Brit watchdog thinks Google's tweaked Privacy Sandbox still isn't cricket
(2024/02/01)
- Reference: 1706772968
- News link: https://www.theregister.co.uk/2024/02/01/google_privacy_sandbox_concerns_remain/
- Source link:
Google so far has lived up to its commitments to make room in its Privacy Sandbox for rivals, though the UK's Competition and Markets Authority says a number of concerns still have to be addressed before the web giant's ambitious advertising technology gets its blessing.
The Privacy Sandbox is Google's name for [1]a set of advertising-oriented APIs in its Chrome browser designed to be more privacy-preserving than current privacy-trampling web advertising tech – namely third-party HTTP cookies.
For instance, rather than using these third-party cookies to track a netizen's interests and activities, websites can instead [2]query Chrome directly , via a Privacy Sandbox API, for a list of the user's interests – such as news, gardening, and live music – and then show them ads and special offers based on that. This list of topics is generated by the browser from the user's browsing history.
[3]
Technically speaking, Privacy Sandbox can be implemented by other browsers, though Apple and Mozilla, to name two, have rejected aspects of the technology for Safari and Firefox – such as the aforementioned Topics API.
[4]
[5]
"We are particularly keen on resolving any remaining concerns relating to the design of the Privacy Sandbox tools and to ensure that Google does not use the tools in a way that self-preferences its own advertising services," the Competition and Markets Authority (CMA) explained in an [6]update [PDF] published on Wednesday. "As part of this, we are also looking to clarify the longer-term governance arrangements for the Privacy Sandbox."
Since Google currently has significant control over the direction and development of the Privacy Sandbox, the UK watchdog believes this creates self-preferencing risks. The CMA also wants assurances that Google won't develop its ad technology in a way that reinforces its power over existing ad infrastructure – specifically Google Ad Manager, which supplies more than 90 percent of the display ads served in the UK.
[7]
The CMA began investigating Google's Privacy Sandbox plan in January 2021 under Chapter II of Britain's Competition Act 1998. To mollify the watchdog, Google agreed in 2022 to a set of commitments to ensure its ad tech doesn't put competitors at a disadvantage. The CMA's update on this process is the latest quarterly report from the government agency.
We have identified a series of areas that could raise competition concerns
"Based on our current understanding of the APIs and concerns raised with us by stakeholders, we have identified a series of areas that could raise competition concerns," the report reads. "This does not mean that we currently think the Privacy Sandbox changes cannot go ahead, but it is important that the concerns are resolved, either through design changes, assurances from Google about action it will take or refrain from, or other evidence which resolves our concerns."
Google argues that the Privacy Sandbox aims to allow online publishers to continue to operate and generate revenue from ads amid evolving privacy regulations.
"The Privacy Sandbox initiative is focused on keeping people's activity private across an open and free internet," a Google spokesperson declared in a statement emailed to The Register .
"The goal from the outset has been to enable a robust, ad-supported ecosystem that is more privacy preserving for users while enabling businesses to thrive online. More [8]organizations are leaning into this change and showing it's possible to evolve their existing solutions, and build new ones, using Privacy Sandbox and other privacy-preserving technologies."
The goal has been to enable a robust, ad-supported ecosystem that is more privacy preserving for users
HTTP cookies consist of data deposited in web browser files that get used for both necessary functions – such as determining whether a visitor is logged in to a website – and for discretionary functions – like advertising analytics and tracking.
Scripts allowed to run on websites may give third-party partners of the website publisher the ability to read and write cookie files. But because of the associated privacy risks – third-party marketing firms being able track people across all the sites they visit – third-party cookies have been blocked by default in browsers like Firefox and Safari for several years.
[9]
Google senior director of product management Victor Wong earlier this month [10]argued that Google's proposed APIs are necessary to support online publishers and that the effort to simply block third-party cookies "makes it harder for publishers to support their content and services, and it's bad for user privacy because it leads to more covert forms of user tracking."
Left unaddressed in this observation is the possibility that more covert forms of tracking may not be legal. As Wong notes elsewhere in his post, "Today, more than half the world is covered by comprehensive privacy and data protection laws, and these requirements are increasing."
So perhaps blocking third-party cookies is not so much bad for privacy as it is bad for scofflaw advertisers who risk fines by flouting legal obligations.
