Google to the UK CMA: Drop Dead

I’m Alan Chapell. I’ve been working at the intersection of privacy, competition, advertising and music for decades and am now a regulatory analyst writing for The Monopoly Report. I’m hosting another ASK ME ANYTHING session this Friday, June 27 at 11:30am EDT.

Our latest Monopoly Report podcast is out with journalist Marty Swant where we talk about the ways an ad industry trade journalist combats spin and misdirection in their search for truth. 

ANOTHER story about the Sandbox?

As witnessed by the results of this survey, I realize that many of you have had your fill of Sandbox and TPC deprecation articles. It’s been over five years. Most of of us are completely exhausted by this saga. So many are asking - can we just leave it alone now that Google has reportedly changed it’s mind on TPC cookies and probabilistic IDs?

The answer is NO - and here’s why:

1. I don’t think Google has really changed it’s mind on TPC deprecation or probabilistic browser identification practices in Chrome.

2. Even if you disagree with me on #1, you probably know in your heart of hearts that Google is likely to change it’s mind. And the only thing standing in the way of another Google flip flop is the UK CMA.

3. The UK CMA will close the file on the Sandbox if they don’t hear from ad techs and others in digital media. You can send feedback confidentially to the CMA at [email protected].

4. Google is counting on your apathy.

The CMA’s interpretation of Google’s blog posts is at best optimistic

In my view, the CMA’s interpretation of the plain text of Google’s language is optimistic - perhaps embarrassingly so.

Point 1: How the CMA Framed Google’s Decision re: TPC Deprecation: 

“In light of Google’s decision not to deprecate third-party cookies, or roll-out a standalone prompt to users on whether to retain third-party cookie, the CMA consulted on a proposal to release the Commitments.” (See the CMA June Case update). “TPCs are not being deprecated or otherwise restricted in Chrome.” (See CMA Notice of Intention to Withdraw Commitments Section 3.6(c)) 

What Google Actually wrote: 

“we’ve made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies.” (See Google’s April 22, 2025 blog post) Pretty vague, right?

Alan’s View: 

Is the above language from Googles’s April 2025 blog post sufficiently clear to you that you’d be willing to bet your business on it? If Google really isn’t going to deprecate third-party cookies or place additional restrictions on cookies for a period of time, they should clearly say so. Heck, even the current version of the Privacy Sandbox page warns us to “Prepare for third-party cookie restrictions.” (See graphic below).

Point 2: How the CMA framed Google’s decision with respect to Probabilistic / Fingerprinting:

Google “confirmed that IP addresses will continue to be available in default browsing mode. As a result, ad techs will be able to build alternative identifiers that can re-create some cross-site tracking functionality in Chrome even for users that do not allow TPCs” (See CMA Notice of Intention to Withdraw Commitments Section 1.11).  

What Google Actually Wrote

“Internet Protocol (IP) addresses are already commonly used in the broader ads ecosystem to help marketers reach people across their customer journey and measure how their ads are working, especially on CTV. At Google, we have already been using these signals responsibly to fight against spam and fraud for years. Now, with new innovations like PETs to mitigate risks, we see an opportunity to set a high privacy bar on the use of data like IP. We can do this by applying privacy-preserving protections that help businesses reach their customers across these new platforms without the need to re-identify them. And because we’re looking to encourage responsible data use as the new standard across the web, we’ll also partner with the broader ads industry and help make PETs more accessible.” (See Google’s Dec 2024 Platform Policy Notice)

Alan’s View

Google’s December 2024 Platform Policy is mostly tailored to the CTV space. Google doesn’t promise that IP protection won’t eventually be introduced outside of Incognito mode, or that Google won’t create some new policy akin to Apple’s Advanced Tracking and Fingerprinting Protection for the browser as one of those “privacy preserving protections” or “PETs” referenced in Google’s statement. In fact, Google is currently advancing proposals and discussions in Github which sound a lot like the anti-fingerprinting techniques that other browsers are using.

More importantly, none of Google’s Statements are the least bit forward looking. They ONLY pertain to Google’s approach at the exact time they were made. It would be irresponsible for anyone to rely on them going forward given Google’s history of flip-flops… yet here we are.

Why would the CMA interpret Google’s statements in this way?

Here’s what I know - Per their website, the CMA was asking Google to agree to an updated set of Commitments from at least September 2024 to February 2025 - presumably because the CMA believed that competition issues remained.

Here’s what I was told - I’m hearing that in May of 2025 (i.e., after Google’s April announcement re: choice prompts), a draft of new Google Commitments was finalized between the CMA and Google. And that the updated Commitments document made its way to Sundar Pinchai’s desk.  Apparently, Pinchai said “NO”. It was only after being rebuffed by Google that the CMA changed its mind and decided that it updated Commitments weren’t necessary.

I got that info from someone I trust, although to be clear - I can’t corroborate it 100%. But think about this…. Why would the CMA suddenly take the position that Commitments were no longer needed after negotiating for them for over six months?  

• Is it more likely that the CMA suddenly re-evaluated Google’s opaque public statements and reasonably concluded that there was no longer a competitive threat?

• Or is it more likely that Google told the CMA to pound sand and the CMA’s recent budget cuts forced their hand?  

I’ll let you be the judge.

I want to provide the CMA with Feedback. What should it say?

Ping me with any questions. Seriously. I want to be helpful. If you’re looking for a few points.

• No Forward Looking Statements or Promises were made by Google about TPC Deprecation or Fingerprinting on Chrome - I’ve lost count on how many times Google has changed course over the past five years. Is the CMA really expecting this time to be different?

• The CMA’s initial competition concerns remain - Most (if not all) of the marketplace concerns expressed by the CMA back in 2022 when it initially negotiated the Commitments continue to be true: (a) asymmetry of information, (b) lack of confidence in Google’s intentions, and (c ) Google’s use of first party data (including data collected via Android) to self-preference.

• CMA should not pretend that TPC Deprecation was the sole way for Google to use the Sandbox to Preference - Even if you believe that Google won’t (a) deprecate TPC again or (b) take anti-fingerprinting measures, there are countless other ways that Google can use the Privacy Sandbox to preference.

• Timing is bad / The Marketplace is still vulnerable - Right now is the worst possible time for the CMA to walk away given that: (a) Google is under the threat of Chrome divestment in its case against the DOJ, but that (b) a final decision could be years away.

At this point, part of me feels bad for the folks working at the CMA. I don’t think they knew what they were in for when they started down this process. And I recognize they have been hit by budget cuts. But if Google has gotten so big that it is able to say NO to the UK Government without fear of consequence, the right response isn’t to cut and run.

The right response is to dig down and figure out how to finish what you started. Or at least hold the fort until other regulatory processes have resolved themselves.

With your help, maybe we can get the CMA to find the intestinal fortitude to finish the job.

Send your responses by email to: [email protected] by July 4 EOD.

__________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.