Google lets a few Android devices into its Privacy Sandbox
(2023/02/14)
- Reference: 1676394008
- News link: https://www.theregister.co.uk/2023/02/14/google_privacy_sandox_beta/
- Source link:
Google on Tuesday began rolling out a beta test of its Privacy Sandbox software for a small portion of Android 13 devices to learn how its purportedly privacy-protecting ad tech actually performs.
Google [1]began working on its Privacy Sandbox in 2019 and its Android iteration [2]surfaced a year ago . The ad tech do-over represents an attempt to maintain current modes of online advertising, like targeting and [3]remarketing , once invasive third-party cookies – used for cross-site tracking and profiling – get phased out.
That was originally supposed to happen in 2022, but was pushed back to 2023, then to 2024, and may yet require longer still.
[4]
The delay has been due to the fact that [5]the technology didn't deliver , at least initially, and that a lot of digital ad firms worry Google's [6]Privacy Sandbox will leave them in the dark.
[7]
[8]
Just as law enforcement groups have fretted that encryption hinders surveillance and forensics, ad tech companies fear that privacy technology will deprive them of data that Google and other large rivals like Apple can collect through their first-party relationships with consumers who use their services.
Ad firms in turn have drawn government regulators into the debate, alongside standards bodies like W3C and privacy groups. These industry stakeholders and members of the internet community have insisted on having a say in what Privacy Sandbox technologies do and how they get implemented.
[9]
Despite the fact that W3C last month gave Google's Topics API, a Privacy Sandbox proposal to track people's interests for target advertising, a [10]failing grade , Google remains committed to its third-party cookie replacement systems.
"Over the past year, we've worked closely with the industry to gather feedback and begin testing these new technologies," said Anthony Chavez, VP of product management for Privacy Sandbox, in a blog post provided to The Register .
"Today, we're entering the next phase of this initiative, rolling out the first Beta for the Privacy Sandbox on Android to eligible devices. With the Beta, users and developers will be able to experience and evaluate [11]these new solutions in the real world."
[12]
In the case of the Topics API, it's appropriate that Chavez said "worked closely" rather than "is working closely" because Google's response to W3C indicates that the company isn't doing much to resolve negative input.
In [13]a response last Thursday to the January W3C report, Google software engineer Michael Kleber expressed willingness to talk while making it clear that Privacy Sandbox construction and the Topics API development will continue despite disinterest from Apple, Mozilla, and W3C:
Your response to this proposal, and the related responses from WebKit and Mozilla, make it clear that without changes or new information, Topics in its current form is not likely to gain multi-browser support or progress along the W3C standards track. In the long term, the Privacy Sandbox effort aims to converge with other browsers on APIs that we all agree are appropriate for the Web and useful for online advertising without cross-site tracking.
In the near term, however, Chrome is unable to remove third-party cookies (expected in 2024) without making some privacy-improving replacement technologies available. The Topics API will remain part of the collection of APIs that we expect the ads ecosystem to test during 2023 – and we hope the testing feedback we hear and the implementer experience we gain will be valuable contributions in future work towards cross-browser standards work in this space, however long that takes.
Even if Chrome does manage to drop support for third-party cookies in 2024, other aspects of the not-so-private legacy ad tech regime look likely to linger several years beyond that point. In a Privacy Sandbox [14]blog post last week, Google indicated that a technology called Fenced Frames (a replacement for iFrames) will be required no sooner than 2026, and that a supporting placeholder technology like " [15]entry-level auction win reporting " will remain active until then.
[16]Google ready to kick the cookie habit by Q3 2024, for real this time
[17]Shot down: Google's grand fancy plan for pro-privacy targeted ads
[18]UK competition watchdog investigates Apple and Google 'stranglehold' over the mobile market
[19]Google postpones Chrome's third-party cookie bonfire yet again
There's reason to believe the current ad tech stack may remain viable until 2028. James Rosewell, CEO of data service biz 51Degrees and director of marketing advocacy group [20]Movement for an Open Web , pointed to Google's 2022 [21]commitment to the UK Competition and Markets Authority (CMA) to consult with interested parties. The agreement [22]lasts for six years [PDF] unless the CMA chooses to release Google from its obligations.