[11]Google Chrome Privacy Sandbox open to all: Now websites can tap into your habits directly for ads
[12]EFF urges Chrome users to get out of the Privacy Sandbox
[13]Google to start third-party cookie cull for 30 million Chrome users
[14]Google ready to kick the cookie habit by Q3 2024, for real this time
Google plans to [15]drop support for third-party cookies in its Chrome browser by Q3 this year, once its Privacy Sandbox tech is deemed ready and meets with regulatory approval. Its cookie culling will be an event of some significance in the online ad world, given the dominance of Google Chrome and all the ad services that continue to rely on third-party cookies.
[16]Privacy Sandbox APIs like Topics, Protected Audience, and Attribution Reporting remain controversial – at least among those who haven't boarded Google's bandwagon.
In a [17]missive last week, for example, Jon von Tetzchner, CEO of browser maker Vivaldi, argued that Google's Topics API is no better than Federated Learning of Cohorts ( [18]FLoC ) – a prior proposal for delivering ads based on people's interests that got shelved.
Your browser would still learn about your interests as you move around the web. So, it's basically spyware
"Topics has the same fundamental problem as FLoC: it enables third parties to build profiles, which is always problematic, no matter how many privacy mitigations you put around it," wrote von Tetzchner. "Your browser would still learn about your interests as you move around the web. So, it’s basically spyware."
In a statement to The Register , James Rosewell, co-founder of Movement for an Open Web, an interest group opposed to Google's ad tech, characterized the CMA's enumeration of ongoing concerns as "a major slap on the wrist for Google." He added, "The breadth and depth of these concerns clearly demonstrate that Privacy Sandbox is not fit for purpose, either in its functionality or in its competitive impact on the market."
Google has brushed off persistent criticism of its plans. Wong's post addresses various objections raised by privacy advocates, backers of rival technology, and others. His responses basically amount to "We disagree."
While not every API will be ready right away, the Privacy Sandbox will open for business soon enough, unless the CMA or another regulatory body intervenes.
The CMA noted, "We are gathering views from interested stakeholders on the issues set out in this report," and will accept [19]feedback via email until February 27, 2024. ®
Get our [20]Tech Resources
[1] https://privacysandbox.com/learning-hub/
[2] https://developers.google.com/privacy-sandbox/relevance/topics
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://assets.publishing.service.gov.uk/media/65ba2a504ec51d000dc9f1f5/CMA_Q4_2023_update_report_on_implementation_of_the_Privacy_Sandbox_commitments_PDFA_1.pdf
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://privacysandbox.com/#ecosystem
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://privacysandbox.com/news/ready-for-builders
[11] https://www.theregister.com/2023/09/07/google_privacy_sandbox/
[12] https://www.theregister.com/2023/09/30/eff_chrome_google_sandbox/
[13] https://www.theregister.com/2024/01/04/google_set_to_start_cookie/
[14] https://www.theregister.com/2023/02/01/google_cookie_sandbox/
[15] https://www.theregister.com/2024/01/04/google_set_to_start_cookie/
[16] https://privacysandbox.com/open-web/
[17] https://vivaldi.com/blog/technology/heads-up-googles-going-off-topics-again/
[18] https://www.theregister.com/2022/05/05/googles_floc_flopped_boffins_claim/
[19] mailto:privacysandbox@cma.gov.uk
[20] https://whitepapers.theregister.com/
The Privacy Sandbox is Google's name for [1]a set of advertising-oriented APIs in its Chrome browser designed to be more privacy-preserving than current privacy-trampling web advertising tech – namely third-party HTTP cookies.
For instance, rather than using these third-party cookies to track a netizen's interests and activities, websites can instead [2]query Chrome directly , via a Privacy Sandbox API, for a list of the user's interests – such as news, gardening, and live music – and then show them ads and special offers based on that. This list of topics is generated by the browser from the user's browsing history.
[3]
Technically speaking, Privacy Sandbox can be implemented by other browsers, though Apple and Mozilla, to name two, have rejected aspects of the technology for Safari and Firefox – such as the aforementioned Topics API.
[4]
[5]
"We are particularly keen on resolving any remaining concerns relating to the design of the Privacy Sandbox tools and to ensure that Google does not use the tools in a way that self-preferences its own advertising services," the Competition and Markets Authority (CMA) explained in an [6]update [PDF] published on Wednesday. "As part of this, we are also looking to clarify the longer-term governance arrangements for the Privacy Sandbox."
