The CMA Is Prepared to Delay Google's Cookie Deprecation Plans

The U.K. Competition and Markets Authority might extend the deadline on cookie deprecation if Google Chrome does not satisfy its concerns, Craig Jenkins, director of the digital markets unit at the CMA, told a room full of ad-tech practitioners at an IAB Tech Lab event in New York today. “If we’re not satisfied we can resolve the concerns, [we can make changes] to effectively delay the implementation,” of third-party cookie deprecation, Jenkins said. “We do have powers to ensure Google addresses these concerns.” Such a delay would only come after Google and the CMA failed to come to an understanding over four months. The CMA will start a formal review of Google’s plan to deprecate cookies and Chrome’s Privacy Sandbox replacements once Google triggers a 60-day standstill period, likely at the beginning of the third quarter. During this standstill, the tech giant is forbidden to put in motion any deprecation procedures on Chrome. During this period, the CMA, which has legal authority to ensure Google’s plans aren’t anti-competitive, will work to address and fix any objections it has with Google’s plan. If they can’t reach an agreement, the 60-day standstill period will become 120 days. If the CMA still finds Google uncooperative, the body can rework the deprecation timeline and even sue Google to stop. “If we’re at the point in the standstill where concerns can’t be resolved, we would consider further action, including potentially opening a case,” Jenkins said. Jenkins said the CMA’s investigation is rooted in concerns that Google could use privacy sandbox to further entrench its dominant position in the market in three ways: Google could use data from Chrome to replicate third-party cookies that competitors wouldn’t have access to, the sandbox could preference Google over other companies or consumer might not have sufficient control over privacy preferences. The CMA’s public reiteration of its intentions to rigorously scrutinize Google comes on the heels of a seething report published by the IAB Tech Lab last month, which raised many concerns about the technical viability of the privacy sandbox as a digital advertising solution. The CMA’s comments provide a modicum of direction in an industry that finds itself increasingly divided and scrambling in the face of cookie deprecation. How the CMA is evaluating Google The CMA is evaluating how Google designs privacy sandbox APIs to ensure they don’t enhance the company’s market position. At the event, Mark Dixon, senior product manager at publisher network Freestar, asked if the CMA was worried that the privacy sandbox pushed more data processing to users’ devices. One of Privacy Sandbox protocols, the Protected Audience API, runs auctions on the Chrome browser. Jenkins responded that the CMA is most concerned about protecting user privacy and ensuring Google’s Ad Manager doesn’t have a competitive advantage but still encourages industry feedback. Jenkins also noted that publishers and ad-tech firms should test the privacy sandbox so the CMA is fully aware of all the market’s concerns. “The sooner we can see test results the better,” Jenkins said. “We want to see test results by the end of June.” But most ad-tech firms have only begun testing privacy sandbox around the end of 2023, many spurred by testing grants from Google, noted Nick Llerandi, staff engineer at Kargo. “Given that this was hastily done by ad-tech firms, does this question the quality of results?” Llerandi asked CMA representatives at the IAB Tech Lab panel. The 2024 Ad-Tech Battleground: Identity and Politics Jenkins and Marcus Grazette, assistant director of data and technology insight at the CMA, assured that while the CMA wants to see ad-tech firms tests of the privacy sandbox, those experiments are just one ingredient to the CMA’s full evaluation, which will also include work from economists. If the CMA does find a reason to delay Google’s cookie-deprecation timeline, many in the industry will be relieved, especially given the risks of the cookie-free future for many Internet businesses, risks highlighted by IAB Tech Lab CEO Anthony Katsur during the event’s opening remarks. “Once the damage is done,” by cookie deprecation, Katsur said, “It will be hard for many smaller media companies to crawl back from this.”