CMA update report on
implementation of thePrivacy Sandbox
commitments

April 2023

Summary
1.

This report updates on the implementation of the legally binding Commitmentsthat Google made in February 2022 to address competition concerns relating
to its proposals to remove third party cookies from Chrome and replace themwith alternative Privacy Sandbox tools (see Annex 1). The report summarises
the progress made in Q1 2023. We do not repeat points made in previous
reports (published July and October 2022, and January 2023) unless they
continue to raise issues that we intend to explore further.

2.

Google intends to remove third party cookies from Chrome in the second halfof 2024. Our aim through the Commitments is to ensure any competition
concerns are addressed in the design of the Privacy Sandbox tools and that
we gather evidence of the likely impacts of the changes by the middle of2024. We plan to have robust mechanisms in place to monitor the ongoing
Commitments on Google in relation to use of data and non-discrimination
once third-party cookies are removed.

3.

Based on the available evidence, we consider that from 1 January 2023 to 31
March 2023 (the relevant reporting period), Google has complied with theCommitments. Any developments in April 2023 will be covered in Google’s
next quarterly report.

4.

Building on the priorities for Q1 2023, as set out in our last update report, in
Q2 2023 we intend to focus on the following:(a) Engaging with Google on the design and development of its Privacy
Sandbox proposals with a particular focus on the Attribution Reporting
API, Topics API and First Party Sets (FPS). We are also ensuring that
Google applies the Development and Implementation Criteria inparagraph 8 of the Commitments in the design of its proposals.
(b) Continuing to engage with a range of market participants (with a particularfocus this quarter on advertisers and SSPs) to identify any concerns with
Google’s Privacy Sandbox proposals, challenging Google whereappropriate, and exploring ways of addressing concerns throughalternative designs. We will be participating in W3C’s Private AdvertisingTechnology Community Group as part of this outreach. We are also keen
to engage further with civil society groups to better understand the views
that users might have on the development of Google’s Privacy Sandbox
proposals.

1(c) Progressing plans for testing the effectiveness of the Privacy Sandbox
tools, including working with Google to continue its own tests, andencouraging market participants to carry out their own testing of thePrivacy Sandbox tools.
(d) Analysing Google’s internal systems, particularly around data access andflows. This is likely to be a multi-period activity to ensure that Google is ina position to comply with the data use obligations in Section G of theCommitments upon third-party cookie deprecation.
5.

Although the timeline for removal of third-party cookies has been set by
Google, we are keen to ensure there are no further delays in the process,provided that our competition concerns are addressed. The work we areplanning to undertake, as outlined above, is intended to meet this objective.

6.

Market participants who have concerns about the design and implementationof the Privacy Sandbox should continue providing feedback to us using thecontact details at the end of this report. We are particularly interested to hearfrom advertisers, ad techs and civil society groups (including both those
based in the UK and outside of it) and would encourage representatives ofthese groups to get in touch. While it may not be possible for us to respond toeach individual concern, raising these points means we are better able tomonitor the development of the Privacy Sandbox and ensure that Google ismeeting its legal obligations.

2Dashboard
Dashboard: summary of CMA view on current position, January-March 2023
Relevant sectionof Commitments

Compliance

D - Transparency
and consultation
with third parties

CompliantLevel of focus
by CMA1

Higher focus

E - Involvement of
the CMA in the
Privacy Sandbox
proposals

CompliantHigher focus

F - Standstill
before theRemoval of ThirdParty Cookies

Compliant

Lower focus(currently N/A)

G - Google’s useof data

H - Nondiscrimination

I - Reporting andcompliance

CompliantCompliantCompliantMedium focus

Medium focus

Lower focus

Key actions during period• Engagement with market
participants on quantitative
testing and development of
individual APIs (eg Topics)• Continue to engage with arange of affected third parties
to explore areas of concern• Continue to develop framework
for testing and trialling• Continue to engage on design
issues including approach to
Topics, FPS & UACH.
• Bring in views from external
experts and third parties

