UK data regulator finds gaps in Google's Privacy Sandbox proposals

Concerns shared with the Competition and Markets Authority

The Information Commissioner's Office (ICO), has raised concerns regarding Google's proposed alternative to third-party cookies: the Privacy Sandbox.

According to a Wall Street Journal report citing internal ICO documents, Google's proposed solutions might not adequately protect user privacy.

The report states that the ICO believes loopholes in Privacy Sandbox could be exploited to track users and undermine their anonymity. This contradicts the initiative's stated goal of reducing online tracking while maintaining a free internet.

The ICO is now urging Google to strengthen Privacy Sandbox's privacy protections and has shared its concerns with the Competition and Markets Authority (CMA), the UK's competition regulator.

As per WSJ report, the CMA will consider the ICO's recommendations when evaluating Google's proposals.

In a statement to Reuters, a Google spokesperson said the company was committed to working with regulators worldwide to find a solution that protects user privacy while maintaining a healthy digital ecosystem.

"We've been closely engaging with the ICO, and other privacy and competition regulators globally, and will continue to do that to reach an outcome that works for users and the entire ecosystem," the spokesperson stated.

Google plans to fully phase-out third-party cookies by mid-2024.

Whilst third-party cookies have some benign uses, such as remembering language preferences and protecting against fraud, they can also be used to track users around the web - for example, remembering sites they visit to show personalised adverts.

Google has proposed Privacy Sandbox as the best solution to privacy concerns surrounding cookies. The initiative aims to offer a more privacy-focused alternative where websites query Chrome directly for user interests, generated from browsing history, instead of relying on tracking cookies.

While technically compatible with other browsers, Apple and Mozilla have expressed reservations about aspects of the technology.

In 2021, the CMA launched an investigation into Privacy Sandbox, leading Google to offer a series of commitments in 2022 to ensure fair competition.

Earlier this year, the regulator acknowledged some progress by Google in addressing competition concerns with Privacy Sandbox initiative, but warned that significant issues remain.

The CMA's primary concern centres on Google's dominant position. The competition watchdog fears the current design could give Google an unfair advantage, potentially allowing the company to prioritise their own advertising services within the Sandbox framework.

Additionally, the CMA wants assurances that Google won't leverage Privacy Sandbox to further solidify its control over existing ad infrastructure, specifically Google Ad Manager, which dominates the UK display ad market.

Google maintains that Privacy Sandbox aims to support online publishers navigating a privacy-focused future.

Responding to the CMA's report published in January, Stephen Bonner, ICO Executive Director for Regulatory Futures and Innovation, said: "Consumers benefit when organisations recognise that data protection, privacy and competition objectives have to be considered together, and the commitments place obligations on Google to do this."

"We will continue to work with both organisations to ensure Google's Privacy Sandbox proposals are compliant with data protection law and deliver good privacy outcomes for individuals.

"Our Commissioner's Opinion set outs clear data protection standards that organisations must meet when developing online advertising technologies. As several proposals are under active development, we will continue to engage with organisations developing them to ensure that they raise standards of data protection and privacy."