UK data privacy regulators ‘disappointed’ in Google’s decision to keep third-party cookies

The ICO has raised concerns with Google’s Privacy Sandbox initiative, a set of proposed solutions to cookie deprecation designed to preserve advertising performance while improving user privacy. The ICO has pointed to a handful of possible vulnerabilities in the Sandbox’s tools that could be exploited to compromise user privacy and even potentially identify individual users who have opted out of being tracked across the web.

“We are disappointed that Google has changed its plans and no longer intends to deprecate third party cookies from the Chrome browser,” said Stephen Bonner, deputy commissioner at the ICO, in a statement shared with The Drum. “From the start of Google’s Sandbox project in 2019, it has been our view that blocking third-party cookies would be a positive step for consumers.”

The ICO is not the only organization that has flagged potential privacy issues inherent in the Sandbox; just last week, research commissioned by the nonprofit interest group the Movement for an Open Web found that Google’s Privacy Sandbox terms may, in fact, violate privacy laws.

Instead of sunsetting third-party cookies on Chrome, Google said on Monday that it intends to retain third-party cookies for users who choose not to disable them. To promote user privacy while maintaining advertising efficacy, Google will introduce a new feature: a one-time prompt allowing users to establish preferences applicable across their Google browsing activities.

Google has not clarified a timeline for when the new feature will roll out to users.

“The new plan set out by Google is a significant change and we will reflect on this new course of action when more detail is available,” the ICO’s Bonner said.

He went on, saying: “Our ambition to support the creation of a more privacy friendly internet continues. Despite Google’s decision, we continue to encourage the digital advertising industry to move to more private alternatives to third party cookies – and not to resort to more opaque forms of tracking. We will monitor how the industry responds and consider regulatory action where systemic non-compliance is identified for all companies including Google.”

The ICO’s previously publicized concerns about Google’s Privacy Sandbox plans were shared with the UK’s antitrust authority, the Competition and Markets Authority (CMA), which has been working closely with the tech giant to phase out cookies without harming market competition.

It has been a long and arduous process: in January of this year, the CMA flagged 39 specific concerns about Google’s Privacy Sandbox. In April, Google said it would push back its third-party cookie deprecation deadline for the third time, citing hiccups in its efforts to win the CMA’s stamp of approval on the Privacy Sandbox.

The CMA previously committed to taking the ICO’s feedback into consideration.

The CMA, for its part, has reacted to Google’s cookie retention plans with less repudiation than the ICO.

“We will need to carefully consider Google’s new approach to Privacy Sandbox, working closely with the ICO in this regard, and welcome views on Google's revised approach – including possible implications for consumers and market outcomes,” a spokesperson for the organization told The Drum in a statement.

The CMA spokesperson added additional context around the group’s initial concerns about Google’s Privacy Sandbox proposals, saying that regulators worried the framework’s solutions “could distort competition by causing advertising spend to become even more concentrated on Google’s ecosystem at the expense of its competitors.”

How the ICO and the CMA will collaborate with Google on its new plans to keep third-party cookies enabled on Chrome while empowering greater user choice remains unclear, but Google’s vice-president of Privacy Sandbox Anthony Chavez said in a company blog post: “We’re discussing this new path with regulators and will engage with the industry as we roll this out.”

Subscribe to Kendra Barnett’s weekly media briefing, as well as The Drum’s daily newsletter, here.