Investigation into Google’s ‘Privacy Sandbox’ browser changes

The Competition and Markets Authority (CMA) has accepted commitments offered by Google that address the CMA’s competition concerns resulting from investigating Google’s proposals to remove third-party cookies and other functionalities from its Chrome browser.

From:
Competition and Markets Authority
Published
8 January 2021
Last updated
31 January 2025 — See all updates
Case type:
CA98 and civil cartels
Case state:
Open
Market sector:
Communications
Opened:
7 January 2021

Case updates

Date Action
October 2024 to February 2025 Discussions with Google on changes to the commitments are ongoing.
September 2024 The CMA indicated that competition concerns remain under Google’s revised approach, and that the current commitments would need to be updated to reflect the evolution in Google’s planned Privacy Sandbox browser changes.
July to August 2024 The CMA invited stakeholders to share their initial views on Google’s revised approach, and possible implications for consumers and market outcomes.
July 2024 Google announced that it is changing its approach to Privacy Sandbox. Instead of removing third-party cookies from Chrome, it will allow users to choose whether to retain third party cookies.

Quarterly reports

Q4 2024

31 January 2025: the CMA published Google’s progress report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 October 2024 to 31 December 2024.

Under the commitments, Google is required to report on the progress of the Privacy Sandbox proposals, its interactions with the CMA and third parties, as well as the approach taken to address concerns raised. We published the full report to inform third parties of developments on the Privacy Sandbox.

We have a role in supervising Google to ensure that the Privacy Sandbox is developed in a way that benefits consumers. As part of this role, we have continued to engage with Google on the design and development of the proposals.

The ICO has been closely involved in this process, given that the aim is to ensure that both competition and privacy are protected.

We have also received the Monitoring Trustee’s assessment of Google’s compliance with the relevant provisions of the current commitments (paragraphs 25 to 27, 30 to 31 and 33). The Monitoring Trustee has not informed the CMA of any instances of Google being non-compliant with its obligations under those provisions of the commitments.

As discussions with Google on changes to the commitments are ongoing, the CMA will not publish an update report for this quarter. We expect to provide a further update soon.

Q2 to Q3 2024

On 11 November 2024, the CMA published its latest update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report sets out the CMA’s current views on the Privacy Sandbox tools. Also, it incorporates the Monitoring Trustee’s assessment of Google’s compliance with the relevant provisions of the commitments.

The CMA also published Google’s progress report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 April 2024 to 30 September 2024.

Q1 2024

On 26 April 2024, the CMA published its latest update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report also incorporates the findings from the Monitoring Trustee’s Q1 2024 report.

We also published Google’s Q1 2024 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 January 2024 to 31 March 2024.

Q4 2023

On January 31 2024, the CMA published its update report for Q4 2023 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q4 2023 report.

We also published Google’s Q4 2023 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 October 2023 to 31 December 2023.

Q3 2023

On 26 October 2023, the CMA published its update report for Q3 2023 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q3 2023 report.

We also published Google’s Q3 2023 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 July 2023 to 30 September 2023.

Q2 2023

On 27 July 2023, the CMA published its update report for Q2 2023 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q2 2023 report.

We also published Google’s Q2 2023 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 April 2023 to 30 June 2023.

Q1 2023

On 27 April 2023, the CMA published its update report for Q1 2023 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q1 2023 report.

We also published Google’s Q1 2023 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 January 2023 to 31 March 2023.

Q4 2022

On 31 January 2023, the CMA published its update report for Q4 2022 on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q4 2022 report.

We also published Google’s Q4 2022 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 October 2022 to 31 December 2022.

Q3 2022

On 27 October 2022, the CMA published its Q3 2022 update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB). The report incorporates the findings from the Monitoring Trustee’s Q3 2022 report.

We also published Google’s Q3 2022 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 July 2022 to 30 September 2022.

