Google & the UK CMA

I’m Alan Chapell. I’ve been working at the intersection of privacy, competition, advertising and music for decades and I’m now a pundit writing for The Monopoly Report.

Our latest Monopoly Report podcast is out with part 2 of my interview with Jonathan Kanter, former Assistant AG for Antitrust with the U.S. Department of Justice. Jonathan and I dig into the DOJ ad tech trial taking place against Google.

Post Mortem re: the CMA’s Sandbox Entanglement

On June 13, 2025, the UK Competition and Markets Authority published a notice of its “intention to release commitments previously accepted by the CMA in respect of Google’s Privacy Sandbox Proposals”.

If you’re reading this, I’m assuming you have some idea of the CMA’s involvement in securing Commitments from Google with respect to the Privacy Sandbox and TPC deprecation. (h/t to MOW for launching the initial complaint).

Given that things seem to be winding down, I wanted to share my thoughts as someone who’s been following this pretty closely since day one.

What the CMA could have done

It’s very easy to Monday morning quarterback the decisions of a regulatory agency dealing with such a complex set of issues. I don’t mean any disrespect to the CMA.

In my view, the most important thing we can do at this time is to soberly assess this process and any mistakes made here - so we can avoid repeating those mistakes.

There were so many missteps here that it’s difficult to choose. But if pushed, I’d say this:

• The CMA could have chosen to impose strict “interim measures” on Google back in 2021 which would have put the CMA in better position to reign in Google’s practices. They choose not to – and opted to create an poorly conceived feedback loop for the Sandbox tools via the Commitments.

• Forcing ad tech companies into this process made it much harder for us to reject the absurd premise from which this exercise is built —- that the biggest ad company in the world should be allowed to determine the fate of the ad supported Internet in the name of competition and data protection.

• The CMA never published (or required Google to publish) clear success criteria as to Sandbox effectiveness despite repeated requests that they do so. That probably should have been a clue to most of us that we would likely be spinning our wheels.

A key question SHOULD have been: How effective does the Sandbox have to be in order for the CMA to feel comfortable that TPC deprecation would not impact competition? I’m not suggesting that the CMA should have published an exact number. And I don’t think anyone was expecting that the Sandbox tools would be 90% as effective as TPC.

In my view, keeping the process so vague meant that this entire effort lacked a north star. And as a result, lots of time and resources were wasted.

But, But…. It’s for Privacy!

Google or the CMA might attempt to frame this whole endeavor as a net positive because ad techs were spending time on a “privacy” related project. The Sandbox may have been a privacy project in name, but its privacy utility is at best debatable. Moreover, this was NEVER “the ad industry’s” project.

Moreover, the entire plan was premised on the notion that anyone who isn’t a part of big tech should be stripped of their ability to use UIDs while the walled gardens continue to link to people’s real world identities.

And they call that privacy?

Going from bad to worse

Google effectively turned the process into a farce. That may sound harsh to some readers, so here’s some additional color:

• Stifling discussion - Google has a prominent seat a every table in our industry. They wield their influence in any number of ways: by dominating agendas at industry trade meetings, and pushing back on negative and/or problematic topics in connection with industry events. Moreover, there is a very short list of people who are openly willing to oppose Google - which was a further inhibitor of honest public discourse re: the Sandbox. I’ll admit - none of this is the fault of the CMA - but one would have hoped that the CMA would have taken this more into account as it built out this process. It wasn’t like they weren’t warned repeatedly.

• Filtering criticism - The feedback loop setup by the CMA mostly involved these steps: (a) industry provides Sandbox related input to the CMA, (b) CMA provides that feedback directly to Google, (c) Google reframes the feedback, and (d) Google provides a public response to the reframed feedback. This approached allowed Google to hold the pen and position Sandbox criticism in a way that is most favorable to Google.

• What about the IAB Techlab Report? - The Techlab report analyzing the Sandbox was one of the few instances where something was published with limited input from Google. It’s pretty much the exception that proves the rule. That report was wildly significant in terms of seeing the Sandbox initiative for what it is. And it could be viewed as a minor miracle that the report made it out at all.

If future competition enforcers take away one thing from the CMA Sandbox initiative, I hope they recognize that you’re never going to get to the bottom of any competition challenge if the monopolist maintains near total control over the dialog and framing of issues.

When things really started heading south

At some point, it became clear that the CMA wasn’t really in control of this process - and that it was looking for a way out.

July 2024 - Google’s July 2024 announcement that it was shifting the discussion from TPC deprecation outright to deprecation by choice screens marked an important change to the process. From that point on, it was pretty clear that Google was in charge, and the CMA was at best playing defense.

Also, from that point on, the CMA was looking to extricate itself from the Sandbox saga. They began closing issues mostly on Google’s say-so (even in the face of evidence to the contrary) and pushing the most challenging issues to a new governance process that would effectively be run by Google. I shared my thoughts re: the CMA’s retreat here and thoughts re: the pivot to choice prompts here.

April 2025 - When Google announced in April 2025 that it was NOT going to deprecate cookies via a Choice prompt, the CMA obviously saw this as its deus ex machina – and used it as an opportunity to extricate itself from this mess entirely.

Who cares - Google’s not deprecating cookies anymore

Well… maybe. But it’s important to keep in mind that Google’s April 2025 announcement was fairly opaque.

The announcement read: “we’ve made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies.”

The April 2025 announcement certainly didn’t promise anything - and it wasn’t in the least bit forward looking. If you know anything about Google-speak, there’s a fair amount of wiggle room in that announcement.

What happens if / when Google changes its mind again re: Deprecation?

The CMA has indicated that it can always re-open the investigation via their standard process. OK. But it’s probably worth noting that the CMA can open an investigation at any time and on any subject. They are quite skilled at opening cases, actually.

So… YES, the CMA certainly CAN re-open the case. But reopening involves political calculations and staffing estimations and resource allocations – each of which impose headwinds and create delays. All that to say that what the CMA CAN do and what it ultimately choses to do can be very different things.

In my view, it seems unlikely that the CMA would be able to move quickly enough if Google changes its mind again.

The CMA should keep the file open until Chrome Divestment is settled

That’s what the Movement for an Open Web (MOW) folks are suggesting. Seems reasonable to me. As you probably know, the DOJ has proposed divesting Chrome as one of the remedies in the Google search antitrust case. If Google is forced to divest Chrome, the CMA is arguably no longer needed. But until divestment happens, there are all kinds of things that Google can do with respect to TPC deprecation.

Do I think that Google is likely to announce TPC deprecation in the near term? No. 

But two things come to mind:

1. The CMA Sandbox Commitments - as flawed as they might be - are still an impediment to Google’s self-preferencing, and I’d Iike there to be as many impediments in place as possible.

2. Google is perfectly capable of arm-twisting the market into further Sandbox related chores - even without the threat of TPC deprecation.

For those reasons, I hope the CMA considers revamping Google’s Sandbox Commitments rather than scrapping them altogether.

__________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.