Summary of planned
next steps• Continuing to engage with market
participants on quantitative testingand development of individual APIs(eg Attribution Reporting API)
• Ensuring Google continues to
respond to stakeholder concerns.
• Encourage testing and trialling by
Google and other market
participants.
• Engage on design issues including
approach to Topics and First Party
Sets• None• None• Build deeper understanding of
Google’s internal data control
systems• Working to ensure thatnecessary data use protections
are fully implemented well inadvance of third party cookie
deprecation• Analyse Google’s proposed
approach to data controls for paras
25-27• Working to ensure that necessary
data use protections are fully
implemented well in advance ofthird party cookie deprecation• Refining the controls aroundinteractions between internal
working groups involved in thedesign of the Privacy Sandbox• Continue to apply technicalknowledge to monitoring
artifacts and logs

• Completion of regularmonitoring report(s)• Systematise recurring elements ofreporting on Section H measures• Further testing Google’s internal
decision-making process,particularly at key decision points• Continue to apply technicalknowledge to monitoring artifacts
and logs• Google to continue demonstrating
ongoing compliance• Prepare for next monitoring
report(s)Note: this is a summary, so it cannot provide comprehensive details on all topics

1 While all aspects of the Commitments are important, this column is referring to the relative priorities of the CMA,

and which have required a greater focus, during the course of the reporting period.

3

Progress during the most recent reporting period
Testing and trialling7.

The aim of testing and trialling is to gather evidence from Google and thirdparty market participants on the likely impact of the Privacy Sandbox tools
before a final decision is taken on whether to remove third party cookies. As
set out in our previous note on experiments, we are working with Google on
tests that they can run within their ecosystem. However, we recognise that
Google cannot observe impacts across the market as a whole, so we are also
very interested in results of tests carried out by other market participants andkeen to encourage third party testing. Over the past three months we havespoken to a number of ad techs and other groups who have carried out theirown tests or are planning to do so. We would encourage stakeholders tocontinue to reach out to us if they would like to discuss their approaches totesting.

8.

The results from testing and trialling will inform part of our assessment of theeffectiveness of Google’s proposed changes in terms of market outcomes,
competition and privacy, as set out in the Development and Implementation
Criteria in the Commitments. We will also take into account wider qualitative
evidence and views alongside the testing and trialling results, particularly in
relation to impacts that are more difficult to assess through quantitative trials.

9.

To clarify how we are intending to incorporate third-party testing within ourassessment:(a) We are not envisaging that there will be a single, industry-wide test thatcompanies need to sign up to participate in. Instead, we are working with
Google to facilitate testing environments that can support effectivenesstesting by other market participants. We have also provided guidance on
the types of methodologies that we think are most likely to yield
meaningful results, and the type of metrics that we are interested in. We
provided initial guidance in our previous experiments note and willcontinue to develop this as we gain experience of how testing is working
in practice.
(b) There is no prescribed combination of Privacy Sandbox tools that testers
will be required to use. We are interested in understanding how market
participants intend to adapt to the removal of third-party cookies and what
the impacts would be, so testers should build the integrations that makesense for their business. For example, market participants who do not rely
on interest-based advertising may not find it meaningful to test the Topics
API.
4

(c) Relatedly, testers are not advised artificially to constrain themselves by
only using Privacy Sandbox APIs and excluding other signals or
technologies they would expect to use in their live products following
deprecation of third-party cookies. For example, market participants who
expect to sell interest-based advertising using other signals alongside
those generated by the Topics API (eg contextual data, publisher firstparty data) should not feel compelled to exclude such signals from theirtreatment group.2(d) Testing will take place over a period of time, and companies are notrequired to test in a certain timeframe beyond the amount of timenecessary to gather sufficient data for their tests and make the results
available to the CMA in a timely fashion. We would particularly welcome
any early test results that could help identify issues or help improve andshape subsequent industry testing.
10.

We have continued to discuss effectiveness testing with Google and market
participants during Q1 2023. Our discussions with Google have focussed onbuilding a deeper understanding of what ‘ecosystem effects’ the types ofexperiments we described in our initial note on quantitative testing of Google’s
Privacy Sandbox tools can be used to measure. As we outlined in that note,
there are aspects of the market for digital advertising and the Privacy
Sandbox tools that make it challenging to replicate auctions for advertisinginventory in a post-third party cookie world. In dedicating time tounderstanding these challenges, we hope to use the results of experiments aseffectively as possible in our assessment.