Q2 2022

On 28 July 2022, the CMA published its first update report on the implementation of Google’s Privacy Sandbox commitments (PDF, 141KB) accepted by the CMA in February 2022. The report incorporates the findings from the Monitoring Trustee’s Q2 2022 report.

We also published Google’s Q2 2022 report on its compliance with the binding commitments accepted by the CMA. The report covers the period from 1 April 2022 to 30 June 2022.

First quarterly reports 2022

On 16 May 2022, Google provided us with its first report on its compliance with the binding commitments accepted by the CMA (PDF, 141KB) on 11 February 2022. The report covers the period from 11 February 2022 to 11 May 2022.

We also received an initial report from ING Bank, the Monitoring Trustee, with its assessment of Google’s compliance with those provisions of the commitments which relate to Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33).The report covers the period between 11 February 2022 and 16 May 2022.

ING Bank did not identify any reportable concerns to the CMA.

We are expecting to receive the future quarterly reports from Google and ING Bank to align with calendar quarters.

2022 case updates

In February 2022, the CMA accepted Google’s Privacy Sandbox commitments (PDF, 141KB) to address its competition concerns resulting from its CA98 investigation into Google’s proposals to remove third-party cookies and other functionalities from its Chrome browser. These commitments involve the CMA working with Google on the design and assessment of the Privacy Sandbox proposals before a final decision is taken to remove third-party cookies from Chrome. This page includes updates on implementation of the commitments, including regular update reports from the CMA and Google, and other relevant information for market participants.

Note: Google’s Android Privacy Sandbox proposals do not fall within the scope of these commitments

Industry testing

On 26 October 2023, the CMA published additional guidance for ad techs, publishers, and advertisers intending to test the Privacy Sandbox tools. This guidance provides detail on how market participants should use Google’s planned testing modes in Chrome in order to generate results which are comparable and informative to our assessment.

On 29 June 2023, the CMA published a further guidance note to advise ad techs, publishers, and advertisers on how they can test the Privacy Sandbox tools in a way that would contribute to our assessment of Google’s technologies. We envisage most testing taking place between Q4 2023 and Q2 2024. The note provides details of two preferred approaches to testing, the metrics we would like to capture, and information market participants can submit to the CMA so we can understand results of testing. The note also describes how the CMA’s preferred testing approaches align with Google’s testing framework.

On 3 November 2022, the CMA published a note which sets out the framework on how quantitative testing might inform our assessment of Google’s Privacy Sandbox proposals. We will be working with Google to further develop the ideas in this note and to design experiments which Google can carry out itself. Under the commitments, Google has committed to being transparent in reporting the results of its tests. At the same time, we also want to encourage other market participants to get involved in testing.

Monitoring Trustee

Appointment of Technical Expert

On 26 September 2022, the CMA approved the appointment of S-RM Intelligence and Risk Consulting Limited by the Monitoring Trustee (ING Bank N.V.) as an independent Technical Expert to support the Monitoring Trustee in monitoring compliance with the following provisions of the binding commitments accepted by the CMA on 11 February 2022: Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33). The role of the Technical Expert is to provide specialised knowledge to support the Monitoring Trustee, particularly in relation to monitoring of data flows, and understanding the possible impacts of the Privacy Sandbox changes on ad tech markets.

Appointment of Monitoring Trustee

On 23 March 2022, the CMA approved the appointment of ING Bank N.V. by Google as Monitoring Trustee to monitor compliance with those provisions of the binding commitments accepted by the CMA on 11 February 2022 which relate to Google’s use of data (paragraphs 25 to 27), non-discrimination (paragraphs 30 to 31) and (with respect to those provisions) anti-circumvention (paragraph 33).

ING Bank also has a role in engaging with interested stakeholders, where they have questions about the nature and scope of the parts of the commitments which it is supervising. ING Bank be reached via the following contacts:

Decision to accept binding commitments

On 11 February 2022, the CMA published its decision to accept commitments from Google in relation to its proposals to remove third-party cookies (TPCs) on Chrome and develop its Privacy Sandbox tools.