Since Google currently has significant control over the direction and development of the Privacy Sandbox, the UK watchdog believes this creates self-preferencing risks. The CMA also wants assurances that Google won't develop its ad technology in a way that reinforces its power over existing ad infrastructure – specifically Google Ad Manager, which supplies more than 90 percent of the display ads served in the UK.
[7]
The CMA began investigating Google's Privacy Sandbox plan in January 2021 under Chapter II of Britain's Competition Act 1998. To mollify the watchdog, Google agreed in 2022 to a set of commitments to ensure its ad tech doesn't put competitors at a disadvantage. The CMA's update on this process is the latest quarterly report from the government agency.
We have identified a series of areas that could raise competition concerns
"Based on our current understanding of the APIs and concerns raised with us by stakeholders, we have identified a series of areas that could raise competition concerns," the report reads. "This does not mean that we currently think the Privacy Sandbox changes cannot go ahead, but it is important that the concerns are resolved, either through design changes, assurances from Google about action it will take or refrain from, or other evidence which resolves our concerns."
Google argues that the Privacy Sandbox aims to allow online publishers to continue to operate and generate revenue from ads amid evolving privacy regulations.
"The Privacy Sandbox initiative is focused on keeping people's activity private across an open and free internet," a Google spokesperson declared in a statement emailed to The Register .
"The goal from the outset has been to enable a robust, ad-supported ecosystem that is more privacy preserving for users while enabling businesses to thrive online. More [8]organizations are leaning into this change and showing it's possible to evolve their existing solutions, and build new ones, using Privacy Sandbox and other privacy-preserving technologies."
The goal has been to enable a robust, ad-supported ecosystem that is more privacy preserving for users
HTTP cookies consist of data deposited in web browser files that get used for both necessary functions – such as determining whether a visitor is logged in to a website – and for discretionary functions – like advertising analytics and tracking.
Scripts allowed to run on websites may give third-party partners of the website publisher the ability to read and write cookie files. But because of the associated privacy risks – third-party marketing firms being able track people across all the sites they visit – third-party cookies have been blocked by default in browsers like Firefox and Safari for several years.
[9]
Google senior director of product management Victor Wong earlier this month [10]argued that Google's proposed APIs are necessary to support online publishers and that the effort to simply block third-party cookies "makes it harder for publishers to support their content and services, and it's bad for user privacy because it leads to more covert forms of user tracking."
Left unaddressed in this observation is the possibility that more covert forms of tracking may not be legal. As Wong notes elsewhere in his post, "Today, more than half the world is covered by comprehensive privacy and data protection laws, and these requirements are increasing."
So perhaps blocking third-party cookies is not so much bad for privacy as it is bad for scofflaw advertisers who risk fines by flouting legal obligations.
[11]Google Chrome Privacy Sandbox open to all: Now websites can tap into your habits directly for ads
[12]EFF urges Chrome users to get out of the Privacy Sandbox
[13]Google to start third-party cookie cull for 30 million Chrome users
[14]Google ready to kick the cookie habit by Q3 2024, for real this time
Google plans to [15]drop support for third-party cookies in its Chrome browser by Q3 this year, once its Privacy Sandbox tech is deemed ready and meets with regulatory approval. Its cookie culling will be an event of some significance in the online ad world, given the dominance of Google Chrome and all the ad services that continue to rely on third-party cookies.
[16]Privacy Sandbox APIs like Topics, Protected Audience, and Attribution Reporting remain controversial – at least among those who haven't boarded Google's bandwagon.
In a [17]missive last week, for example, Jon von Tetzchner, CEO of browser maker Vivaldi, argued that Google's Topics API is no better than Federated Learning of Cohorts ( [18]FLoC ) – a prior proposal for delivering ads based on people's interests that got shelved.
Your browser would still learn about your interests as you move around the web. So, it's basically spyware
"Topics has the same fundamental problem as FLoC: it enables third parties to build profiles, which is always problematic, no matter how many privacy mitigations you put around it," wrote von Tetzchner. "Your browser would still learn about your interests as you move around the web. So, it’s basically spyware."
In a statement to The Register , James Rosewell, co-founder of Movement for an Open Web, an interest group opposed to Google's ad tech, characterized the CMA's enumeration of ongoing concerns as "a major slap on the wrist for Google." He added, "The breadth and depth of these concerns clearly demonstrate that Privacy Sandbox is not fit for purpose, either in its functionality or in its competitive impact on the market."
