CMA update on Google's Privacy Sandbox

FOR IMMEDIATE RELEASE: 26 NOVEMBER 2021 

CMA secures improved commitments on Google's Privacy Sandbox

The CMA has secured improved commitments from Google on its proposals to remove third party cookies and other functionalities from its Chrome browser.

It has been investigating Google's proposals since the start of the year due to concerns that, without the Competition and Markets Authority's (CMA) involvement, Google's alternatives could be developed and implemented in ways that impede competition in digital advertising markets. This may cause advertising spending to become even more concentrated on Google, harming consumers who ultimately pay for the cost of advertising. It may also undermine the ability of online publishers such as newspapers to generate revenue and continue to produce valuable content in the future, reducing choice for consumers.

The CMA's intervention, and the improved commitments, are designed to ensure that Google's proposals can improve privacy without adversely affecting competition, which would be to the detriment of users.

In June 2021, the CMA consulted on initial commitments offered by Google, which provided the CMA with a key oversight role in the design and development of its Privacy Sandbox proposals. Google announced that if the CMA accepted those commitments, Google would apply them globally.

The CMA heard from over 40 third parties who agreed with the CMA's competition concerns but suggested that the commitments should be strengthened in a number of areas. These included increasing Google's transparency and engagement with the industry, adding that certain functionality should not be removed before third-party cookies, improving the provisions on Google self-preferencing its advertising products and services and bolstering the monitoring of Google's compliance.

To address these points Google has now offered to:

·    ensure that the CMA's role and the ongoing CMA process are mentioned in Google's key public announcements;

·    instruct its staff not to make claims to customers which contradict the commitments;

·    report regularly to the CMA on how Google has taken account of third party views;  

·    address concerns about Google removing functionality or information before the full Privacy Sandbox changes, including by delaying enforcement of its Privacy Budget proposal, and offering commitments around the introduction of measures to reduce access to IP addresses;

·    clarify the internal limits on the data that Google can use;

·    provide greater certainty to third parties developing alternative technologies;

·    improve the provisions on reporting and compliance, including by appointing a CMA-approved monitoring trustee; and

·    provide for a longer duration of 6 years from the date of any decision to accept Google's modified commitments.

The CMA's provisional view is that Google's revised offer addresses the CMA's competition concerns, so the CMA is now consulting on these modifications.

CMA Chief Executive Andrea Coscelli said:

"We have always been clear that Google's efforts to protect user's privacy cannot come at the cost of reduced competition.

"That's why we have worked with the Information Commissioner's Office, the CMA's international counterparts and parties across this sector throughout this process to secure an outcome that works for everyone.

"We welcome Google's co-operation and are grateful to all the interested parties who engaged with us during the consultation.

"If accepted, the commitments we have obtained from Google become legally binding, promoting competition in digital markets, helping to protect the ability of online publishers to raise money through advertising and safeguarding users' privacy."

The CMA will now consult on these new commitments until 5pm on 17 December 2021.

If the commitments are accepted, this would result in the closure of the CMA's investigation, and lead to the next phase of this oversight work for the CMA.

For more information on all possible investigation outcomes, see Chapter 10 of the relevant CMA guidance.

Notes to editors 

1.   More information is available on the case page for 'Investigation into Google's 'Privacy Sandbox' browser changes' at this link.

2.   This is further evidence of the collaborative partnership between the CMA and the ICO, and of the close relationship between the interests of competition and data protection. The ICO and CMA published a joint statement on the relationship between the aims of competition and data protection in May 2021. Within its notice published today, the CMA has set out how it intends to consult with the ICO on aspects of the proposals that relate to data protection. On 25 November 2021, the ICO published an opinion that refers to the CMA's investigation.

3.   The CMA will establish a Digital Markets Unit (DMU) to oversee a new regulatory regime for the most powerful digital firms, promoting greater competition and innovation in these markets and protecting consumers and businesses from unfair practices. The Government is currently analysing responses to a consultation on the DMU's powers.  While the role of monitoring the implementation of any commitments would fall to the CMA for their duration, in the medium term the establishment of the DMU could provide a framework for regulatory oversight and scrutiny.

4.   As further detailed in the notice published by the CMA today, the CMA does not intend to publish the responses to the consultation with any commitments decision or further notice to provisionally accept any modified commitments, but the information contained in the responses may be used or summarised on an anonymous basis in these documents.

5.    On Monday 29 November 2021 and Tuesday 30 November 2021 the CMA will host the first dedicated two-day summit with the heads of the G7 competition authorities to discuss cooperation across digital markets.

6.   For media enquiries, contact the CMA press office on 020 3738 6460 or press@cma.gov.uk.