11.

Topics, FLEDGE (which Google recently renamed as Protected AudienceAPI), and the Attribution Reporting APIs are scheduled to move to General
Availability as of Q3 2023. It is during this phase that Google intends to carryout quantitative testing of the Privacy Sandbox tools. Market participants
engaging in their own testing in advance of and during this phase, and sharing
results with us, will help in formulating our assessment of the Privacy
Sandbox tools during the Standstill period.

12.

In our last update report, we described how market participants were broadly
supportive of our approach to testing, but had signalled that engagement with

2 In the case of interest-based advertising, market participants might find it useful to design two treatment groups

in their experiments: one including other signals only (eg contextual data and publisher first party data), andanother including these other signals alongside the Topics API. This approach would support the identification of
the incremental benefit of the Topics API.

5

testing the Privacy Sandbox tools was low due to the cost and complexity
involved.3
13.

Market participants told us that further clarity on the timeline and technicalparameters for testing might encourage engagement in advance of ourassessment. Over the next quarter, we will work with Google on mitigations
for any challenges to running experiments and refine a set of recommended
methodologies we can share with market participants for effectiveness testing.
Within the next month we expect Google to publish more detailed guidance on
testing the Privacy Sandbox proposals, and to clarify how Chrome will
facilitate and support third party testing.

14.

We also heard that market participants would like reassurance that Google’s
proposals are close to their final state before dedicating significant resources
to testing, including by Google publishing results of internal testing. We havecontinued to receive similar feedback over this period.

15.

In our January report, we indicated that Google Ads was planning to run
preliminary internal experiments testing the effectiveness of the Topics andMeasurement APIs.4 Since that report, Google has conducted an experimenttesting how the Topics API might affect interest-based advertising for display
ads on Google platforms. Google has published the results of this experimentin a Whitepaper and accompanying blog post.5

16.

We worked closely with Google while the experiment was in the field tounderstand their approach and reviewed their findings before publication. This
experiment was conducted in highly Google-specific circumstances, and is
only a partial test of one of the Privacy Sandbox tools – we would expect
subsequent combined tests of the APIs to give a more robust reflection of
likely impacts. However, we consider Google publishing the results andmethodology to be an important step in providing greater transparency forother market participants about possible testing approaches andmeasurement of impacts.

17.

Google is also in the early stages of running similar testing on theeffectiveness of Measurement APIs. We will continue to work with Google tounderstand these experiments, and expect Google to publish results later thisyear when the testing is further advanced.

18.

To help us formulate our quantitative testing and our overall assessment of
the Privacy Sandbox tools at the Standstill period, we have recently appointed

3 CMA’s Q4 2022 report, paragraph 14.
4 CMA’s Q4 2022 report, paragraph 18.
5 Google’s Whitepaper and blog post.

6

Garrett Johnson, an Assistant Professor of Marketing at Boston University, asa technical adviser working on the implementation of the Commitments.
Professor Johnson was appointed through an open competitive process forhis expertise in online experiments, privacy and online display advertising, as
well as Google’s Privacy Sandbox. We will draw on his expertise in theseareas as we review and develop our testing and assessment framework.6
Design issues
19.

As noted in our previous reports, Google’s current timeline indicates that most
proposals (except IP Protection7 and Privacy Budget) will be available forgeneral adoption as of Q3 2023.8

20.

We have continued to hold detailed discussions with Google during the period
on several of the key Privacy Sandbox APIs, including raising with Google
points that stakeholders put to us during the period, and probing on how the
proposals can be designed to address the Development and Implementation
Criteria in the Commitments. We summarise below the key points raised.

Topics API
21.

We had previously discussed with Google early findings showing limitations in
the URL-based assignment of topics to websites. In this quarter, Google hasannounced an improved classifier considering page titles.9 This should meanthat websites will be assigned topics that are more representative of theircontents, and therefore represents an improvement for the overall utility of the
Topics API.

22.