Roswell told The Register in an email there's "zero chance of FLEDGE, et al., meeting competition requirements. Therefore existing Chrome/Android functionality remains until Feb 2028 not 2026. Privacy in practice isn't being improved for anyone as Google and Apple continue to know everything about everyone."
But regardless of when or whether Google's ad tech renovation reaches general availability and industry acceptance, [23]testing has now moved beyond desktop browsers to the Android ecosystem.
This rollout is aimed at developers involved in marketing and publishing who are interested in seeing how current Privacy Sandbox APIs perform. Hence the blog post's mention of [24]developer guidance and the selection of effusive quotes from industry partners.
"The Privacy Sandbox Beta provides new APIs that are designed with privacy at the core, and don't use identifiers that can track your activity across apps and websites," said Chavez. "Apps that choose to participate in the Beta can use these APIs to show you relevant ads and measure their effectiveness."
The Privacy Sandbox for Android Beta is being made available to "a small percentage of Android 13 devices," and the plan is to expand enrollment over time. According to Google, those selected to participate in the beta test will receive an Android notification.
Notified individuals outside the European Economic Area, Switzerland, and the UK will have to opt out if they prefer not to participate. Selected Android users within those areas, however, will have to opt in to sample Privacy Sandbox-based ads.
Those freed from the obligation to exempt themselves can thank their legislators. ®
Get our [25]Tech Resources
[1] https://www.theregister.com/2019/08/22/google_chrome_privacy_sandbox/
[2] https://www.theregister.com/2022/02/17/google_privacy_sandbox/
[3] https://advertising.amazon.com/library/guides/remarketing
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2022/01/26/google_floc_topics/
[6] https://privacysandbox.com/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/01/18/google_topics_api/
[11] https://developer.android.com/design-for-safety/privacy-sandbox?beta-post#proposed-solutions
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://github.com/w3ctag/design-reviews/issues/726#issuecomment-1424728951
[14] https://developer.chrome.com/docs/privacy-sandbox/fledge-api/feature-status/
[15] https://github.com/WICG/turtledove/blob/main/FLEDGE.md#5-event-level-reporting-for-now
[16] https://www.theregister.com/2023/02/01/google_cookie_sandbox/
[17] https://www.theregister.com/2023/01/18/google_topics_api/
[18] https://www.theregister.com/2022/11/23/cma_apple_google_investigation/
[19] https://www.theregister.com/2022/07/28/google_postpones_thirdparty_cookie_phaseout/
[20] https://movementforanopenweb.com/
[21] https://competitionandmarkets.blog.gov.uk/2022/02/24/cma-secures-final-privacy-sandbox-commitments-from-google/
[22] https://assets.publishing.service.gov.uk/media/62052c6a8fa8f510a204374a/100222_Appendix_1A_Google_s_final_commitments.pdf
[23] https://www.theregister.com/2021/07/08/google_floc_changes/
[24] https://developer.android.com/design-for-safety/privacy-sandbox/program-overview?version=beta
[25] https://whitepapers.theregister.com/
Google [1]began working on its Privacy Sandbox in 2019 and its Android iteration [2]surfaced a year ago . The ad tech do-over represents an attempt to maintain current modes of online advertising, like targeting and [3]remarketing , once invasive third-party cookies – used for cross-site tracking and profiling – get phased out.
That was originally supposed to happen in 2022, but was pushed back to 2023, then to 2024, and may yet require longer still.
[4]
The delay has been due to the fact that [5]the technology didn't deliver , at least initially, and that a lot of digital ad firms worry Google's [6]Privacy Sandbox will leave them in the dark.
[7]
[8]
Just as law enforcement groups have fretted that encryption hinders surveillance and forensics, ad tech companies fear that privacy technology will deprive them of data that Google and other large rivals like Apple can collect through their first-party relationships with consumers who use their services.