Google has brushed off persistent criticism of its plans. Wong's post addresses various objections raised by privacy advocates, backers of rival technology, and others. His responses basically amount to "We disagree."
While not every API will be ready right away, the Privacy Sandbox will open for business soon enough, unless the CMA or another regulatory body intervenes.
The CMA noted, "We are gathering views from interested stakeholders on the issues set out in this report," and will accept [19]feedback via email until February 27, 2024. ®
Get our [20]Tech Resources
[1] https://privacysandbox.com/learning-hub/
[2] https://developers.google.com/privacy-sandbox/relevance/topics
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://assets.publishing.service.gov.uk/media/65ba2a504ec51d000dc9f1f5/CMA_Q4_2023_update_report_on_implementation_of_the_Privacy_Sandbox_commitments_PDFA_1.pdf
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://privacysandbox.com/#ecosystem
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zbt51akj@KBlRikOhxLJBAAAAQw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://privacysandbox.com/news/ready-for-builders
[11] https://www.theregister.com/2023/09/07/google_privacy_sandbox/
[12] https://www.theregister.com/2023/09/30/eff_chrome_google_sandbox/
[13] https://www.theregister.com/2024/01/04/google_set_to_start_cookie/
[14] https://www.theregister.com/2023/02/01/google_cookie_sandbox/
[15] https://www.theregister.com/2024/01/04/google_set_to_start_cookie/
[16] https://privacysandbox.com/open-web/
[17] https://vivaldi.com/blog/technology/heads-up-googles-going-off-topics-again/
[18] https://www.theregister.com/2022/05/05/googles_floc_flopped_boffins_claim/
[19] mailto:privacysandbox@cma.gov.uk
[20] https://whitepapers.theregister.com/
Re: Still a stupid idea
Electrcial_wanderer
I have conflicted thoughts on this. Privacy is gaining traction in my world and then I am learning just how the web finances itself and works. I don't like it but understand that how it pays for itself. But what I have seen traffic from ads and telementary from my OS and Google slurping data and the kick back against encryption (In the uk snoopers charter).
And then there is web 2.0 or is 3.0 and a brave new world of opt in rather than included by default and no idea.
I agree stupid idea this will push me away from google.
We all can see adds as we search for something and it keeps popping up everywhere adds in videos etc etc
It is too much I won't , or rarely , take any notice of them but the bandwidth and data that flows must be very signifcant.
This explains it well https://youtu.be/JJ0St6OmTp0?feature=shared
My 2p!
Loophole
elsergiovolador
This is plain simple circumvention of GDPR dressed as do-gooding-privacy feature but actually doing the opposite.
Google will no longer have to spend money on building user profile on their end and offload it to user computer - essentially theft of computer resources.
No concern about that from useless CMA?
CMA should have slapped this out of the Google filthy hands, but instead they are appeasing.
Re: Loophole
I ain't Spartacus
The CMA aren't "appeasing". They're raising their concerns in a pretty pro-active way for a regulator. Rather than waiting until the deed is done, then studying it, then saying "oops we shouldn't have allowed that".
They might be preparing to appease in future, but we can't know that. Plus they should get the credit for at least publicly doing the work now.
Also, the CMA aren't a privacy regulator. They're a competition regulator. So they're much more interested in Google abusing its market dominance, having a browser, search and mobile phone OS monopoly.
Still a stupid idea
I work in ad tech. 3rd-party cookies definitely help us in many ways.
But also, non-Chrome browsers have already blocked 3rd-party cookies for years, and we've been just dealing with the lack of those signals, fine.
The amount of effort that Google is putting into "ok we're going to remove 3rd-party cookies but also kinda come up with a weird bundle of replacements which are shitty versions of what we think people want 3rd-party cookies for and also rework how RTB auctions work in Chrome" is just suspicious.
If they actually cared about privacy+tracking they'd just say "we're gonna do like Safari and just disallow that" and then everyone would have to deal with Chrome as we deal with Safari. Instead there's this opaque system, controlled by Google, which they pinky-swear has no backdoors or other ways for Google to get to keep all of your info.
I really, really can't buy the idea that this isn't a subtle land grab by Google that they're trying to sneak by regulators. Just say "no one gets 3rd-party cookies" and be done with it.