Industry concerns. Marketers and businesses are adapting to the new consent-based model but remain cautious, citing challenges like governance, security and the effectiveness of new tools.
Google's latest update to its Privacy Sandbox comes at a critical juncture as the company rethinks its approach to phasing out third-party cookies from its Chrome web browser.
In a July 2024 announcement, Google announced that rather than eliminating cookies outright, it would introduce a consent-based model that allows users to manage their data more transparently.
However, as the Privacy Sandbox promises to enhance privacy with new APIs and limit invasive tracking, Google remains under scrutiny from the US Department of Justice. The US feds won a case against Google over its dominance in search and now is in a second case over digital advertising.
As businesses prepare to navigate the new tools and consent mechanisms, the industry watches closely to see if regulators and tech changes -- or each -- will impact both competition and the future of personalized advertising.
Google launched Privacy Sandbox in 2019 with a clear goal: to replace third-party cookies with privacy-focused alternatives that would still allow advertisers to deliver relevant, targeted ads while safeguarding user privacy. Third-party cookies have long been a cornerstone of digital advertising, enabling businesses to track users across websites for personalized marketing (i.e. the ad that follows users around the web).
However, growing concerns over data privacy and user tracking spurred regulatory pressure and demands for change. Privacy Sandbox was designed to address these issues by developing new technologies that could protect user data without undermining the ad-supported web ecosystem.
At the core of Privacy Sandbox are several key technologies and APIs aimed at anonymizing user data and shifting away from individual tracking. The Topics API, for example, replaces granular behavioral tracking with broader interest-based targeting, grouping users into general categories based on their browsing habits. Other APIs, such as FLoC (Federated Learning of Cohorts) -- later phased out in favor of the Topics API -- aimed to create group-based identifiers rather than relying on tracking individual users. Google also introduced tools such as FLEDGE (First Locally-Executed Decision over Groups Experiment) to facilitate remarketing in a privacy-preserving manner, and technologies like Private State Tokens to help identify fraudulent activity without compromising user identity.
Google's move to a consent-based model marks a departure from its earlier, more aggressive plans to remove cookies entirely by 2023, now offering a middle ground where users have more control over their data. Still, third-party cookies remain in play for those who consent. By introducing a consent mechanism, Google may be attempting to assuage concerns of it having an unfair advantage while still pushing forward with its privacy-first vision for digital advertising.
Jorge Argota, founder of the marketing agency by the same name, Jorge Argota, told CMSWire that Google's consent-based third-party cookie model in Chrome increases transparency and gives users more control over their data -- but doesn't eliminate tracking; it just centralizes control with Google.
"This gives some privacy benefits but raises questions about how much Google will know about user behavior," he said.
Argota is particularly concerned about the depth of insights Google could gather through this centralized approach, which might result in the company knowing more about user behavior than is necessary or comfortable for users. While Google's shift to a consent-based model ostensibly empowers users, critics argue that it could also create a scenario where Google has greater visibility into user activity than ever before -- particularly when combined with the wealth of data it already controls across its various services. This raises important questions about whether true privacy can be achieved when a single entity holds so much power over user data.
On the other hand, Mike Yeager, VP of engineering at MetaRouter, a server-side tag management solution provider, told CMSWire that Google's shift to a consent-based model for third-party cookies is still a step in the right direction toward improved user privacy and control.
"By giving users the choice between third-party cookies and the Privacy Sandbox framework, Google empowers users with greater control over their data," said Yeager. "It'll be interesting to see how Google educates Chrome users on the differences between third-party tracking and the Privacy Sandbox."
This new model bears a resemblance to Apple's App Tracking Transparency (ATT) framework, introduced in 2021, which required apps to ask users for permission to track their activity across other apps and websites.
However, while Apple's ATT created a stark "opt-in" choice for all users, Google's consent-based system allows more flexibility, potentially giving advertisers continued access to third-party cookies for users who do not actively opt out. The question remains whether Google's approach will strike the right balance between protecting user privacy and maintaining a viable advertising ecosystem.
Nick Tiano, CRO of digital marketing and data consultancy Making Science, told CMSWire that the intended outcome is to evolve the open web and the ads ecosystem that keeps it largely free, by moving the industry out of its user-based, cross-site tracking comfort zone to a more modeled, privacy-centric approach to advertising that improves the user experience.
Tiano explained that the practical goals of the Privacy Sandbox are to address three forcing functions head-on:
Mateusz Jedrocha, chief product officer at Adlook, an advertising services and solutions provider, told CMSWire that his company views these updates to Privacy Sandbox as a positive development that enhances utility for buyers. "It's encouraging to see Google actively listening to and incorporating industry feedback," said Jedrocha. "We want to emphasize that Privacy Sandbox remains crucial, as we anticipate a decline in traffic using third-party cookies once user consent is required. We're eagerly awaiting details on how this consent process will be structured, as this information will allow us to better predict the impact on third-party cookies' share in the ecosystem."