Ad firms in turn have drawn government regulators into the debate, alongside standards bodies like W3C and privacy groups. These industry stakeholders and members of the internet community have insisted on having a say in what Privacy Sandbox technologies do and how they get implemented.
[9]
Despite the fact that W3C last month gave Google's Topics API, a Privacy Sandbox proposal to track people's interests for target advertising, a [10]failing grade , Google remains committed to its third-party cookie replacement systems.
"Over the past year, we've worked closely with the industry to gather feedback and begin testing these new technologies," said Anthony Chavez, VP of product management for Privacy Sandbox, in a blog post provided to The Register .
"Today, we're entering the next phase of this initiative, rolling out the first Beta for the Privacy Sandbox on Android to eligible devices. With the Beta, users and developers will be able to experience and evaluate [11]these new solutions in the real world."
[12]
In the case of the Topics API, it's appropriate that Chavez said "worked closely" rather than "is working closely" because Google's response to W3C indicates that the company isn't doing much to resolve negative input.
In [13]a response last Thursday to the January W3C report, Google software engineer Michael Kleber expressed willingness to talk while making it clear that Privacy Sandbox construction and the Topics API development will continue despite disinterest from Apple, Mozilla, and W3C:
Your response to this proposal, and the related responses from WebKit and Mozilla, make it clear that without changes or new information, Topics in its current form is not likely to gain multi-browser support or progress along the W3C standards track. In the long term, the Privacy Sandbox effort aims to converge with other browsers on APIs that we all agree are appropriate for the Web and useful for online advertising without cross-site tracking.
In the near term, however, Chrome is unable to remove third-party cookies (expected in 2024) without making some privacy-improving replacement technologies available. The Topics API will remain part of the collection of APIs that we expect the ads ecosystem to test during 2023 – and we hope the testing feedback we hear and the implementer experience we gain will be valuable contributions in future work towards cross-browser standards work in this space, however long that takes.
Even if Chrome does manage to drop support for third-party cookies in 2024, other aspects of the not-so-private legacy ad tech regime look likely to linger several years beyond that point. In a Privacy Sandbox [14]blog post last week, Google indicated that a technology called Fenced Frames (a replacement for iFrames) will be required no sooner than 2026, and that a supporting placeholder technology like " [15]entry-level auction win reporting " will remain active until then.
[16]Google ready to kick the cookie habit by Q3 2024, for real this time
[17]Shot down: Google's grand fancy plan for pro-privacy targeted ads
[18]UK competition watchdog investigates Apple and Google 'stranglehold' over the mobile market
[19]Google postpones Chrome's third-party cookie bonfire yet again
There's reason to believe the current ad tech stack may remain viable until 2028. James Rosewell, CEO of data service biz 51Degrees and director of marketing advocacy group [20]Movement for an Open Web , pointed to Google's 2022 [21]commitment to the UK Competition and Markets Authority (CMA) to consult with interested parties. The agreement [22]lasts for six years [PDF] unless the CMA chooses to release Google from its obligations.
Roswell told The Register in an email there's "zero chance of FLEDGE, et al., meeting competition requirements. Therefore existing Chrome/Android functionality remains until Feb 2028 not 2026. Privacy in practice isn't being improved for anyone as Google and Apple continue to know everything about everyone."
But regardless of when or whether Google's ad tech renovation reaches general availability and industry acceptance, [23]testing has now moved beyond desktop browsers to the Android ecosystem.
This rollout is aimed at developers involved in marketing and publishing who are interested in seeing how current Privacy Sandbox APIs perform. Hence the blog post's mention of [24]developer guidance and the selection of effusive quotes from industry partners.
"The Privacy Sandbox Beta provides new APIs that are designed with privacy at the core, and don't use identifiers that can track your activity across apps and websites," said Chavez. "Apps that choose to participate in the Beta can use these APIs to show you relevant ads and measure their effectiveness."
