Google’s plan to replace tracking cookies goes under UK antitrust probe

Google's plan to end support for third party cookies in the Chrome browser and its Chromium engine is under investigation by the UK's Competition and Markets Authority (CMA).

The antitrust regulator said today that it's launched a probe under Chapter II of the UK's Competition Act 1998 into suspected breaches of competition law by Google".

The move follows a complaint lodged in November by a coalition of digital marketing companies which urged the CMA to block Google's implementation of the self-styled Privacy Sandbox'.

The CMA also received complaints from newspapers and technology companies alleging the tech giant is abusing a dominance position, it added.

A Google spokesperson sent this statement in response to a request for comment on the CMA investigation:

Creating a more private web, while also enabling the publishers and advertisers who support the free and open internet, requires the industry to make major changes to the way digital advertising works. The Privacy Sandbox has been an open initiative since the beginning and we welcome the CMA's involvement as we work to develop new proposals to underpin a healthy, ad-supported web without third-party cookies.

Google had previously said it would implement the Sandbox in 2021 - accelerating an earlier timeline for the phasing out of third party cookies and sending ripples of fear (and loathing) through an adtech industry that bet the farm on mass surveillance of Internet users.

No changes have been made so far, according to Google.

It also said today that any changes will not be made before 2022 - as it continues a process of public collaboration (now coupled with close regulatory engagement, via the CMA) on how to replace tracking cookies.

With the looming demise of third party cookies, digital marketers are concerned about their ability to target ads at web users as browsers decommission support for key tracking technologies.

But it's worth noting that Google's Chrome is actually the laggard in proposing to pull the plug on tracking cookies; WebKit, which underpins Safari, announced a tracking prevention policy back in 2019 - taking inspiration from Mozilla's earlier anti-tracking stance. (The latter made third party cookie blocking in Firefox the default in September of the same year.)

These anti-tracking plays by browser-makers are, on one level, a response to consumer distaste over creepy ads and concern for their online privacy.

And in the European Union at least, many core elements of adtech infrastructure are subject to complaints and remain under regulatory scrutiny. (Albeit, the UK's data protection regulator, the ICO, is currently being sued for failing to act on complaints about the lawfulness of real-time bidding which date back to September 2018.)

But the contention by the marketing, publishing and adtech businesses which are crying foul over the end of cookies is that tech giants - Google in this case - are using privacy as a convenient excuse to increase their market power (and control over user data) at smaller entities' expense.

The investigation will assess whether the proposals could cause advertising spend to become even more concentrated on Google's ecosystem at the expense of its competitors," the CMA writes in a press release announcing its investigation. It follows complaints of anticompetitive behaviour and requests for the CMA to ensure that Google develops its proposals in a way that does not distort competition."

The announcement also makes clear that the regulator is alive to the genuine issue of privacy concern - with the CMA writing that it's been considering how best to address legitimate privacy concerns without distorting competition". This has included holding discussions with the Information Commissioner's Office (ICO), and talking to Google to better understand its proposals", it says.

The current investigation will provide a framework for the continuation of this work, and, potentially, a legal basis for any solution that emerges," the CMA adds.

Exactly what will replace tracking cookies is still very much up in the air.

Google has made a number of proposals, via the W3C standards forum, including one called Dovekey' which suggests using a key value server and which Google says builds on the feedback and proposal from adtech firm Criteo's Sparrow proposal.

It's also shared the algorithms for its Federated Learning of Cohorts (FLoC) proposal - referring to a suggestion to use a specific machine learning technique to allow behavioral ad targeting to continue (but without needing to collect individuals' data).

The wider adtech industry, meanwhile, has also been coming up with various ideas and offers for replacing tracking cookies. Such as the UnifiedOpen ID 2.0 proposal (that's being built by The Trade Desk) and proposes a centralized system for tracking Internet users based on personal data such as an email address or phone number; or the Unified ID service launched by TechCrunch's parent Verizon Media (leveraging its access to first party data), to name just two.

So whatever replaces tracking cookies looks unlikely to be simple or singular. Not least given the formal regulatory dimension that's now been added to Google's mix.

With its Sandbox project underway but no replacement for tracking cookies yet selected the CMA's intervention certainly looks very strategic - giving the UK regulator a (potentially major) role in influencing the future shape of adtech.

Although it could also lead to regulatory divergence for adtech in the UK vs the European Union, where the Commission's antitrust regulators have also been eyeing Google's adtech practices but have not yet launched a formal investigation - depending on the outcome of any probe/intervention there.

Back in the UK, a recent CMA market study of the digital advertising sector led it to report substantial concerns over the power of the Google-Facebook adtech duopoly - and it sought views on breaking up the tech giants - although in its final report it deferred any competitive intervention in favor of waiting for the government to legislate.

Since then UK ministers have unveiled a plan to establish a pro-competition regulatory regime that will include a new statutory code of conduct, overseen by a Digital Market Unit (to be set up this year), with the aim of putting some hard limits on big (ad)tech - including potentially requiring them to offer users an opt out from behavioral advertising (something Facebook, for example, currently does not).

Update: The UK-based marketing coalition which complained to the CMA about Google's Privacy Sandbox has welcome the investigation, dubbing it vital for the future of all online businesses, including publishers, technology companies and advertisers".

In a statement, James Rosewell, director of the Marketers for an Open Web' (MOW) coalition, added: This is about the future of the Open Web and the threat that Google poses to its development. By launching this investigation, the CMA has recognised the seriousness of this issue."

Privacy Sandbox would effectively create a Google-owned walled garden that would close down the competitive, vibrant Open Web. Providing more directly identifiable, personal information to Google does not protect anyone's privacy. We believe that the CMA's investigation will confirm this and save the web for future generations," he added.

Rosewell's statement also invites concerned businesses to join MOW in campaigning for an injunction to prevent Google's Sandbox being implemented until after legislation is implemented", although it's still not clear who exactly is behind its push for a vibrant Open Web" except for Rosewell himself, who's CEO and co-founder of UK mobile marketing company, 51 Degrees.

A membership section of MOW's website still does not name any of its supporters - making only a generic reference to top companies across the globe". (We've asked MOW for more info on its membership and will update if we get any names. Update: A spokesman told us the members of MOW have had to remain confidential as they're concerned about repercussions from Google".)

We estimate that our supporters work with more than 21,000 advertisers and nearly 6 million individual websites in more than 50 countries, jointly serving over 320 billion advertising impressions each year. The companies have a combined workforce of over 10,000 employees and combined revenues in excess of $4BN," MOW adds on the site, again without listing the names of any of the adtech players involved in the complaint that Google's Privacy Sandbox is threatening the open web.