Privacy Sandbox: Envisioning Advertising After Google Kills off Third-Party Cookies
Privacy Sandbox and third-party cookie deprecation need to meet the expectations of the privacy community, users, advertisers, and the adtech industry.
- In May this year, Google said it would bring Privacy Sandbox for 1% of Chrome users and disable cookies for them starting in early 2024.
- The search giant in July released Privacy Sandbox APIs in tandem with Chrome 115.
- Read on to understand the impact of Privacy Sandbox on companies and how businesses can respond.
Google is planning to replace cookie-driven tracking for advertising with Privacy Sandbox. After being in the experimental phase for years and multiple delays, in May this year, the company said it would bring Privacy Sandbox for 1% of Chrome users and disable cookies for them starting in early 2024. The company plans to deprecate third-party cookies completely by H2 2023.
More importantly, the search giant in July released Privacy Sandbox APIs in tandem with Chrome 115. The gradual rollout of these relevance and measurement APIs would cover 35% of Chrome users in July 2023, 60% in August, and as much as 99% of Chrome users by September and October this year in time for the next iteration of Chrome.
The previous delays in the rollout of Privacy Sandbox signal a vital requirement: it needs to meet the expectations of the privacy community, users, advertisers, and the adtech industry.
Progress of the Privacy Sandbox Project
So, can it be delayed again? Lecio DePaula, vice president of data protection at KnowBe4, told Spiceworks News & Insights, “I think this depends on where the technology is at in the next six months or so and if ad companies see that they can get ROI implementing some of the new standards and practices. For this to work, it needs to show value to not only Google but the advertising companies as well.”
Rachael Ormiston, head of privacy at Osano, said she “would not be surprised to see delays or more phased rollouts.”
“The Sandbox is intended to provide a solution that will reduce the tracking of personal information being exchanged by eliminating many third-party cookies. Finding a solution that achieves this, and meets the needs of privacy and competition authorities while continuing to be a reliant advertising tool, may take time,” Ormiston added.
The current Privacy Sandbox initiative incorporates Topics API, the replacement for the ill-fated Federated Learning of Cohorts (FLoC); the first locally-executed decision over groups experiment’ or FLEDGE API (rebranded to Protected Audience API) for remarketing, the Attribution Reporting API for conversion measurement, Cookies Having Independent Partitioned State or CHIPs for cross-site tracking, and other infrastructural changes.
As things stand, here’s Google’s progress:
Privacy Sandbox Timeline
Source: Google
Third-Party Cookie Deprecation Timeline
Source: Google
Is Privacy Sandbox as Effective for Privacy?
The deprecation of third-party cookies, web fingerprinting, and other related behavioral user tracking and the ushering in of Privacy Sandbox has been met with mixed responses from the data privacy community and privacy and antitrust regulators alike.
As such, U.K’s privacy watchdog, Competition Markets & Authority, oversees the development of Privacy Sandbox. The regulator also released new guidelines for testing Privacy Sandbox, scheduled to conclude in early Q4 2023.
Still, it raises the question of whether Privacy Sandbox would help safeguard end-user privacy, as Google claims. “I do believe it’s more privacy-centric, especially with the focus on cutting out third-party cookies. This alone would significantly reduce the amount of personal data processed and collected by organizations without the knowledge of the end user,” DePaula opined.
“The other components also help minimize cross-site tracking, such as storage partitioning, first-party sets, and fenced frames.”
Ormiston pointed out the benefits of Privacy Sandbox features, such as differential privacy and k-anonymity, but added that the project’s overall impact should only be assessed based on the ongoing tests.
DePaula suggested Google go beyond CMA and work closely with “those organizations and implement valuable feedback that the organizations may have” to expedite the process. “Additionally, the sandbox should be marketed further to get the standards/tools in the hands of more developers. The more people that leverage these standards, the higher likelihood that valuable implementations or use of the standards are created.”
Possible Impact of Privacy Sandbox
In February 2022, when Google first announced Privacy Sandbox for Android, Anthony Chavez, VP of product management for Android Security & Privacy at Google, noted that Google is committed to creating and instituting a privacy-preserving alternative path. Advertising is, after all, Google’s primary revenue source.
Apple and DuckDuckGo’s App Tracking Transparency (ATT) and App Tracking Protection (ATP) obliterate behavioral advertising. For instance, since ATT was released in April 2021, Meta (then Facebook), Twitter (now X), Snapchat, and YouTube cumulatively lost out on $9.85 billion in revenue by November of that year, 80% of which was borne by Meta.
In 2022, Lotame assessed the impact of ATT on Meta’s coffers to the tune of $12.5 billion. Google doesn’t want to do that. If it does, the biggest victim would be the company itself.
“As this would phase out third-party cookies, it will help bring in a new era of less invasive marketing tactics and data collection,” DePaula said. “The con for organizations is that it will take a while to iron everything out and get the ‘new school’ data collection to show an ROI similar to the one they had by using more invasive tactics.
“There will be a huge shift in company processes and policies, which will cause some disruption for organizations that do not have the power or capacity to implement new solutions.”
Ormiston added that she expects some revenue drop, more so than what was observed between 2021-2022. “There has been some reticence by adtech vendors concerned about the potential loss in the efficacy of third-party cookie replacements, which may mean a potential revenue drop,” Ormiston said.
The Internet Advertising Revenue Report 2023 notes that internet advertising revenues grew 10.8% year-over-year (YoY) between 2021-2022 to $209.7 billion after rising 35% between 2020-2021. The drop in internet advertising revenue growth between 2021-2022 is attributed partially to ATT and the cooldown of the COVID-19-induced boom in 2020-2021.
How Can Businesses Respond to Privacy Sandbox?
Advertisers would have to rely on first-party user data instead of third-party cookies. Companies can tap into existing customers to make up for the lost revenue in the short term. According to Smile.io data, repeat customers usually spend more, have a higher average order value than first-time customers, have a higher conversion rate, and have a lower average customer acquisition cost.
Meanwhile, developers would need to consider and adapt to these “inevitable” privacy changes to avoid becoming functionally irrelevant.
Third parties can also identify the 470 topics (will increase) under Google’s Topics taxonomy that suits them the most. This privacy-preserving interest data should give companies a head start in adapting to the new paradigm.
“The ecosystem is changing, and I think businesses will be best positioned by taking steps to monitor the developments but also lean into the layers of protection that it hopes to provide. Trust and transparency are key drivers to these changes, but these also help grow business as a differentiator too,” said DePaula.
Interestingly, the World Wide Web Consortium (W3C) has said Topics could be used for “inappropriate surveillance.”
Meanwhile, DePaula called for a shift in marketing strategies. He said, “Organizations need to perform data and process audits to understand what data they are collecting and how it’s being collected. From there, they can gameplan a solution to incorporate the new marketing techniques in their processes and phase out the old marketing practices.”
Opportunities that lie ahead
DePaula added that not only can the release of Privacy Sandbox usher in greater privacy, but it should also give rise to more creativity in marketing efforts.
“If successful, it could show that organizations can be successful without resorting to invasive privacy practices. Individuals or consultants who specialize in this sort of implementation will be in high demand, which will create job opportunities for new people in the industry or organizations that already assist with marketing initiatives,” DePaula said.
“The more privacy that we implement now, the more privacy can eventually be embedded into processes in the future. This is just one small step to a more privacy-centric web, and I’m excited for what’s to come as privacy continues to be embedded in data collection practices.”
How can organizations adapt to Privacy Sandbox? Share your thoughts with us on LinkedIn, Twitter, or Facebook. We’d love to hear from you!
Image source: Shutterstock
MORE ON GOOGLE
