CMA’s latest on Google’s Privacy Sandbox sparks doubt among ad execs

What’s got it riled up? Most of these concerns are just expansions of the ones the watchdog had all along. From suspicions that the sandbox will just keep Google on top of the ad game to questions about who’s going to be in charge once these alternatives are up and running — it’s the clearest signal yet from the watchdog that it believes there are some serious structural issues with the sandbox that aren’t even close to being fixed.

But here’s where things take a different turn: the U.K.’s Information Commissioner’s Office (ICO) is now part of the picture. For the first time, its views on the sandbox’s privacy protections — or lack thereof — have joined the conversation, informing additional concerns raised by the CMA. In short, both regulators are waving red flags, highlighting gaps in the sandbox that could compromise privacy and expose users who should remain anonymous. It’s a new twist in an already tangled tale.

“The regulators are showing real concern about some significant areas — from latency and the role of cloud providers through to governance and privacy,” said James Rosewell, founder of the Movement for an Open Web (MOW) — a coalition of anonymous businesses and industry players. “These are fundamental issues that are not going to be addressed overnight.  The fact that the issues list is growing as the technology gets closer is a sign that Google has tied itself up in knots that it simply can’t unwind.

Given all this, it’s hardly surprising that Google decided to bite the bullet and extend the deadline for the third time in its efforts to eradicate third-party cookies. But what’s even clearer is that more extensions could be on the horizon, especially considering the wide range of concerns — or, to put it bluntly, the lack of progress in addressing them all, ranging from governance issues to whether the sandbox gives YouTube an advantage, at this moment.

Granted, three months was never going to be enough time to fix all the concerns raised by the CMA in the previous report but when so much of the latest one reads like a broken record, repeating “maintains our view” or “our view remains unchanged| then its hard to see how everything gets resolved, deadline or not. . And when those phrases aren’t there, they’re just replaced by even more problems the ad industry has dredged up since the last report.

That’s not to say there’s no progress toward some sort of resolution. It’s just more like baby steps at this point.

For instance, Google is considering ways to provide view and click information to buyers, the report said. That’s a step in the right direction because it could help buyers optimize their programmatic auctions in the Chrome browser. However, it doesn’t address the bigger concern over those auctions: That the sandbox would ultimately preserve Google’s top seller status in them and therefore its influence over large swathes of ad dollars.

“We are continuing to discuss these concerns with Google,” said the CMA in the update. “This is a high priority area for us to resolve.”

That gives ad execs a glimmer of hope — that the CMA’s really on it, making sure the sandbox doesn’t end up causing more trouble than it solves. 

But others aren’t holding their breath. 

They still want to see the regulator do more to push Google on addressing some basic but still unanswered questions about the sandbox: namely, does the sandbox work, can it be tested, and what will its impact be on the rest of the ad industry. And arguably, those points are hard to dispute, considering not all the sandbox components are up and running, the ones that are being tested seem to have glitches, and there are legitimate worries about whether it’s ultimately beneficial for the ad industry. 

These skeptics aren’t expecting miracles, to be clear. They understand the complexity of what Google is attempting with the sandbox, and they acknowledge that there are some strong elements to it. However, they doubt Google’s sincerity in making it work for the overall betterment of the ad industry. Sure, Google keeps promising to address these concerns eventually, especially as it aims to say goodbye to third-party cookies by early 2025, as per the new deadline. But let’s face it, Google’s been singing this same tune since day one of this saga four years ago, and look at what’s happened since.

Implementing Trusted Execution Environments, so it’s not just Google and Amazon, could help alleviate some of these suspicions, ad execs have said. Likewise, making it easier for advertisers to build interest groups for Topics, given its departure from current practices, could also address concerns. Bottom line: there are some key changes Google could make to the sandbox, particularly the Protected Audiences API, that would go some way to allaying the CMA’s concerns and ultimately those harbored by the ad industry too.

Only time will tell if Google addresses these issues. For now, the industry watches on with bated breath.

“The CMA has rightfully put on the brakes here, and pushed Google to re-engage with the ad tech universe and the rest of the market because the devil is in the details when you do look at at all of this, and so much of it [the sandbox] fails at this point,” said Drew Stein, the CEO of ad tech business Audigent.