Cybersecurity Policy Report, U.K.’s CMA Cites Continuing Concerns About Google’s ‘Privacy Sandbox’, (Nov 12, 2024)

By Lynn Stanton

Although the United Kingdom’s Competition and Markets Authority continues to have concerns about the way in which Google LLC is implementing its “Privacy Sandbox” initiative, including its decision earlier this year to allow Chrome browser users to choose whether to accept third-party cookies rather than eliminating them altogether (CPR, July 23), the CMA yesterday said Google had complied with its existing commitments.

“This means that in our view Google has followed the required process set out in the Commitments and is engaging with us (and the ICO [Information Commissioner’s Office]) to resolve our concerns relating to the development and implementation of the Privacy Sandbox tools,” the CMA said in its latest update on the implementation of the Privacy Sandbox commitments it accepted from Google in February 2022.

The CMA noted that it did not publish an update in the third quarter because it was considering Google’s revised approach regarding third-party cookies. “Our view is that the current Commitments need to be updated to reflect Google’s revised approach. We are discussing with Google the implications of the revised approach for our competition concerns, and the changes that are required to address them,” it said.

“In some areas, there continues to be a risk that parties and Google may use the Privacy Sandbox tools in a way that is not in compliance with Applicable Data Protection Legislation leading to ongoing risks for privacy outcomes. In most cases concerning compliance with this legislation, the responsibility lies with the parties using the Privacy Sandbox tools. Resolving these risks of noncompliance by parties through technical changes to the Privacy Sandbox tools has had to be balanced against the potential for distortions to competition arising from Google’s plans with respect to the availability of third-party cookies in the Chrome browser,” it added.

The CMA said Google had proposed improvements to the governance framework that included a formal consultation period for strategic decisions, an externally managed appeals process, codifying privacy and utility principles, and introducing a new annual reporting mechanism to the CMA and the ICO “on risks to privacy from cross-site tracking under the Privacy Sandbox in Chrome.”

“[O]ur view is that Google’s proposed governance framework could resolve a range of outstanding issues once finalised and provided it is implemented effectively. Until Google has done so, these issues will remain unresolved,” the CMA said.

News: InternationalLegislation DataPrivacy