Privacy Sandbox saga continues: UK watchdog extracts more commitments from Google over ad tech
- Reference: 1637933587
- News link: https://www.theregister.co.uk/2021/11/26/cma_google/
- Source link:
The CMA's claims come in the wake of [2]yesterday's call by the UK's data watchdog, the Information Commissioner's Office (ICO), for Google and co to sort out the privacy risks posed by ads. The ICO continues to work with the CMA to review the plans of the Mountain View gang.
The investigation by the competition regulator [3]kicked off in January amid worries that Google's intention to change its Chrome browser and phase out third party cookies in favour of a so-called Privacy Sandbox would, in fact, strengthen the megacorp's grip on the online ad ecosystem.
[4]
[5]In June the CMA consulted on initial commitments offered by Google and the feedback from third parties was... they needed a bit of work.
[6]
[7]
That feedback included calls for Google to be more transparent; to bolster the monitoring of compliance; and to improve "the provisions on Google self-preferencing its advertising products and services."
Google's response to the concerns, according to the CMA (which reckons the revisions addresses its worries), has been to offer to:
ensure that the CMA’s role and the ongoing CMA process are mentioned in Google's key public announcements;
instruct its staff not to make claims to customers which contradict the commitments;
report regularly to the CMA on how Google has taken account of third party views;
address concerns about Google removing functionality or information before the full Privacy Sandbox changes, including by delaying enforcement of its Privacy Budget proposal, and offering commitments around the introduction of measures to reduce access to IP addresses;
clarify the internal limits on the data that Google can use;
provide greater certainty to third parties developing alternative technologies;
improve the provisions on reporting and compliance, including by appointing a CMA-approved monitoring trustee; and
provide for a longer duration of six years from the date of any decision to accept Google's modified commitments.
Independent privacy researcher and consultant, [8]Lukasz Olejnik , [9]said of the penultimate point: "I am prepared to volunteer to be the 'trustee'. So, where do I send my application?"
New Google commitment. It will be ABSOLUTELY CRITICAL who will that person be. Will that be someone with technology and appropriate policy skills, obviously independent? Can we trust the process? [10]https://t.co/hedYaKHdlO [11]pic.twitter.com/uKRRVoCZVy — Lukasz Olejnik (@lukOlejnik) [12]November 26, 2021
Quoting the [13]modification notice posted by the CMA [PDF] , he told The Register : "Four respondents objected to paragraph 11(a) of the Initial Commitments, citing Google's stated aim of making the web 'more private and secure for users.'"
"On a similar theme," the Modification Notice continues, "another respondent suggested that Google should publicise that its technology is neither 'more privacy-friendly' than others' technology, nor 'certified' by the CMA or the ICO."
[14]
Olejnik also [15]highlighted Google's promise not to use a user's browsing history once Chrome ends support for third-party cookies.
[16]US states' antitrust lawsuit against Google's advertising business keeps growing
[17]Google loses appeal against $2.7bn EU antitrust fine for distorting competition in price comparison websites
[18]Awkward. At Chrome summit, developer asks: Why should anyone trust Google?
[19]Google's 'Be Evil' business transformation is complete: Time for the end game
[20]Google updates timeline for unpopular Privacy Sandbox, which will kill third-party cookies in Chrome by 2023
'Beware Black Friday offers – read the small print'
The Movement for an Open Web, formerly Marketers for an Open Web (MOW), which has repeatedly expressed concerned at Google's plans to, in its words, "effectively create a Google-owned walled garden" around third-party cookies, sounded a note of caution regarding the CMA's claims and said: "Beware Black Friday offers – read the small print."
It is a [21]hefty document [PDF] after all , weighing in at 125 pages.
Timothy Cowen, MOW's legal advisor and chair of the antitrust practice at Preiskel & Co LLP, said: "We will be looking closely at these commitments – like any Black Friday offer they may be good but they may also be too good to be true."
That said, James Rosewell, founder and director of MOW, said: "Should the commitments avoid the need for an injunction to prevent the digital market being controlled by trillion-dollar US companies then we would welcome them."
[22]
The CMA is now consulting on these new commitments until 17:00 BST on 17 December. If accepted, the investigation will be closed and the next phase of oversight kick off. A very merry Christmas indeed for all the inhabitants of the Chocolate Factory.
As for Google, it [23]said : "We continue to appreciate the thoughtful approach and engagement from the CMA and ICO as we develop our Privacy Sandbox proposals.
"We welcome, and will carefully consider, any comments that people provide during the consultation process."