Several stakeholders raised concerns about the utility of the initial 350-topic
taxonomy. In this quarter, Google is planning to announce an update to thetaxonomy. Google has said it remains committed to a long-term goal ofshifting governance of the taxonomy to an external party that would
continuously incorporate feedback and ideas from across the industry.10 We
understand that Google has been discussing its proposed new taxonomy withseveral market participants across the ad tech supply chain. While a few large
publishers have said that greater utility of topics would increase competitive
pressure on their first-party data based solutions, our preliminary view is that

6 You can read more about Garrett Johnson’s academic work here: Garrett A. Johnson | Assistant Professor ofMarketing Questrom School of Business Boston University (garjoh.com).
7 IP Protection is an updated Privacy Sandbox proposal that supersedes Gnatcatcher.
8 privacysandbox.com/open-web/#the-privacy-sandbox-timeline (accessed 18 January 2023).
9 The page title is an HTML element, containing a short description of a page, and is commonlyused to describe the page to users and search engines.
10 As per the Topics API explainer: patcg-individual-drafts/topics: The Topics API (github.com)

7

greater utility is better for competition overall – in particular for the ability ofsmaller publishers to continue monetising their inventory after the deprecationof third-party cookies.
23.

Overall, our preliminary view is that an improvement in the utility of theindividual topics would be a positive step. However, we are sensitive to therisk of a ‘full capture’ of the taxonomy by Google, and we are also keen tounderstand what any new taxonomy would mean for market participants interms of updating their ad systems. We welcome feedback from the wider
ecosystem.

FLEDGE (now Protected Audience API)24.

We continue to monitor developments and ecosystem feedback on FLEDGE(now Protected Audience API). Google published a blog providing greater
clarity on the timeline for implementation of different features, and which
would be optional in the short term. Our view is that such clarity is welcome
and allows better planning of engineering resources for market participants.

25.

Google also issued further information about the bidding and auction services
that will support computation of part of the auction on a trusted server, as
opposed to entirely on device. Our understanding is that this is beneficial andovercomes latency and user experience issues associated with on-device
processing – and also enables ad techs to run more complex scripts. This isearly stage and we will continue to monitor the implications of using such‘trusted servers’, including security aspects.

26.

We previously ascertained that FLEDGE enables the publisher to decide
which SSP would be the top-level seller in a multi-seller auction (also referred
to as component auction). Google has now also told us that FLEDGE allows
each publisher to choose the structure of the auction, including the choice of
top-level and component sellers (if any).

Attribution Reporting API
27.

On Attribution Reporting API, we noted ad techs have, based on functional
testing, asked for greater utility and in particular quicker reporting. We notethat Google recently announced a move towards evaluating shorter delays(under 10 minutes) in sending aggregate reports (aggregate mode of the API).
We understand also that the addition of null reports will help ensure privacy is
not reduced with this change. For event-level reports, the introduction ofcustom report windows will also allow reports to be received one day after aclick or view, instead of the previous minimum two days.

8

28.

The CMA and the ICO noted the importance of having clarity regarding how
design decisions are made about key API parameters (for Attribution andother APIs), in particular about levels of noise and delays, and how they affectthe privacy vs utility trade-offs.

29.

We continue to be interested in understanding how smaller publishers andadvertisers will be impacted in particular by noise and delays. We welcome
the guidance that Google issued in this quarter, to help market participants
understand the impact of various API parameters – and in particular how tobest use the aggregate mode of the API, e.g. based on volume of conversions
and the product advertised.

User Agent Reduction (UAR)30.

Stakeholders have continued to express concerns about the implementationof UAR and User Agent Client Hints (UA-CH) since the publication of our lastreport.

31.

The User Agent (UA) string is a text field supplied by clients (usuallybrowsers) in communications exchanges with web-servers. Chrome has been
reducing the amount of information in the UA string (through ‘UA-Reduction’)and instead requiring third parties to request the information through UA-CH.
UA-CH reduces the default data supplied in the string whilst enabling servers
to explicitly request specific more fine-grained data for certain use-cases.

32.

UAR rollout for an increasing proportion of Chrome traffic continues largely onschedule.

33.

