I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.
The latest Monopoly Report podcast! This week, I welcome Jean-Paul Schmetz, Chief of Search and Ads at the Brave browser. We discuss privacy, ad blocking, and publisher fortunes (or lack thereof).
There are at least a few engineers who need to see this message.
Wait, Another Damn Sandbox Article?
I know, I know. Nobody wants to talk about the Privacy Sandbox anymore.
Google walked away from cookie deprecation in April 2025, and most of the industry has moved on to talking about agentic AI. And this week in particular, everyone is preparing for Cannes and pre-gaming for the ceremony where LiveRamp’s data magically turns into first-party data now that it’s part of an agency holdco.
I recognize that this might be, as the boomers say, harshing your mellow.
In my view, some new research from Garrett Johnson and his colleagues at the BU Questrom School of Business deserves attention — not because the Sandbox itself matters anymore, but because it offers the cleanest published overview to date of how privacy-enhancing technologies (PETs) are designed, marketed, and ultimately measured.
What’s a Privacy-Enhancing Technology?
Privacy-enhancing technologies (PETs) are a category of tools, cryptographic methods, and architectural frameworks designed to safeguard personal data throughout its lifecycle. They allow organizations and individuals to collect, share, and analyze sensitive information without exposing the raw data, minimizing privacy risks while preserving data utility.
In the ads space, PETs can be helpful so long as they are designed with clear goals. I’ve covered PETs in connection with browsers, clean rooms, attribution, and measurement. This begs the question: What else do you have to say about PETs?
This newly peer-reviewed research from Questrom provides a great example of the limits of PETs.
Background on the Questrom Research
The researchers partnered with Raptive to analyze 200 million ad impressions served to Chrome users in August 2024. They leveraged the CMA-Google open field experiment, which randomly assigned Chrome users into three buckets:
Status Quo (third-party cookies enabled)
Privacy Sandbox (Sandbox APIs active, cookies disabled)
Cookieless (Sandbox and cookies disabled)
Here are the headlines. I’m over simplifying a bit, and I’d encourage you to read the study for yourself to get the full details.
Third-party cookie removal hurt pub revenues: Removing third-party cookies reduced publisher revenue by 29.1%.
Sandbox revenue recovery: no bueno: Privacy Sandbox recovered only 4.2% of the revenue lost from cookie deprecation.
Privacy Sandbox also increased ad latency materially: The 75th percentile latency under Sandbox was 5.64 seconds, more than double the 2.24 seconds in Status Quo. Impressions sold via the Protected Audience API showed 75th percentile latency of 7.89 seconds. Sandbox latency caused 2.9% of impression opportunities to go unsold, partially offsetting whatever modest revenue gains per-impression the APIs delivered.
All due respect to Google, but these results are very different from what the Privacy Sandbox team had promised (or at least strongly implied) while the Sandbox was being built. I’m not trying to beat anyone over the head, but I hope that we can all learn a few things from this adventure.
PETs must, must, must be tied to specific outcomes
Simply offering a high-level platitude such as “building a better web” isn’t a viable north star. Anyone creating PETs needs to design them for specific goals. For example:
Does the PET map to a valid legal basis under EU data protection law?
Does the the PET satisfy the sale/share requirements under CCPA?
Does the PET address specific consumer concerns about tracking?
Is the PET auditable by independent third-party researchers?
In too many cases, PETs within the ads space are not tied to any of the above.
Transparency is (or should be) the most important component of any PET used in the ads space. And to Google’s credit, it was willing to provide the data here (with the help of the UK CMA). But imagine if we didn’t have this underlying data. Then, we’d be forced to trust the narrative coming from the Privacy Sandbox team.
And that’s why I believe that privacy without transparency isn’t a viable solution.
___________________________________________________________________________
If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.
We’ve created spaces designed to transform your message into assets that leave an impact long after the Croisette clears out. Reach out to secure your spot.
Activate with Marketecture Media at Cannes Lions
Marketecture Media is back at Cannes, and this year, we’re doing even more!
From our signature hosted dinners to our Hot Yachts series, 1:1 interviews, and our always-on content studio, we create the content and gatherings where the advertising industry comes together.
Want to work with us? Click the button below.
