The Google vs CMA war of attrition

I’m Alan Chapell. I’ve been working at the intersection of privacy, competition and advertising for decades and I’m now writing for The Monopoly Report. If you have a tip to share in confidence, ping me on Signal at chapell.33.

Our latest Monopoly Report podcast is out with Bill Wise, Co-founder and CEO of Mediaocean. Bill has a few things to say about Google.

The UK Competition and Markets Authority has just released the Q2/Q3 update report on Google’s Privacy Sandbox Commitments in connection with the deprecation of TPC. The tl;dr is that CMA says that competition concerns remain with Google’s approach but CMA actions indicate that the CMA might be looking to move on from the Sandbox.

How to win a war of attrition

PSA to any competition regulator out there. If you take ONE thing from Google’s Sandbox Commitments over the past few years, I hope it is this: any antitrust remedy that involves the creation of a process managed by Google will ultimately exhaust you and your entire team - leading to insomnia, depression and acute career stagnation. Run while you still can. The Google folks are just too good at this game.

When I look at Google’s interactions with the UK Competition and Markets Authority, I feel like those interactions could be seen as analogous to the American Revolution. It’s not so much that a fledgling America defeated England when General Cornwallis surrendered his army to General George Washington in 1781. Rather, it’s that England lost the will to fight and decided to focus its energies elsewhere.

Is that what’s going on between Google and the CMA? You tell me.

A brief history of the Privacy Sandbox

Back in 2019, Google announced that it was deprecating third-party cookies in Chrome. Concerns were raised to the UK Competition and Markets Authority (CMA) regarding the competitive impact of Google’s plan. The CMA and the ICO (i.e., UK’s data protection regulator) teamed up to address these challenges and negotiated a set of Commitments for Google – as well as a process by which outstanding competition and privacy concerns could be addressed as Google builds out the Sandbox Tools and deprecates TPC.

Perhaps the most glaring omission by the CMA in this process was its inability to quantify what is an acceptable loss in functionality as between status quo (i.e., advertising with TPC) and the newly created Sandbox tools. I don’t think anyone was expecting that the Sandbox tools would be 90% as effective as TPC. But equally, I wonder if anyone in the ad tech space would have endured this marathon had they thought the CMA’s Mendoza Line was closer to 40-50%.

As part of its CMA Commitments, Google is required to provide a quarterly update regarding its progress towards building out the Privacy Sandbox tools and its plan to deprecate third-party cookies (TPCs). Google pretty much blew up the entire process this past July by announcing that they wanted to take a different course. Under the new process, rather than deprecating TPC unilaterally, Chrome will offer some kind of choice prompt, although the particulars of such are still TBD.

In my view, one of the reasons that Google pivoted to the choice prompt was to avoid having to directly face a litany of bad press in connection with release of Sandbox testing results. (Btw, what’s the point of putting a process into place and demanding that the entire marketplace follow the process if you are unable or unwilling to prevent Google from going in an entirely different direction simply because they don’t like how the wind is blowing.) Anyway, the CMA opted to pause its quarterly reporting in order to reassess.

Where do things stand as of now? (i.e., what the CMA is saying)

There’s a disconnect as between what the CMA is saying and what the CMA is doing. If you choose to take the CMA literally, one might conclude that: (1) the CMA’s position is that competition concerns remain under Google’s revised approach, (2) the CMA will publicly consult before taking any decision on whether to accept these changes to Google’s Commitments, and that (3) the CMA hopes to provide an assessment of Sandbox testing and trialling results by the end of 2024. Sounds OK, right?

Where do things REALLY stand (i.e., what the CMA is doing)

But if one looks at the specific actions the CMA is taking, a very different picture emerges.

Specifically: (1) Chris Jenkins, who has been leading this process for the CMA has moved to a new role, (2) the CMA has closed out a number of issues based mostly on assurances from Google when counter evidence has also been presented, and (3) the CMA plans to allow Google to setup a separate governance framework (i.e., distinct from the process created under Google’s CMA Commitments) to address many of the issues that remain open. And this new Governance framework will be the process used to manage the Sandbox going forward.

I kid you not! After four years of little progress but lots of of running our industry around in circles via a multi-stakeholder process run by Google that was (sort of) monitored by the CMA… the CMA’s final solution here is to punt the most difficult outstanding questions to [checks notes] ANOTHER. PROCESS. RUN. BY. GOOGLE!

A perfect 10, CMA. No notes.

At this point, you might also be wondering: Why did we bother to go through a multi-year process of uncovering and raising issues if the CMA was just going to take Google’s word most of the time?

I wish I had answers to those questions - perhaps they’ll be addressed in the NEXT set of Sandbox update reports.

What else is in the Q2/Q3 Update?