At the CMA’s request Google has carried out testing of latency incurred whencritical hints are requested via UA-CH. Their findings indicate a modest
latency impact, which is summarised in their latest report. We invite
ecosystem stakeholders to feedback to us if they believe this particularlatency will measurably impact them.

34.

UA-CH functionality continues to be expanded. We note that Google has also
been responsive to some developer feedback, including addressing bugs andedge cases.

35.

We do not see any reason to require Google to pause the ongoing rollout atpresent, however we will continue to monitor latency and take-up metrics.

36.

In the longer term, we will consider the impacts of UAR and UA-CH as part ofour overall assessment of the Privacy Sandbox changes at the Standstill
period.

9

First Party Sets (FPS)37.

During Q1 2023 we asked Google to clarify communications on thespecification for associated sets, which were unclear across the various
communications channels including the Chrome Developer blog and GitHub
repositories. We understand that the final specification of the various
categories of subsets is still an ongoing process in response to stakeholder
feedback.

38.

Google is due to change the status of the current FPS submission processfrom ‘test’ to ‘live’ from the end of April 2023. Previous submissions will bedeleted. We continue to raise and will monitor the potential administrative
burden this process may impose upon Google and are yet to be convincedthat proposed automated checks on the submission process will be sufficient
to ensure smooth operation of the registration (and any subsequent
amendments to their first-party sets) for third parties.

39.

The concern here is that although Google is introducing numerous registration
and attestation mechanisms (for example, developer registration for use ofPrivacy Sandbox APIs), the success of FPS registration is very important to
the overall functioning of Privacy Sandbox. Only one stakeholder attempted
domain registration during the ‘test’ period on the FPS GitHub repository andthey encountered problems. We do not share Google’s confidence that thesystem will be resilient when a ‘cliff-edge’ is reached prior to third-party cookie
deprecation and that the majority of stakeholders are motivated to submit their
domains using the procedure currently available. We have raised theseconcerns with Google, and we will continue to monitor.

Privacy Sandbox enrolment and attestation40.

Google announced an enrolment process for organisations wanting to use key
targeting and measurement Privacy Sandbox APIs. The aim is to obtaingreater transparency for the ecosystem as to how each organisation intends
to use these APIs.

41.

Our preliminary view is that this enrolment process is acceptable as long as
Google does not gain an unfair advantage from collecting additional data
about the use of Privacy Sandbox API. We note that Google will make publicly
available the information it collects through this enrolment process.

Other proposals
42.

We have also continued to discuss with Google its plans for user controls forwhen Privacy Sandbox reaches general availability in 2023. Google has
10presented to the CMA its current proposed user interfaces for controls relating
to Topics, FLEDGE (now Protected Audience API) and ad measurement.
Together with the ICO, we are continuing the dialogue with Google about thisand what underlies current design decisions on the consent flow for opting inor out of Privacy Sandbox; and how this would compare with the consent flow
for Google’s own personalised advertising.
43.

We continue to welcome market participants' feedback on any of the Privacy
Sandbox proposals.

Actions and conclusions of the Monitoring Trustee
44.

The Monitoring Trustee has not informed the CMA of any instances of Google
being non-compliant with its obligations under the relevant paragraphs of theCommitments.

45.

During the reporting period, the Monitoring Trustee has overseen Google’s
activities relating to paragraphs 25-27, 30-31, and 33 of the Commitments,
including:(a) Further refining the controls around interactions between internal working
groups involved in the design of the Privacy Sandbox.
(b) Continuing to review compliance artifacts around internal decision-making
processes (eg logs and records) to test whether Google’s internal
processes are being followed in practice.
(c) Building a deeper understanding of Google's internal data control systems
in order to robustly test Google’s proposals to address its commitments on
Chrome browsing history, Google Analytics data, and ad inventory on
websites not owned and operated by Google. These commitments only
apply after Chrome ends support for third party cookies, but we areworking to ensure that these controls are fully implemented well inadvance of third-party cookie deprecation.
(d) Developing plans to investigate data flows within Google to ensure thatthe data controls are effective in practice (eg addressing potential risks
arising from data use from any secondary storage locations).
(e) Speaking to, and reviewing submissions from, stakeholders who haveraised concerns. We note that we would generally not expect theMonitoring Trustee to respond directly to individual stakeholder feedback,11

but it would incorporate any relevant points into its overall review, as wellas informing the CMA and/or Google as appropriate.11
46.

