Google’s Privacy Sandbox: A Solution, or A Shiny Object? The UK’s MOW Weighs In

Advocacy group Movement for an Open Web (MOW) prides itself in finding ways around one of the W3C’s biggest voices, Google.

In the United States, the cookie replacement talk is all Privacy Sandbox this, Privacy Sandbox that, but in the UK, they seem to move to the beat of a more skeptical drum. 

There is no doubt that Google dominates the open web. Whether you’re an ad tech company, publisher, or buyer, you will transact with the tech giant in some capacity. 

When it comes to big tech entities like Google, there is no competition, regardless of what they might tell the Department of Justice. They have the pipes, infrastructure, and the audience to garner the majority of ad spend.

Following the Competition and Markets Authority’s (CMA) report on digital markets in July 2020, the Movement for an Open Web (MOW) started in September 2022. MOW was encouraged by the CMA, as they needed someone to come forward to do their job. MOW is comprised of a mix of media, advertising and technology businesses.

MOW doesn’t see itself as a general services company. The organization was the original body that complained to the CMA, leading to the commitments that delayed the rollout of the Privacy Sandbox. Without MOW’s complaint and the CMA, Google’s Sandbox may have rolled out long ago.

“I think the fact that we exist is a testament to the fact that established trade bodies are not able to represent victims’ interests for various reasons adequately, some of which are the membership of Google in those organizations and the financial dependency that those organizations have on Google,” said James Rosewell, co-founder of MOW. Rosewell is also one of the leading voices of SWAN (Secure Web Addressability Network), a community-operated and open-source replacement for many use cases supported by third-party cookies.

Uncovering the Truth Within the Sandbox

The CMA’s current commitment to Google is that the entity exists to judge whether competition will be preserved once Google makes a series of changes. The highlighted modification is the end of third-party cookies, but other components, like IP protection, bounce tracking, and more, are set to change.

The test is twofold: one, does the design give the possibility of equivalence, and two, does the testing provide the evidence so that the CMA could make a decision that would stand up as a minimum for other regulators?

MOW believes the Privacy Sandbox fails on both of those tests. The design can’t achieve equivalents with third-party cookies, and we also see testing woes. We are just throwing things at a wall to see what sticks, which is not scientific enough, according to Rosewell.

In a perfect world, Google would have tested this technology on their properties. As a suggestion, MOW strongly feels that Google should have applied the Privacy Sandbox across YouTube for at least a quarter and then reported the revenue impact to the Security and Exchange Commission (SEC). Then, they could prove the revenue uplift associated with its usage. Upon publishing their findings on the market they would have achieved a high standard of SEC reporting and showed the market what worked, giving the CMA more of a leg to stand on.

Google ran a very small test, where they continued to use third-party cookies for everything except segmentation. They only tested the Privacy Sandbox solutions for attribution and tracking, but that was only one aspect. Big G claimed that the test ran on their owned and operated properties, but that just wasn’t enough according to MOW. The nonprofit organization strongly feels that if the Privacy Sandbox were this saving grace that Google claims it to be, YouTube would have made much more money using it. 

For publishers using the Privacy Sandbox, MOW warns that you won’t be able to measure advertising on your websites. This can only be accomplished by using Google’s algorithms to measure it at an aggregate level with noise.

“If you’re a massive advertiser like Nike or a massive Publisher like The Washington Post or the DailyMail, then the noise in aggregate reporting may be tolerable for you, but if the same amount of noise is added to a chain of three hairdressers in a local community’s website or a small local publisher, then it might not meet the threshold to come up and be surfaced as a report,” Roswell pointed out. 

Smaller businesses are restricted by the technologies that Google provides, he says. There is also no auditing and independent auditors like the Media Rating Council to determine whether or not Google’s code, the way it’s working, and the way it’s deployed is accurate. That is going to be a real problem. 

Is the Future of 2024 Bright?

2024 is going to be different because the dialogue will move to remedies. MOW is working on a summary of remedies in discussions with the organization’s participants and industry regulators. 

We need to see the browser regulated just as we would regulate traditional telecommunications. “AT&T does not have the power to tell a consumer that they don’t like a particular phone conversation they are having on the network; they wouldn’t ask to interfere in your conversation,” Rosewell added. 

He explained that digital advertising is about 25 years old and we must see regulation. The browser should be limited to access and navigation as it was originally intended. According to MOW, if standard bodies are regulated, they can’t disadvantage other participants as they do now by preferring the web browser and giving the web browser vendor preferential status.