Two things jumped out at me.

Google Collaborating on Enforcement with the ICO - Google would provide the ICO with an “annual reporting on cross-site tracking risks on Privacy Sandbox on Chrome”. In other words, Google will be deputized by the ICO to provide information about how Google’s competitors use the Sandbox tools.

Compliance Obligations – The Report states that: “In most cases, we consider that the primary responsibility for mitigating these risks rests with the parties using the Privacy Sandbox tools.” OK Google, when will I be able to review that Sandbox joint controller DPA?

When will Google start deprecating TPC in Chrome via the choice prompts?

Neither the CMA nor Google have made any indication, but Google also hasn’t specifically changed its timing plans since its April 2024 announcement. Back then, Google said that they were eying early 2025. Does the choice prompt change that timing? Beats me…

It is certainly possible that the choice screen prompt process could commence as soon as next Spring or Summer 2025. We’ll probably have a better idea when the CMA provides an update later this quarter. I suspect that the “soft” goal for TPC deprecation via choice prompt is to have it start in mid-2025. In order to support that timing, you may see Google starting to socialize the choice screens in the next week or two. By December, you should see the CMA report analyzing Sandbox test results to date.

Is mid-2025 realistic? It really depends on the extent to which the CMA is still fully invested in this process. Practically speaking, a mid-2025 timeline may be hard to meet if: (a) there is additional Sandbox testing, (b) the marketplace is allowed input into how the choice prompts are presented, and (c) there is a robust dialog regarding how the new Google governance framework will work in practice. As of now, those seem like pretty big IFS….

Is there ANYTHING buried here which might give us optimism?

There’s always the chance that there’s some super-secret plan being executed behind the scenes. Perhaps the EU Commission or some other regulator will jump in with something prohibiting TPC deprecation and rebooting this process entirely. (e.g., DOJ wins a divestiture of Chrome AND gets an injunction preventing TPC deprecation). Or maybe the UK CMA is simply going through the motions with this investigation and separately planning on opening up a new investigation via the UK’s brand new (and much more powerful) competition law.

I’m skeptical that this is the case. For one thing, it’s hard to believe that the CMA would waste time closing so many of the current issues (and using some very pro-Google logic justifying those closures) if they were seriously planning to move the project elsewhere.

Meanwhile, we all wait - and continue to operate in all the uncertainty. Which ironically, is also not great for competition.

Alan’s Hot Takes…

Here are a few additional stories that hit me over the past week and that I wish I had time to cover for thoroughly. But Ari makes me buy him a case of beer every week I go over 2,000 words.

• DOJ will ask for Chrome Divestiture - The DOJ reportedly will ask Judge Mehta to divest Chrome from Google. A few thoughts on the reports that the DOJ is going to push for divestment of Chrome: (1) Big props to Jonathan Kanter and DOJ for swinging for the fences, (2) I'd pump breaks - we're still in early innings and there are a lot of things that can change, (3) Google has made clear (e.g., CMA Sandbox process described above) that other types of remedies are low utility / high frustration endeavors, so that leaves us with divestment (here's hoping other regulators see that as well), (4) Serious question: Is Chrome a viable business outside the confines of Google? and (5) Who wants to bet that the same company tries to buy both TikTok and Chrome, but the proposed merger gets blocked by the FTC? (6) Perhaps the most significant way this could impact the digital media space is if Judge Mehta agrees with Google re: the divestiture of Chrome and ALSO imposes a temporary injunction on Google from deprecating cookies.

• FTC Blog Post on Data Clean Rooms? – If you view the recent blog post on Data Clean Rooms as mostly the FTC’s attempt to state that clean rooms carry risks, and that the FTC stands ready to protect against consumer harm, then the blog post is not so bad. A few thoughts: (1) Accuracy? The FTC certainly made a few misstatements. (e.g., Let’s be careful with terms like “most” unless you show your math - it’d be ironic if the FTC were making false or deceptive statements). (2) Definitions? "Clean rooms" are not well defined (definitions or lack thereof are an endemic issue in adtech). When the market refuses to define something (i.e., because most participants might just prefer to exploit the seams) you run the risk of having your critics defining things for you. As such, (3) Join me? it might be time for a code of conduct for Data Clean Rooms. Anyone want to help me create one?

• IAB (and other trades) sue FTC over click-to-cancel rules – I’m a bit baffled by the IAB’s decision to participate in a lawsuit that pushes back on the FTC’s recent click to cancel rules. Under click to cancel, a consumer signing up online must be allowed to cancel online rather than needing to call a support line, write a letter, or show up in person. California has already imposed a very similar rule. Lots of anger on LinkedIn over this - has anyone gotten on the phone with IAB to discuss? Anyone from the IAB want to come on the pod to explain?

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.