CMA to keep ‘close eye’ on Google as it secures final Privacy Sandbox commitments

The Competition and Markets Authority has accepted a revised offer from Google of commitments relating to its proposed removal of third-party cookies from the Chrome browser (known as the Privacy Sandbox proposals).

The CMA's competition investigation was launched in January 2021 over concerns that the proposals would cause online advertising spending to become even more concentrated on Google, weakening competition and so harming consumers who ultimately pay for the cost of online advertising.

The CMA was also concerned that the proposals could undermine the ability of online publishers, such as newspapers, to generate revenue and continue to produce valuable content in the future - reducing the public’s choice of news sources.

The final commitments accepted by the CMA today are a result of an in-depth investigation and extensive engagement with Google and market participants, including 2 formal public consultations. They address the CMA’s competition concerns and Google has also said that the commitments will be rolled out globally.

The CMA is working closely with the Information Commissioner’s Office (ICO) to oversee the development of the proposals, so that they protect privacy without unduly restricting competition and harming consumers.

You can read the full list of commitments but they include:

• Involvement of the CMA and the ICO in the development and testing of the Privacy Sandbox proposals, to ensure they achieve effective outcomes for consumers to protect both competition and privacy;

• Google will engage in a more transparent process than initially proposed, including engagement with third parties and publishing test results, with the option for the CMA to require Google to address issues raised by the CMA or third parties;

• Google will not remove third-party cookies until the CMA is satisfied that its competition concerns have been addressed. If the CMA is not satisfied that its competition concerns have been addressed, the CMA may take further action (i.e. re-open its investigation, impose interim measures or proceed to a decision);

• Commitments to restrict the sharing of data within its ecosystem to ensure that it doesn’t gain an advantage over competitors when third-party cookies are removed; and commitments to not self-preference its advertising services;

• A Monitoring Trustee will be appointed to work alongside the CMA to ensure the commitments are monitored effectively and Google complies with its obligations. This appointment is expected to be made shortly.

Google has today published a blog post about its obligations under the commitments and the next phase in the development of the Privacy Sandbox.

Google have set out further detail on the process they will follow in engaging with third parties.

Andrea Coscelli, the CMA’s Chief Executive, said:

Our intervention in this case demonstrates our commitment to protecting competition in digital markets and our global role in shaping the behaviour of world-leading tech firms.

The commitments we have obtained from Google will promote competition, help to protect the ability of online publishers to raise money through advertising and safeguard users’ privacy.

While this is an important step, we are under no illusions that our work is done. We now move into a new phase where we will keep a close eye on Google as it continues to develop these proposals.

We will engage with all market participants in this process, in order to ensure that Google is taking account of concerns and suggestions raised.

The CMA has secured a raft of mechanisms in the commitments that are designed to hold Google to account.

These include:

• CMA oversight of the design of tests of replacements to third-party cookies and other Privacy Sandbox proposals

• A standstill period of at least 60 days before Google proceeds to withdraw third-party cookies, during which the CMA and Google will work to resolve any remaining competition concerns

• A mechanism for Google to resolve concerns raised by the CMA without delay.

The CMA may re-open its Competition Act 1998 investigation and impose interim measures in future if necessary.

The commitments will terminate six years from 11 February 2022, unless released at an earlier date in accordance with section 31A(4) of the Competition Act 1998.

Notes to editors

1. More information is available on the case page for ‘Investigation into Google’s ‘Privacy Sandbox’ browser changes’.

2. This is further evidence of the collaborative partnership between the CMA and the ICO, and of the close relationship between the interests of competition and data protection. The ICO and the CMA published a joint statement on the relationship between the aims of competition and data protection in May 2021. Within its decision published today, the CMA has set out more on how it intends to consult with the ICO on aspects of the proposals that relate to data protection. On 25 November 2021, the ICO published an opinion that refers to the CMA’s investigation

3. The Government has proposed establishing, within the CMA, a statutory Digital Markets Unit (DMU) to oversee a new regulatory regime for the most powerful digital firms, promoting greater competition and innovation in these markets and protecting consumers and businesses from unfair practices. The Government is currently analysing responses to a consultation on the DMU’s powers. While the role of monitoring the implementation of any commitments would fall to the CMA for their duration, in the medium term the establishment of the DMU could provide an appropriate framework for regulatory oversight and scrutiny.

4. The CMA does not intend to publish the responses to the consultations, but the information contained in the responses has been summarised on an anonymous basis in the decision.