We would emphasise that while the Monitoring Trustee’s quarterly report
represents a snapshot in time, Google is subject to continuous monitoring forthe duration of the CMA Commitments. Therefore, monitoring activities may
be reported on as in progress or otherwise in the process of discussion,negotiation, investigation, or consideration, with a future road map ofmonitoring work at any given time.

47.

As explained below, the Monitoring Trustee has been working closely with theTechnical Expert, as well as with the CMA. Submissions (or extracts ofsubmissions) from stakeholders which are relevant to multiple elements of thecompliance regime are frequently shared between the CMA, Monitoring
Trustee, and Technical Expert to ensure that they are fully addressed.

Technical Expert
48.

As mentioned in the last update report, the Technical Expert aims to support
the Monitoring Trustee by providing the following skills which are vital for
effective monitoring of the Commitments:(a) Analysing Google’s data access and flows;(b) Analysing technical access controls and security; and(c) Providing general ad tech expertise and advice.

49.

We have also continued our direct dialogue with the Technical Expert.
Discussions have focused primarily on market trends and issues concerning
the design and implementation of Google’s Privacy Sandbox proposals.

Engagement with market participants
50.

We are continuing to engage with market participants in the wider online
advertising ecosystem to ensure that we become aware of, and understand,concerns about the Privacy Sandbox tools and their impact.

51.

It is important to note that our own stakeholder engagement is not intended asa substitute for market participants’ direct interactions with Google, and we

11 Under paragraph 12 of the Commitments, ‘Google will take into consideration reasonable views andsuggestions expressed to it by publishers, advertisers and ad tech providers, including (but not limited to) thoseexpressed in the W3C or any other fora, in relation to the Privacy Sandbox proposals, including testing, in order
to better apply the Development and Implementation Criteria in the design, development and implementation of
the Privacy Sandbox proposals’.

12would encourage participants to raise substantive concerns through existing
channels including W3C. Google is required under the Commitments to
respond to reasonable views and suggestions, as summarised in Google’squarterly report which is published alongside this document. It is importantthat Google responds substantively to feedback, and we will highlight toGoogle where we do not consider that it has provided an adequate response
and ensure that it does so.
52.

Since the publication of the CMA’s last report, in Q1 2023, our engagement
has had a particular focus on publishers, organisations developing alternative
cookie-less technologies and civil society groups. Concerns raised throughout
the stakeholder engagement process have been raised with Google, anddirectly informed our role overseeing the design and implementation of its
proposals.

53.

Some publishers raised the following concerns:(a) that the limit of three associated domains within Google’s updated First
Party Sets proposals would restrict their ability to compete with large
platforms by pooling data across commonly-owned publications;(b) that the Topics API taxonomy was not granular enough to support
interest-based advertising, while others felt that increasing its
effectiveness further would undermine publishers’ own first party data
efforts;(c) that W3C was an unfamiliar venue for publishers, and that alternative fora
should be utilised for non-technical policy discussions.

54.

Companies developing alternative cookie-less technologies expressed
concern that uncertainty in Google’s timeline for third-party cookie deprecation
had negatively impacted investment. This is a concern we have heard
repeated by certain publisher associations. We recognise this concern, and as
mentioned above, we do not want to see the timeline extended further,
provided our competition concerns can be addressed. There is also concernthat Google might restrict the ability of alternative technologies to operate
through changes to its Chrome browser, and that this further contributed to
uncertainty.

55.

Additionally, a civil society group told us that by delaying deprecation of thirdparty cookies in Chrome, the commitments process was preserving the statusquo and leading to a delay in the privacy benefit resulting from the removal of
third-party cookies.

13

56.

We shared the above concerns and comments with Google during the period.
Google has provided responses to each point, in addition to feedback
received directly, in its Q1 2023 report.

57.

