Google’s wrangling of third-party cookies is getting lost in transition

Let’s start with the most recent one first: the IAB Tech Lab’s blistering rebuke, released on February 8, of Google’s plan to replace third-party cookies with a suite of alternatives that fall short of doing the things those cookies currently do for the fundamental parts of advertising. With five main points of contention, spanning areas like audience management, auction dynamics, and creative delivery, the rebuke reads like a “best hits list” of all the grievances long held by ad execs against Google’s cookie crackdown.

But at the heart of it, all is one age-old issue that’s been lingering since Google started its crackdown: the absence of third-party cookies in Chrome could upend or severely diminish key elements of online advertising, to the detriment of advertisers, agencies, ad tech vendors, and media owners alike. Put plainly, Google may be banking on its logged-in user base to fill the void left by third-party cookies.

Google, on the other hand, hasn’t taken those concerns lying down. It has fiercely contested the IAB Tech Lab’s report, citing errors and incomplete information. But without directly addressing these alleged flaws, ad execs find it difficult to trust Google’s assurances. They question whether the tech giant could have pursued its privacy-driven advertising reforms more collaboratively and transparently. 

For instance, Google could have provided the transparency necessary to address concerns raised by the U.K. data watchdog, the Information Commissioner’s Office, and its counterparts across Europe, said James Rosewell, founder of the Movement for an Open Web (MOW) — a coalition of anonymous businesses and industry players. And it could’ve done this, he continued,  by putting in place auditing, as proposed by the IAB Tech Lab, to provide regulators with the necessary information to effectively carry out their duties. In Rosewell’s view, this proactive approach would enhance transparency and accountability within the industry. 

Ad executives seem to share those sentiments, particularly after witnessing the functionality of the sandbox on the one percent of Chrome traffic without third-party cookies

“I don’t think there’s much progress on the sandbox [despite the one percent of cookieless traffic],” said a publishing exec who spoke to Digiday on the condition of anonymity. “Topics is still a black box and, I think, pose a serious threat to publishers’ first-party data strategies, the Protected Audiences API seems only to strengthen Google and Related Website Sets is highly disadvantageous to publishers with many channels/properties.”

Such candid feedback from the industry paired with the IAB Tech Lab’s response has emphasized that second major event: the U.K.’s Competition and Markets Authority’s investigation into whether Google’s Privacy Sandbox offer as a third-party cookie alternative is anti-competitive.

There’s a lot to dissect, but the bottom line is clear: third-party cookies aren’t disappearing if the regulator’s concerns remain unresolved. And there’s quite a bit that needs resolving — 39 issues, in fact by February 2028. Among the more notable concerns are Google’s governance of the sandbox, potential advantages the sandbox’s tools may have over other alternatives to third-party cookies, and the design and use of those tools.

On that latter point, the CMA is pulling at a thread that some observers believe underpins many of their suspicions about what Google truly stands to gain from the depreciation of third-party cookies. 

The crux of the CMA’s concerns hinge on how third-party cookies will be replaced: A cookie’s duration resets with each visit, effectively prolonging its lifespan indefinitely for users who return regularly. This mirrors how many parts of the sandbox work, which raises questions about whether the sandbox’s design subtly favors Google’s ecosystem, potentially reinforcing its dominance in the online sphere.

However, this alone may not be sufficient to halt the sandbox.

Whatever the CMA’s decision, it will carefully balance any perceived advantages of Google’s dominance against the industry’s losses, all while considering the net benefits to consumer privacy and data security. In other words, the sandbox just needs to keep the negative impact as low as possible to get the green light. 

Reports like the one from the IAB Tech Lab highlight the challenges Google faces in achieving this unless it’s willing to make concessions on the sandbox. Yet, as is often the case, the chances of compromises on that scale look dim. That’s not to say Google won’t make any — it definitely will as it has stressed repeatedly in the past. Rather, any compromises it does make over the coming weeks and months will fall short of addressing everything. 

Whether this will be enough for the CMA to give Google the green light to push on with its plan remains uncertain. While the regulator appears somewhat reassured by Google’s attempts to address anti-competitive issues, there’s a lingering doubt. The viability of the sandbox remains a concern, prompting the CMA to adopt a cautious approach, monitoring industry adoption and feedback before making a definitive decision.

Sounds sensible, right? But here’s the catch: it potentially leaves the sandbox teetering on the edge of limbo. The CMA doesn’t have to make a decision on the sandbox unless Google requests a “standstill” period. This period, lasting between 60 and 120 days, allows the CMA to conduct a thorough examination without Google’s changes already in effect. But Google will only request this if it’s confident of securing approval in the end.

As long as this doesn’t happen, the CMA is likely to keep directing Google back to the drawing board for adjustments. And it can continue to do so until February 2028 when the set of global commitments it secured from Google ends.

“As the discussions surrounding Privacy Sandbox and its approaching deadline continue, it is evident that controversies are being raised increasingly frequently,” said Mateusz Rumiński, vp of product at PrimeAudience. “This doesn’t take away from the fact that the Privacy Sandbox represents a crucial step forward though, as it fosters an open web ecosystem while enhancing user privacy safeguards.”

Still, even if this is true, at least in the eyes of competition watchdogs like the CMA, it may not necessarily be so in the eyes of privacy advocates, especially in Europe. Just because Google is moving profiling into the browser in the name of privacy doesn’t mean tracking won’t continue to be intrusive, opaque, and perpetuate arbitrary targeting. That’s definitely how some observers see this shaking out based on their own analysis of the sandbox to date. There’s no way of accurately accrediting media effectiveness, and billing features are significantly degraded. This means advertisers who only pay for Media Rating Council (MRC) or Trustworthy Accountability Group (TAG) accredited platforms won’t be able to use Sandbox-based solutions.

“If you were to talk to an anti-competition lawyer, and to a privacy lawyer, neither would be able to tell you how compromise could be found here,” said Adform’s chief technology officer Jochen Schlosser. “There’s a gray area that needs to be defined into a new acceptable standard at some point.”

Given these complexities, Google’s crackdown on third-party cookies might already be in limbo.