UK Antitrust Probe: Google's Cookie Replacement Plan

The United Kingdom’s Competition and Markets Authority (CMA) is currently reviewing Google’s plans to discontinue support for third-party cookies within its Chrome browser and the Chromium engine.

The regulatory body announced today that it has initiated an investigation, operating under Chapter II of the U.K.’s Competition Act 1998, to examine “suspected breaches of competition law by Google”.

This action stems from a formal complaint submitted in November by a group of digital marketing firms, requesting the CMA to prevent Google from enacting its “Privacy Sandbox” initiative.

The CMA also acknowledged receiving complaints from news organizations and technology companies who allege the technology company is leveraging a dominant market position, it stated.

A representative for Google provided the following statement in response to inquiries regarding the CMA investigation:

Google had previously indicated its intention to implement the Sandbox in 2021—an acceleration of the original schedule for phasing out third-party cookies, which generated significant concern within the adtech sector reliant on extensive tracking of internet users.

According to Google, no alterations have been made to date.

The company also communicated today that any modifications will be postponed until 2022, as it continues a collaborative process—now incorporating close engagement with the CMA—to determine how to replace tracking cookies.

Digital marketers have expressed apprehension about their capacity to effectively target advertisements to web users as browsers move to eliminate support for essential tracking technologies with the approaching end of third-party cookies.

However, it is important to note that Google’s Chrome is actually behind other browsers in proposing the removal of tracking cookies; WebKit, the foundation of Safari, declared a tracking prevention policy back in 2019—drawing inspiration from Mozilla’s earlier anti-tracking measures. (Mozilla made blocking third-party cookies in Firefox the default setting in September of the same year.)

These anti-tracking efforts by browser developers are, to some extent, a reaction to consumer dissatisfaction with intrusive advertising and concerns regarding their online privacy.

Furthermore, within the European Union, many fundamental components of adtech infrastructure are subject to complaints and ongoing regulatory assessment. (However, the U.K.’s data protection regulator, the ICO, is currently facing legal action for failing to address complaints concerning the legality of real-time bidding, dating back to September 2018.)

The central argument made by the marketing, publishing, and adtech businesses objecting to the end of cookies is that large technology companies—Google in this instance—are utilizing privacy as a pretext to enhance their market influence (and control over user data) at the expense of smaller businesses.

“The investigation will assess whether the proposals could cause advertising spend to become even more concentrated on Google’s ecosystem at the expense of its competitors,” the CMA explained in a press release announcing its investigation. “It follows complaints of anticompetitive behaviour and requests for the CMA to ensure that Google develops its proposals in a way that does not distort competition.”

The announcement also emphasizes that the regulator recognizes the legitimate issue of privacy concerns—with the CMA stating that it has been “considering how best to address legitimate privacy concerns without distorting competition”. This has involved discussions with the Information Commissioner’s Office (ICO), and conversations with Google to “better understand its proposals”, it says.

“The current investigation will provide a framework for the continuation of this work, and, potentially, a legal basis for any solution that emerges”, the CMA added.

The precise replacement for tracking cookies remains uncertain.

Google has presented several proposals through the W3C standards forum, including “Dovekey”, which suggests utilizing a key value server and, according to Google, builds upon feedback and proposals from adtech firm Criteo’s Sparrow proposal.

It has also shared the algorithms for its Federated Learning of Cohorts (FLoC) proposal—referring to a suggestion to employ a specific machine learning technique to enable continued behavioral ad targeting (without the need to collect individual user data).

The broader adtech industry has also been developing various alternatives to tracking cookies. Examples include the UnifiedOpen ID 2.0 proposal (developed by The Trade Desk), which proposes a centralized system for tracking internet users based on personal data like email addresses or phone numbers, and the Unified ID service launched by TechCrunch’s parent company, Verizon Media (utilizing its access to first-party data), among others.

Therefore, the eventual replacement for tracking cookies is unlikely to be straightforward or singular, especially considering the newly introduced regulatory dimension to Google’s efforts.

With its Sandbox project underway but no replacement for tracking cookies yet chosen, the CMA’s intervention appears strategically timed—potentially granting the U.K. regulator a significant role in shaping the future of adtech.

However, it could also result in regulatory discrepancies for adtech in the U.K. compared to the European Union, where the Commission’s antitrust regulators have also been scrutinizing Google’s adtech practices but have not yet initiated a formal investigation—depending on the outcome of any probe/intervention there.

In the U.K., a recent CMA market study of the digital advertising sector led it to report significant concerns regarding the power of the Google-Facebook adtech duopoly—and it solicited feedback on potentially breaking up the tech giants—although in its final report it postponed any competitive intervention in favor of awaiting government legislation.

Subsequently, U.K. ministers have unveiled a plan to establish a pro-competition regulatory framework that will include a new statutory code of conduct, overseen by a Digital Market Unit (to be established this year), with the goal of imposing firm limitations on large (ad)tech companies—potentially requiring them to offer users an opt-out from behavioral advertising (something Facebook currently does not provide).

Update: The U.K.-based marketing coalition that filed a complaint with the CMA regarding Google’s Privacy Sandbox has expressed its support for the investigation, describing it as “vital for the future of all online businesses, including publishers, technology companies and advertisers”.

In a statement, James Rosewell, director of the Marketers for an Open Web (MOW) coalition, added: “This is about the future of the Open Web and the threat that Google poses to its development. By launching this investigation, the CMA has recognised the seriousness of this issue.”

“Privacy Sandbox would effectively create a Google-owned walled garden that would close down the competitive, vibrant Open Web. Providing more directly identifiable, personal information to Google does not protect anyone’s privacy. We believe that the CMA’s investigation will confirm this and save the web for future generations”, he added.

Rosewell’s statement also encourages interested businesses to join MOW in advocating for an injunction to prevent Google’s Sandbox from being implemented “until after legislation is implemented”, although the identities of those behind its campaign for a “vibrant Open Web” remain unclear, except for Rosewell himself, who is CEO and co-founder of U.K. mobile marketing company, 51 Degrees.

A membership section of MOW’s website does not currently list any of its supporters—making only a general reference to “top companies across the globe”. (We’ve contacted MOW for further information on its membership and will update if we receive any names. Update: A spokesperson informed us that MOW members “have had to remain confidential as they’re concerned about repercussions from Google”.)

“We estimate that our supporters work with more than 21,000 advertisers and nearly 6 million individual websites in more than 50 countries, jointly serving over 320 billion advertising impressions each year. The companies have a combined workforce of over 10,000 employees and combined revenues in excess of $4BN,” MOW adds on the site, without identifying any of the adtech players involved in the complaint that Google’s Privacy Sandbox is threatening the open web.