Go back to menu

Digital Advertising - Out with the old and in with the new

The Google Privacy Sandbox

01 June 2021

At the end of 2019, Google announced its intention to phase out third-party cookies on the Chrome browser by 2022. Third-party cookies will be replaced with a new set of tools for targeted advertising, referred to as the 'Privacy Sandbox', that Google says is intended to provide greater protection of consumers' privacy.

This article provides an overview of what exactly the Privacy Sandbox entails and what consequences it has for consumer privacy and digital advertising.

The use of third-party cookies for digital advertising

Third-party cookies play a fundamental role on the web and in particular in digital advertising. They are the most common mechanism for cross-site tracking and record data about a user's use of a website to direct and display advertisements as precisely as possible. Third-party cookies are created by a third-party (i.e. not by the website owner, but usually by an ad tech company) to store information for a domain which is different to the website that the user is currently visiting (e.g. if a user sees an advert for jeans, while browsing YouTube, then third-party cookies have been used to track their behaviour on other websites to advertise to them). The user knows that they are interacting with the website that they are on but may not be aware of the ad tech companies that are collecting their information, including to sell to third parties for their own profit.

The Privacy Sandbox

While much of the web's ability to deliver and monetise content has been built on third-party cookies, the use of third-party cookies has also raised privacy concerns for consumers, because they make it technically possible to track users across sites. In the EU, the use of cookies by website operators is regulated by the General Data Protection Regulation (GDPR) and the ePrivacy Directive (ePD).Under the GDPR and ePD, an obligation is imposed on the entity placing a cookie on a user's computer to obtain the prior informed consent of that user (with an exemption for cookies that are strictly necessary). This means that (i) information about the sending and purposes of the cookie must be given to the user, (ii) the user, having been provided with this information, must consent before the cookie is placed on their computer or the information stored in their computer is retrieved, and (iii) the user must be able to choose whether to give consent to the use of cookies and must provide an active indication that they consent.

The Privacy Sandbox is a set of proposals, currently in a testing and experimentation phase, about how advertising can be rebuilt without third-party cookies, and covers ad targeting, ad delivery, ad performance reporting, and user privacy. The rationale behind it is that publishers, marketers and ad tech companies will no longer be able to track users across the web through the use of third-party cookies. Instead, the tracking of users will only be possible at a cohort level. This means that users can only be tracked as part of a large group comprising thousands of other users. The browser will perform the tracking, and will expose only aggregate information to third-parties.

'Federated Learning of Cohorts'

One of the proposals is 'FLoC', which stands for 'Federated Learning of Cohorts', which will use an advanced machine learning technology known as 'federated learning' to allow advertisers to reach new audiences. With FLoC, web browsers (like Chrome and Firefox) talk to each other and, based on a user's browsing habits, find other similar users and group them together into cohorts, i.e. different sets of users will be grouped together by their browsing habits to try and establish a shared meaning. This is all done anonymously, so no actual user data is shared. By creating FLoCs, the personal identities of users will be concealed, but it will still be possible to use data from a user's browsing history to determine their interests for targeted advertising. From a user perspective, FLoC should not create any difference between how the web of today and the web in a post-Privacy Sandbox world works.

Final thoughts

It is important to note that Google has a significant role in digital advertising, both for publishers who want to sell advertising space, and for advertisers who want to display their ads on the publisher's platform. Further, Google operates the world's most used browser 'Chrome' and mobile operating system 'Android', as well as other popular online services that are used globally (e.g. Youtube, Google Search and Google Maps). Many of the players in the online advertising world are therefore dependent on Google and will be forced to accept the consequences of the Privacy Sandbox.

Google claims that the implementation of the Privacy Sandbox will not equal a decrease in revenue for publishers, and it will still be possible for advertisers to use targeted advertising. However, there is a concern that the Privacy Sandbox will increase Google's market dominance because it will give Google access to more data than what is made available to other industry players (e.g. publishers, advertisers, other web browsers and ad tech vendors). For example, ad networks will have to rely on Google's first-party logged-in data, without being able to gain access to any data directly from their audiences.

Google's Privacy Sandbox is still a work in progress, and it is not clear how it will affect users, other web browsers and the advertising market. We should all keep a close eye on what its further development and implementation means for privacy and competition standards, and the future of monetising the web.