Why Google’s approach to replacing the cookie is drawing antitrust scrutiny

Under pressure from governments and consumers over data privacy infringement concerns, Google a year ago said it will disable third-party cookies by 2022 in its Chrome browser, which is used by more than 60% of the world’s web users. The move will effectively disable a primary way that ads are targeted and content is personalized on publishers’ sites. By extension, it could compromise publishers’ abilities to make money from online advertising and push people, their data and — along with them — ad dollars further within the walls of Google’s already dominant properties, according to ad tech and publishing executives.

Google’s decision to disable the third-party cookie has been referenced as examples of anti-competitive behavior in recent antitrust suits against the company, too. A multi-state antitrust suit filed in December claimed Google uses its “massive information advantage strategically to harm any publisher who refuses to use its intermediaries.” Another recent antitrust suit filed on behalf of publishers claimed that Google’s cookie decision was “exclusionary.” Federal lawmakers also highlighted antitrust concerns over Google’s third-party cookie plans in a 2020 report from the U.S. House Subcommittee on Antitrust.

Through its Privacy Sandbox initiative, Google has proposed an evolving collection of ad targeting and measurement methods for replacing third-party cookies. The sandbox project is open to participation from other ad tech firms who can join in through an online forum, the Worldwide Web Consortium. However, ad tech providers and publishers are wary of how open Google actually is to their participation.

“Privacy Sandbox is trying to replace an open and interoperable technology with one that is Google controlled,” wrote James Rosewell, director of Marketers for an Open Web a group whose complaints against Google helped prompt the CMA investigation. “This will force more marketers into their walled garden and will spell the end of the independent and Open Web.” Rosewell is CEO of 51 Degrees, a mobile ad and publishing tech firm.

Critics question Google’s commitment to a collaborative cookie replacement process
Despite the seemingly collaborative setting, Google’s Privacy Sandbox is under increasing scrutiny throughout the digital media industry and now from the U.K. government because Privacy Sandbox is under Google’s control.

“Google has magnanimously allowed the industry to play a role,” said Alan Chapell, president of privacy law firm Chapell and Associates, with some sarcasm. “Google should not be allowed to call this an industry consensus project.”

A Google executive defended the firm in light of the CMA investigation. “The Privacy Sandbox has been an open initiative since the beginning and we welcome the CMA’s involvement as we work to develop new proposals to underpin a healthy, ad-supported web without third-party cookies,” said Chetna Bindra, group product manager, user trust and privacy at Google, in a statement.

In regards to the Privacy Sandbox investigation, Andrea Coscelli, chief executive of the U.K.’s CMA said in a statement last month the agency “has an open mind and has not reached any conclusions at this stage as to whether or not competition law has been infringed.” He also said that the agency “will continue to engage with Google and other market participants to ensure that both privacy and competition concerns can be addressed as the proposals are developed.”

Google’s approach could favor its browser business, say critics

Ad tech firms are participating in the Google sandbox effort. But some, including Criteo, are leery of an approach they say has been too centered around the browser.

“Chrome’s proposals remain very much browser-centric, which Criteo has shared in the past our concerns about,” Arnaud Blanchard, senior analytics and product manager at Criteo, told Digiday.

If parts of the ad operation happen inside the device at the browser level, the data storage and processing demands will be too burdensome and possibly even discriminatory against people with limited data plans, Blanchard said.

One of Criteo’s proposals to provide more balance in the cookieless targeting and measurement process is to set up an “independent gatekeeper” such as a cloud service provider or SSP to “provide people more control and transparency,” said Blanchard.

In response to concerns around browser-centric control, Google recently unveiled its latest targeting method, FLEDGE, which incorporates what it calls a “trusted server” that stores information about an ad campaign’s bids and budgets.

When asked what qualities determine whether a server is trustworthy, and whether Google or some other entity would control such a trusted server, Bindra told Digiday those issues would be determined through public forum discussions with those participating in development of Privacy Sandbox ad methods. “FLEDGE does not specify or expect any particular entity to run a ‘trusted server,'” she said.

An issue of trust

Trust in Google — or lack thereof — is at the core of most complaints about the Privacy Sandbox process. At the end of the day, said Chapell, people need to trust that Chrome will do what’s best for users, that Google’s numbers are accurate, that Google will itself employ the approach it is devising for the open web and that other ad tech firms have a genuine ability to compete once it is in place.

Any method that could give Google even more control over the ad process has advertisers, publishers and ad tech firms raising eyebrows.

“It certainly would be a step in the right direction if it were an independent entity,” said Chapell. “Anybody but Google is a step in the right direction.”