Through the course of our engagement, we also heard concerns related toGoogle’s proposed Android Privacy Sandbox. As previously noted, Google’s
Android developments are not included within the scope of Google’s
Commitments agreed with the CMA, although we have passed on feedback to
Google where appropriate.

58.

Since our last report, members of our case team have joined W3C’s Private
Advertising Technology Community Group. We do not intend to play an activerole in the group but we will be observing the ongoing debate.

59.

We are continuing to discuss these issues with Google and otherstakeholders, and will continue to monitor developments in W3C over the nextreporting period. Given the global nature of Google’s developments, wewelcome feedback from organisations both within and outside the UK.

Engagement with the ICO and international authorities
60.

We have continued to work together with the ICO in implementing theCommitments. The ICO’s role has included:(a) Participating in discussions with us and Google on the development of thePrivacy Sandbox tools, analysing data protection impacts with a specificemphasis on user controls;(b) Continuing to work with us on plans for the wider assessment of thePrivacy Sandbox tools, including assessing privacy impacts; and(c) Engaging with market participants on proposed alternative technologies totargeting.

61.

We have also continued to engage with our international counterparts anddata protection authorities on the of implementation of the Commitments in aneffort to identify any issues of common concern and ensure consistency ofapproach.

Current views and next steps
62.

Based on the available evidence, we consider that Google has been
compliant with the Commitments.

14

63.

Over the next three months, we are planning to focus on the following
activities:(a) Engaging with Google on the design and development of its Privacy
Sandbox proposals with a particular focus on the Attribution Reporting
API, Topics API and First Party Sets (FPS). We are also ensuring that
Google applies the Development and Implementation Criteria inparagraph 8 of the Commitments in the design of its proposals.
(b) Continuing to engage with a range of market participants (with a particularfocus this quarter on advertisers and SSPs) to identify any concerns with
Google’s Privacy Sandbox proposals, challenging Google whereappropriate, and exploring ways of addressing concerns throughalternative designs. We will be participating in W3C’s Private AdvertisingTechnology Community Group as part of this outreach. We are also keen
to engage further with civil society groups to better understand the views
that users might have on the development of Google’s Privacy Sandbox
proposals.
(c) Progressing plans for testing the effectiveness of the Privacy Sandbox
tools, including working with Google to continue its own tests, andencouraging market participants to carry out their own testing of thePrivacy Sandbox tools.
(d) Analysing Google’s internal systems, particularly around data access andflows. This is likely to be a multi-period activity to ensure that Google is ina position to comply with the data use obligations in Section G of theCommitments upon third-party cookie deprecation.

64.

We are planning to publish our next update report and Google’s quarterly
update in July 2023.

Contact details
65.

We would welcome views from members of the online advertising ecosystemon this report, as well as on any other relevant publications (eg Google’s own
quarterly reports). The relevant contact details are:(a) CMA: privacysandbox@cma.gov.uk; matthew.allsop@cma.gov.uk;
angela.nissyrios@cma.gov.uk; and chris.jenkins@cma.gov.uk.
(b) Monitoring Trustee (including communications for the TechnicalExpert): trustee.services@ing.com; matthew.hancox@ing.com; anddavid.verroken@ing.com.
15

(c) Google: Feedback - Chrome Developers.

16Annex 1 – current proposals in the Privacy Sandbox
At the time of publication, the list of proposals in the Privacy Sandbox include:
1.

Use Case: Fight spam and fraud on the web(a) Private State Tokens (previously Trust Tokens)

2.

Use Case: Show relevant content and ads(d) Topics(e) FLEDGE (now Protected Audience)3.

Use Case: Measure digital ads(a) Attribution Reporting4.

Use Case: Strengthen cross-site privacy boundaries(a) First Party Sets(b) Shared Storage(c) CHIPS(d) Fenced Frames(e) Federated Credential Management

5.

Use Case: Prevent covert tracking(a) User Agent Reduction (including User-Agent Client Hints)(b) DNS-over-HTTPS(c) Storage Partitioning(d) Network State Partitioning(e) IP Protection (previously Gnatcatcher)(f) Privacy Budget(g) Bounce Tracking Mitigations

17