Google's ad business turned over $148.25bn in sales for the [24]nine months ended 30 September [PDF] , up from $100.72bn in the corresponding period in the prior year. In total, Google turned over $182.3bn, up from $125.6bn. ®
Get our [25]Tech Resources
[1] https://www.gov.uk/government/news/cma-secures-improved-commitments-on-google-s-privacy-sandbox
[2] https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/11/ico-calls-on-google-and-other-companies-to-eliminate-existing-privacy-risks-posed-by-adtech-industry/
[3] https://www.theregister.com/2021/01/09/uk_watchdog_google/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YaESv3BMdmdB0DU@HPJZvQAAAMM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2021/06/11/uk_cma_privacy_sandbox/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YaESv3BMdmdB0DU@HPJZvQAAAMM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YaESv3BMdmdB0DU@HPJZvQAAAMM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://lukaszolejnik.com/
[9] https://twitter.com/lukOlejnik/status/1464168402696785922
[10] https://t.co/hedYaKHdlO
[11] https://t.co/uKRRVoCZVy
[12] https://twitter.com/lukOlejnik/status/1464167486794915841?ref_src=twsrc%5Etfw
[13] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1036204/211126_FINAL_modification_notice.pdf
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YaESv3BMdmdB0DU@HPJZvQAAAMM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://twitter.com/lukOlejnik/status/1464184452054147078
[16] https://www.theregister.com/2021/11/16/google_antitrust_extension/
[17] https://www.theregister.com/2021/11/10/google_shopping_ecj/
[18] https://www.theregister.com/2021/11/08/why_should_anyone_trust_google/
[19] https://www.theregister.com/2021/11/01/google_opinion_column/
[20] https://www.theregister.com/2021/07/26/google_privacy_sandbox_roadmap/
[21] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1036204/211126_FINAL_modification_notice.pdf
[22] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YaESv3BMdmdB0DU@HPJZvQAAAMM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[23] https://blog.google/around-the-globe/google-europe/update-our-privacy-sandbox-commitments/
[24] https://abc.xyz/investor/static/pdf/2021_Q3_alphabet_10Q.pdf?cache=cdb5740
[25] https://whitepapers.theregister.com/
Re: This is a waste of time
Google hasn't wiped the floor with [1]South Korea yet.
[1] https://www.theregister.com/2021/11/18/south_korea_app_store_fines/
Looking down the list….
Looking down the list of commitments G is apparently prepared to make, I notice that most of them don’t come close to “we promise not to be complete and utter bastards and continue to abuse everyone’s data” and the couple that sort-of touch on such an idea are vague and weasely enough for G to ignore them anyway.
Why don’t the gov just pass a bloody law on the lines of “don’t use anyone’s personal data for shit like advertising” and “don’t track anyone” and lock the bloody company directors up when (not if) they fail to comply? If the directors were made personally responsible then they might finally start to behave a bit. Same goes for the bloody water companies, by the way. It’s not f***ing rocket science
Re: Looking down the list….
Some really great suggestions. Sadly trying to lock up the Google BOD is a lost cause.
The US-UK extradition act is so one sided that IMHO, if a US citizen killed the Queen, it still would be impossible to get the culprit extradited to the UK. Whereas... going the other way is very easy as we can see from the Autonomy case.
Re: Looking down the list….
' Why don’t the gov just pass a bloody law on the lines of “don’t use anyone’s personal data for shit like advertising” and “don’t track anyone” '
Because that's contrary to HM Gov's policy of [1]Driving growth and unlocking innovation .
Part of the same picture is the proposal to remove the right " not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her " [GDPR Article 22 and equivalent UK legislation].
See DCMS consultation [2]Data: A New Direction . Paragraph 101 of the consultation document states The Taskforce on Innovation, Growth and Regulatory Reform has recommended that Article 22 of UK GDPR should be removed. [...] [consultation document sadly no longer downloadable].
[1] https://www.gov.uk/government/publications/digital-regulation-driving-growth-and-unlocking-innovation/digital-regulation-driving-growth-and-unlocking-innovation
[2] https://www.gov.uk/government/consultations/data-a-new-direction
Ah yes the "Being seen to be doing..." hypocrisy.
Cookies aren't the problem it's the tracking of unique codes in cookies, urls, and those bits of screen scraping pervert ware by the likes of Adobe and Hotjar and the tying of this data together. Just outright ban selling of data unless the original user officially sanctioned it and if the user does sanction it then the company must give 90% of the profit they make on that data to the user their harvested it from. Make having the data useless and its handling egregious would go a long way to stopping this, hit them where it hurts (their shareholders wallets).
This is why I always prefer not to keep any data the user isn't in direct control of on any of my products. One must always practice what they preach.
UnBoxed Chrome possible?
I wonder if fairly soon it won't be possible to take the Chromium source, and modify the Privacy sandbox code to look like it works, but actually keeps nothing.
Or, the corresponding Google JS in the page will test that the sandbox is functioning, and deny access to the page if it detects anomalous behaviour,
Or something else equally evil.
This is a waste of time
Google will do just as it wants and the CMA can go pound sand as far as they are concerned.
Trying to stop BigG is impossible, They are bigger than many countries so... They are answerable only to themselves. go against them and they'll wipe the floor with you.
I just try to avoid using Googleanything as much as I can. I know that this isn't very much but as the ad slogan says, 'Every little helps'.