This is the first CMA update report on implementation of the legally binding Commitments that Google made to address competition concerns identified in relation to its proposals to remove third party cookies from Chrome and replace them with alternative Privacy Sandbox tools. The report aims to explain the progress made to date and highlight areas of focus where potential concerns have been raised, including through feedback from the wider industry. At the end of the report, the CMA has included some specific questions on which it would most value input.

Based on the evidence the CMA currently has available, it considers that from 1 April 2022 to 30 June 2022 (the relevant reporting period), Google has complied with the Commitments it has made. Google is reporting on the basis of calendar quarters, so any developments in July 2022 will be covered in Google’s next quarterly report.

In making this assessment, the CMA recognises that there is still a lot of work to be done. In some cases, specific obligations have not yet been engaged and in other cases detailed assessment must wait until other work is completed. Overall, it thinks that Google has begun the processes and the CMA will continue to monitor its progress for the duration of the Commitments.

The CMA’s current overall priorities are:

• ensuring that Google’s public statements (including any explainers) are accurate and give market participants sufficient information to understand and engage with Google’s proposals;
• ensuring Google designs a robust testing framework for its proposed new tools and Application Programming Interfaces (APIs);
• reviewing Google’s internal processes to ensure that strong firewalls (processes and systems) are in place to prevent the Google Ads services accessing data that they should not, and consider any potential improvements that may be possible; and
• understanding concerns that are being raised by market participants about different elements of the Privacy Sandbox proposals, challenging Google over its proposed approaches and exploring alternative designs for the Privacy Sandbox tools which might address these issues.

The CMA welcomes further engagement from market participants, in particular those who have concerns about any element of the design or implementation of the Privacy Sandbox as set out in the Commitments. The CMA is keen to hear views around the following key questions:

• Where should the CMA focus its efforts in engaging with Google on the design of the Privacy Sandbox APIs?
• What steps should the CMA take to plan for the testing and assessment of the APIs, and what would help stakeholders to engage with the testing process?
• Are there concerns about specific aspects of the Privacy Sandbox APIs which are not covered in Google’s quarterly feedback report and which Google should take into account?
• Are there any instances where Google has mischaracterised elements of the Privacy Sandbox or otherwise failed to meet its obligations under the Commitments?

To access the update report, click here.