Notice of intention to accept commitments offered by Google in relation to its Privacy Sandbox Proposals Case number 50972 11 June 2021 © Crown copyright 2021 You may reuse this information (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence. To view this licence, visit www.nationalarchives.gov.uk/doc/open-government- licence/ or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: [email protected]. Contents Page 1. Executive Summary .............................................................................................. 2 2. Introduction ........................................................................................................... 6 3. The CMA’s Investigation ....................................................................................... 8 4. Background ......................................................................................................... 15 5. The CMA’s competition concerns ....................................................................... 22 6. The CMA’s assessment of the Proposed Commitments ..................................... 49 7. The CMA’s intentions and invitation to comment ................................................ 69 Appendix 1: The Proposed Commitments ................................................................ 71 Appendix 2: Google’s Privacy Sandbox Proposals................................................... 83 1 1. Executive Summary 1.1 On 7 January 2021, the Competition and Markets Authority (‘CMA’) opened an investigation into suspected breaches of competition law by Google. The investigation concerns Google’s proposals to replace third- partycookies (‘TPCs’) and other functionalities with a range of changes known as the ‘Privacy Sandbox’ Proposals. It follows complaints of anticompetitive behaviour and requests for the CMA to ensure that Google develops its proposals in a way that does not distort competition. 1.2 The Privacy Sandbox Proposals are a set of proposed changes on Chrome that aim to address privacy concerns by removing the cross-site tracking of Chrome users through TPCs and other methods of tracking; and create a set of alternative tools to provide the functionalities that are currently dependent on cross-site tracking. 1.3 The CMA has been working closely with the Information Commissioner’s Office (‘ICO’) who is also assessing the Privacy Sandbox Proposals for compliance with data protection and ePrivacy law. The CMA and the ICO are working collaboratively in their engagement with Google and other market participants to build a common understanding of Google’s proposals, and to ensure that both privacy and competition concerns can be addressed as the proposals are developed in more detail. 1.4 The CMA is concerned that, without sufficient regulatory scrutiny and oversight, the Privacy Sandbox Proposals would: distort competition in the market for the supply of ad inventory and in the market for the supply of ad tech services, by restricting the functionality associated with user tracking for third parties while retaining this functionality for Google; distort competition by the self-preferencing of Google’s own advertising products and services and owned and operated ad inventory; and allow Google to exploit its apparent dominant position by denying Chrome web users substantial choice in terms of whether and how their personal data is used for the purpose of targeting and delivering advertising to them. 1.5 The CMA is also concerned that the announcements of the Privacy Sandbox Proposals have caused uncertainty in the market as to the specific alternative solutions which will be available to publishers and ad tech providers once TPCs are deprecated. The announcements and 2 actions to date have shown (and created the expectation) that Google is determined to proceed with changes in the relevant areas, including by deprecating TPCs within two years of the announcements, in ways which advantage its own businesses and limit competition from its rivals. 1.6 In this regard, the CMA considers that the concerns that third parties have expressed to it regarding the impact that the Privacy Sandbox Proposals are likely to have in the future, reflect in part: the asymmetry of information between Google and third parties regarding the development of the Privacy Sandbox Proposals, including the criteria that Google will use to assess different design options and evidence relating to their effectiveness against these criteria; and a lack of confidence on the part of third parties regarding Google’s intentions in developing and implementing the Privacy Sandbox Proposals, given the commercial incentives that Google faces in developing Google’s Proposals and the lack of independent scrutiny of Google’s Proposals. 1.7 Google has offered commitments (‘Proposed Commitments’) which seek to address these concerns. The CMA has reached the provisional view that the Proposed Commitments, once implemented, would address its competition concerns as they: (a) Establish a clear purpose of the Proposed Commitments that will ensure that Google’s Proposals are developed in a way that addresses the above competition concerns, by avoiding distortions to competition, whether through restrictions on functionality or self- preferencing, and avoiding the imposition of unfair terms on Chrome’s web users. (b) Establish the criteria that must be taken into account in designing, implementing and evaluating Google’s Proposals. These include the impact of the Privacy Sandbox Proposals on: privacy outcomes and compliance with data protection principles; competition in digital advertising and in particular the risk of distortion to competition between Google and other market participants; the ability of publishers to generate revenue from ad inventory; and user experience and control over the use of their data. 3 (c) Provide for greater transparency and consultation with third parties over the development of Google’s Proposals, including a commitment publicly to disclose the results of tests of the effectiveness of alternative technologies. This would help to overcome the asymmetry of information between Google and third parties regarding the development of the Privacy Sandbox Proposals; (d) Provide for the close involvement of the CMA in the development of Google’s Proposals to ensure that the purpose of the Proposed Commitments is met, including through regular meetings and reports, working with the CMA without delay to identify and resolve any competition concerns before the removal of TPCs, involving the CMA in the evaluation and design of tests of Google’s Proposals. This would ensure that the above concerns about the potential impacts of the Privacy Sandbox Proposals are addressed and contribute to addressing the lack of confidence on the part of third parties regarding Google’s intentions in developing and implementing Google’s Proposals; (e) Provide for a standstill period of at least 60 days before Google proceeds with the removal of TPCs (‘Standstill Period’), giving the CMA the option, if any outstanding concerns cannot be resolved with Google, to reopen its Investigation and, if necessary, impose any interim measures necessary to avoid harm to competition. This provision would strengthen the ability of the CMA to ensure its competition concerns are in fact resolved; (f) Include specific commitments by Google not to combine user data from certain specified sources for targeting or measuring digital advertising on third-party and first-party ad inventory. This would contribute to addressing the competition concerns arising from Google’s greater ability to track users after the introduction of Google’s Proposals; and (g) Include specific commitments by Google not to design any of the Privacy Sandbox Proposals in a way which could self- preference Google, not to engage in any form of self-preferencing practices when using the Privacy Sandbox technologies and not to share information between Chrome and other parts of Google which could give Google a competitive advantage over third parties. This would address the above concerns relating to the potential for discrimination against Google’s rivals. 4 1.8 Overall, the CMA’s provisional view is that, in combination, the Proposed Commitments would address the competition concerns that the CMA has identified in relation to the Privacy Sandbox Proposals, and provide a robust basis for the CMA, ICO and third parties to influence the future development of Google’s Proposals to ensure that the Purpose of the Commitments is achieved. 1.9 The CMA has not reached a final view and invites all interested parties to submit observations and evidence in order to assist the CMA in its final assessment of the Proposed Commitments. How to respond is set out in section 7 with deadline for comments by 8 July 2021 at 5pm. 5 2. Introduction 2.1 On 7 January 2021, the CMA opened an investigation into suspected breaches of the prohibition in Chapter II of the Competition Act 1998 (the ‘Act’) by the undertaking comprising Google UK Limited and Google LLC and any other member of their corporate group1 (‘Google’), in relation to Google’s proposals to withdraw support for TPCs on Chrome and Chromium and replace TPCs and other functionalities with a range of Privacy Sandbox tools, while transferring key functionality to Chrome (the ‘Investigation’).2 2.2 On 28 May 2021, Google offered commitments to the CMA aimed at addressing the CMA’s competition