The Privacy Sandbox for Android Beta is being made available to "a small percentage of Android 13 devices," and the plan is to expand enrollment over time. According to Google, those selected to participate in the beta test will receive an Android notification.
Notified individuals outside the European Economic Area, Switzerland, and the UK will have to opt out if they prefer not to participate. Selected Android users within those areas, however, will have to opt in to sample Privacy Sandbox-based ads.
Those freed from the obligation to exempt themselves can thank their legislators. ®
Get our [25]Tech Resources
[1] https://www.theregister.com/2019/08/22/google_chrome_privacy_sandbox/
[2] https://www.theregister.com/2022/02/17/google_privacy_sandbox/
[3] https://advertising.amazon.com/library/guides/remarketing
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2022/01/26/google_floc_topics/
[6] https://privacysandbox.com/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/01/18/google_topics_api/
[11] https://developer.android.com/design-for-safety/privacy-sandbox?beta-post#proposed-solutions
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@wSkn8krG99ITKTtMmO6AAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://github.com/w3ctag/design-reviews/issues/726#issuecomment-1424728951
[14] https://developer.chrome.com/docs/privacy-sandbox/fledge-api/feature-status/
[15] https://github.com/WICG/turtledove/blob/main/FLEDGE.md#5-event-level-reporting-for-now
[16] https://www.theregister.com/2023/02/01/google_cookie_sandbox/
[17] https://www.theregister.com/2023/01/18/google_topics_api/
[18] https://www.theregister.com/2022/11/23/cma_apple_google_investigation/
[19] https://www.theregister.com/2022/07/28/google_postpones_thirdparty_cookie_phaseout/
[20] https://movementforanopenweb.com/
[21] https://competitionandmarkets.blog.gov.uk/2022/02/24/cma-secures-final-privacy-sandbox-commitments-from-google/
[22] https://assets.publishing.service.gov.uk/media/62052c6a8fa8f510a204374a/100222_Appendix_1A_Google_s_final_commitments.pdf
[23] https://www.theregister.com/2021/07/08/google_floc_changes/
[24] https://developer.android.com/design-for-safety/privacy-sandbox/program-overview?version=beta
[25] https://whitepapers.theregister.com/
Re: Torn on this.
Anonymous Coward
Do you use Google keyboard? Check all those nice, juicy services that app uses, besides the actual keyboard and then we'll talk.
Re: Torn on this.
JimboSmith
If you’re worried about Google (or other companies) spying on you on your Android phone/tablet there is a way to stop them. It’s to use a no root firewall and block outgoing and incoming connections for individual apps and services. You can see which addresses apps are trying to communicate with and how frequently. I restricted a weather app I downloaded to just the source for the data, it had a fit and complained that it couldn’t connect which it bloody well could, but just not to the random dodgy website it wanted to. I deleted that one and found another that didn’t complain.
Re: Torn on this.
Yet Another Anonymous coward
What if it's "Android (ie Google) system networking", and the destination is Google.com? You going to block those?
That's the complaint, Google can block all other advertising trackers leaving itself a monopoly to buy targeted ads from
Re: Torn on this.
Chet Mannly
And if you block Play Services all manner of things cease working. And you just know Google will incorporate it into play services so it can't be uninstalled/blocked...
Re: Torn on this.
Chet Mannly
Not torn here - Google scooping up every lick of data they can *and* running their ad system to process all that data on my device?
That's a hard f#%^ off from the Australian judge...
Alternative approach
LenG
I'm not sure I'll ever be able to fully prevent the various service providers from gathering information about me but I'm not too bothered as I have made a pretty good fist of ensuring that ads aren't actually displayed.
Torn on this.
If Google are only going to collect data via their first-party relationship with users, and block everybody else from tracking then this sounds like a great idea to me personally: I use none of Google's services, so that would be a win for me. However I simply don't believe that they'd only collect data that way, so on balance if Google think this is a good idea then it probably isn't - when the biggest data-slurper on the planet starts talking about user privacy my bullshit meter goes off.