Privacy Sandbox delay?

As a result of the myriad antitrust cases Google faces, the expectation is rife that Google will divest a number of its ad tech assets, with many speculating it will part ways with its ad tech assets, i.e., Google Ad Manager, as a result of such trials.

Damien Geradin, a vocal Google critic whose law firm is representing the 30-plus media owners suing Google in the Netherlands, told Digiday that he anticipates such a move will take place within the next 12-to-18 months. He pointed to the June 2023 European Commission statement of objection against Google’s ad tech practices, which followed a two-year investigation that alleged Google favors its own advertising services, as cause for this assertion. 

“A concern for many is that Google may seek to use the Privacy Sandbox to circumvent the remedies that may be adopted by antitrust authorities in the ad tech cases it faces,” he added. “It’s possible for Google to use Chrome to develop the sort of functionalities that they would have to divest [if they are forced to divest part of GAM].”

James Rosewell, cofounder of the lobby group Movement for an Open Web and fellow outspoken critic of Google, argued similarly and further called on the CMA to insist that Google further stalls its existing Privacy Sandbox timeline.  

“The ad tech cases, the DOJ, or the European Commission, become a bit mute if the fundamental technology is moved into a piece of consumer software called a web browser, that rather defeats the point of the [antitrust] trials,” he added. 

“We would like to see the regulators use interim measures, or injunctures to prevent Sandbox from progressing to ensure those trials can progress and any potential outcome does not become irrelevant.” 

But how to strike a balance?

Even if regulators rule in favor of ad tech independents or ‘open internet players,’ the requirement for better policing of ad tech is apparent, especially in the U.S., where a nationwide privacy law akin to GDPR is not on the horizon anytime soon. 

Arielle Garcia, a former Madison Avenue executive, and prominent privacy advocate, emphasized the need for regulatory authorities, as well as Google’s detractors, to strike a balance between competition and privacy concerns. 

“The industry can be absolutely right that Google is capitalizing on what they’re terming to be privacy,” she told Digiday, “I believe that what the industry is trying to solve for is sustaining business models more so than reinventing a competitive, healthy, fair market for businesses and consumers.” 

“We as an industry need to come to grips with the fact that we are now a regulated industry, and we need to strike a balance,” concluded IAB Tech Lab’s Katsur, adding that the online ad industry has to better describe its utility to politicians and consumers alike.