Formal acceptance of commitments by the CMA brought the investigation to an end, with no decision being made as to whether or not the Competition Act 1998 has been infringed.

Consultation on modified commitments

On 26 November 2021, the CMA published a notice of intention to accept the modified commitments offered by Google and has invited representations from interested third parties on these modified commitments.

As detailed more fully in the related notice, the modified commitments:

  • add obligations on Google regarding its transparency and consultation with third parties
  • put in place a more transparent process through which Google will develop and test the Privacy Sandbox Proposals
  • add commitments to address concerns about Google removing additional functionality or information before TPCs
  • provide for a mechanism for the CMA to monitor Google’s adherence to any resolutions reached under the commitments
  • clarify the internal limits on the data that Google is allowed to use for the purposes of targeting and measuring digital advertising
  • improve the approach to addressing concerns about the potential for Google self-preferencing
  • improve the provisions on reporting and compliance
  • provide for a longer duration for any commitments

Consultation on commitments

On 11 June 2021, the CMA published a notice of intention to accept the commitments offered by Google and has invited representations from interested third parties.

Any non-disclosure agreement a party may have in place with Google should not prevent them from responding to this consultation. Google has confirmed that it will not use any confidentiality provision with a party to prevent them from responding to this consultation.

The CMA is particularly interested to hear any views on whether the proposed commitments are sufficient to address the CMA’s competition concerns regarding:

  • unequal access to the functionality associated with user tracking
  • self-preferencing Google’s own ad tech providers and owned and operated ad inventory
  • imposition of unfair terms on Chrome’s web users

Case launch

On 7 January 2021, the CMA launched an investigation under Chapter II of the Competition Act 1998 into suspected breaches of competition law by Google. The investigation concerns Google’s proposals to remove third-party cookies (TPCs) on Chrome and replace TPCs functionality with a range of ‘Privacy Sandbox’ tools, while transferring key functionality to Chrome.

Notes

  • the investigation is under Chapter II of the Competition Act 1998
  • the CMA has not reached a view as to whether there is sufficient evidence of an infringement of competition law for it to issue a statement of objections to any party under investigation. Not all cases result in the CMA issuing a statement of objections
  • the CMA will consider any representations it receives before any decision is taken as to whether competition law has in fact been infringed
  • further detail of the CMA’s procedures in Competition Act 1998 cases is available in CMA8
  • changes to the timing of original entries in the case timetable will be made where the estimated timing changes

Personal data

The CMA may collect, use and share personal data for its investigations, including investigations under the Competition Act 1998. This includes processing personal data for the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018.

You can find more information about how the CMA handles personal information in the CMA’s Personal Information Charter.

Contacts

Case team

Updates to this page

Published 8 January 2021
Last updated 31 January 2025 + show all updates

  1. Google's Q4 2024 report published and case page updated.

  2. December 2024 progress update added.

  3. Latest progress update reports from the CMA and Google published.

  4. Updated statement regarding Google’s revised approach, and project manager contact details updated.

  5. Update on Google’s approach to Privacy Sandbox published.

  6. Q1 2024 update reports published.

  7. Q4 2023 update reports published.

  8. CMA Q3 2023 update report and additional guidance published

  9. Q2 2023 CMA report and Q2 2023 Google report published.

  10. Guidance note published

  11. Quarter 1 2023 progress report updated.

  12. Fourth quarterly reports for 2022 published.

  13. Update on proposals for testing published.

  14. CMA's second update report and Google's Q3 progress report published.

  15. Appointment of technical expert published.

  16. Google's Q2 report and CMA progress report published.

  17. Google’s quarterly report and monitoring trustee report published.

  18. Appointment of monitoring trustee published.

  19. Decision to accept binding commitments published.

  20. Notice of intention to accept modified commitments and link to consultation published on the page.

  21. Updates made to case timetable.

  22. Update to the administrative timetable published.

  23. Notice of intention to accept binding commitments published, link to public consultation on commitments added to the page.

  24. First published.

Contents

Related content