Jedrocha emphasized that these developments underscore the importance of continued collaboration between Google and industry stakeholders in shaping the future of digital advertising.
Related Article: Google Will Not Deprecate Chrome Web Cookies Tracking After All
Regulatory hurdles in the UK and US have likely slowed the rollout of Privacy Sandbox, forcing Google to take a more measured approach and adjust its strategy, as seen in its recent decision to delay the complete phase-out of third-party cookies in favor of a consent-based model.
UK's Competition Markets Authority is closely examining Google's digital ad market.
"Regulators worry that Privacy Sandbox will embed tracking into Chrome and cement Google's market dominance," said Argota. "Google says it will balance privacy and utility but this could limit competitors' ability to operate on a level playing field and create a more Google-centric ad ecosystem."
One of the core issues under investigation is whether Privacy Sandbox will reduce competition by restricting the availability of key user data that smaller ad-tech firms rely on. Smaller ad-tech firms view this as a potential threat to their business models, claiming that Privacy Sandbox favors larger companies with the infrastructure to adapt, particularly Google, which controls both the advertising pipeline and the dominant web browser, Chrome. This dual role has prompted calls for stricter regulatory oversight.
"The changes will create barriers for smaller ad-tech companies and independent advertisers making it harder for them to compete and innovate," said Argota. "The reliance on Google's infrastructure and self serving may prevent them from getting access to the data they need to adapt to the new world."
As the industry prepares for a future where third-party cookies are no longer the primary mechanism for tracking and targeting, advertisers and ad-tech companies are exploring alternative strategies to adapt. Although Google has delayed the complete phase-out of third-party cookies, the need to diversify targeting methods remains critical for advertisers seeking to maintain effectiveness in a privacy-conscious world.
"Advertisers are adapting by focusing on first-party data and learning to use Privacy Sandbox APIs," said Argota. "But integrating these tools is a big challenge especially for smaller businesses with limited resources as they navigate compliance and ad targeting."
Advertisers are increasingly turning to first-party data to build robust profiles and target users without third-party trackers, while also adopting contextual targeting and employing machine learning algorithms to analyze customer behavior and predict interests, enabling personalized ads without relying on cookies.
"Advertisers are facing significant challenges in preparing for the Privacy Sandbox transition," said Yeager. "Many are developing robust first-party data strategies while adapting to new APIs like Topics and FLEDGE. Key challenges include uncertainty around the effectiveness of new APIs, especially for smaller players; performance concerns, as current adtech relies on high-performance server-side ecosystems; and timeline pressures to adapt to new workflows."
Yeager suggested that businesses, particularly smaller ones, will need to invest in understanding and testing these new technologies, which could be resource-intensive and potentially lead to a loss of granularity in targeting and measurement capabilities.
Related Article: Google Cookies Are Here to Stay: What This Means for SEO
Davi Ottenheimer, VP of trust & digital ethics at Inrupt, a data and consent management platform provider founded by Sir Tim Berners-Lee, told CMSWire that although Google's shift toward a consent-based model for third-party cookies in Chrome is marketed as a privacy improvement, it's still problematic.
"The data largely remains within Google's ecosystem, where Google continues to control how it's used," said Ottenheimer. "This gives the illusion of change, but fundamentally, Google retains its central role as the controller and broker of ad-related data. User consent becomes almost irrelevant when all the data processing mechanisms are still tied to Google's infrastructure."
Ottenheimer gave the example of David Hume's analogy of being on a ship in the ocean -- where you can either stay on board or jump into the water -- which he said aptly captures the lack of real choice.
The privacy versus competition tradeoff is at the heart of the debate. While privacy advocates generally support Google's efforts to reduce cross-site tracking, many argue that Privacy Sandbox might not go far enough in ensuring user protection. Some experts fear that Google's new privacy tools, such as the Topics API and FLEDGE, could still enable a degree of targeted advertising that benefits Google's ad platforms at the expense of competitors. By controlling both Chrome and the ad infrastructure, Google's ability to prioritize its own solutions over third-party alternatives raises concerns about further entrenchment in the market.
Yeager explained that concerns remain about power concentration in Google's hands, given their control over both Chrome and Android.
"These concerns are rampant enough that U.S. regulators will potentially take action to break up Google's parent company Alphabet in the coming years, pending current litigation," said Yeager. "In the meantime, while a choice-based approach is an improvement, advertisers and regulators will still carefully scrutinize Google's actions to ensure they truly enhance user privacy."