4 February 2022
COMPETITION AND MARKETS AUTHORITY
Case 50972 ‐ Privacy Sandbox
Google Commitments Offer

A. Introduction
1.

In August 2019, Google launched its Privacy Sandbox initiative to develop a set ofopen standards with the stated aim of enhancing privacy on the web.1

2. On 7 January 2021, the CMA commenced an investigation under section 25 of the
Act in relation to Google’s Privacy Sandbox proposals. The CMA subsequently
informed Google that the CMA was concerned that Google’s proposals, if
implemented without regulatory scrutiny and oversight, would be likely to amountto an abuse of a dominant position.
3. To address the CMA’s competition concerns, Alphabet Inc., Google UK Limited and
Google LLC offer Commitments under section 31A of the Act. These Commitments
provide for scrutiny and oversight by the CMA over implementation of, andannouncements relating to, Google’s Privacy Sandbox proposals.
4. Consistent with sections 31A and 31B of the Act, and subject to section 31B(4) of
the Act, the Commitments are offered on the basis that if the CMA accepts theCommitments in accordance with section 31A(2) of the Act, it will not continue theinvestigation, make a decision within the meaning of section 31(2) of the Act, or
give a direction under section 35 of the Act.
5. The offering of Commitments by Google does not constitute an admission ofwrongdoing and nothing in these Commitments may be construed as implying that
Google agrees with any concerns identified by the CMA in its investigation,
including in a Commitments Decision. Google has not been the subject of any
infringement decision or statement of objections in respect of the investigation.
B. Definitions
6. For the purposes of these Commitments, the following definitions apply:“Act” means the Competition Act 1998;

1

In January 2020, Google declared its goal of making the web more private and secure for users, while also
supporting publishers. See Building a more private web, 22 August 2019, and Building a more private web: A
path towards making third party cookies obsolete, 14 January 2020. To date neither the CMA nor the ICO
have concluded on the privacy impacts of the Privacy Sandbox proposals.

4 February 2022
“Ads Systems” means the computer systems that constitute Google’s various
products and services used for Targeting or Measurement of digital advertising on
the web;“Alternative Technologies” means the technologies designed, developed andimplemented by Google as alternatives to Third-Party Cookies in Chrome andChromium listed at Annex 1, and any successor technologies having the same
objective;“Applicable Data Protection Legislation” means all applicable data protection
and privacy legislation in force in the UK, including the Data Protection Act 2018,
the UK General Data Protection Regulation (and regulations made thereunder) and
the Privacy and Electronic Communications (EC Directive) Regulations 2003;“Campaign Manager 360” means Google’s web-based ad management system
for advertisers marketed under that name at the Effective Date, and any successor
product;“Chrome” means the Chrome web browser as built on Chromium and Blink;“CMA” means the Competition and Markets Authority;“Commitments” means the commitments given by Google pursuant to section
31A of the Act;
“Commitments Decision” means a formal decision by the CMA under section 31Aof the Act to accept Commitments, such that section 31B of the Act applies;“Compliance Statement” means the quarterly statement provided by Google
confirming its compliance with the Commitments;“Display & Video 360” means Google’s demand side platform for advertisers
marketed under that name at the Effective Date, and any successor product;“Effective Date” means the date on which the CMA notifies Google of aCommitments Decision;“Gnatcatcher” means the Chrome proposal aimed against covert tracking thatboth supports the Willful IP Blindness functionality, by which websites may attest
that their servers will use IP addresses only for defined critical purposes and notfor covert tracking, and, for websites that do not participate in Willful IP Blindness,enables the forwarding of HTTP requests through an IP privatising server, and any
successor technology having the same objective;2

4 February 2022
“Google” means Alphabet Inc., Google UK Limited (company number 03977902)
and Google LLC and any other member of their corporate Group;“Google Ad Manager” means Google’s ad management platform for publishers
marketed under that name at the Effective Date, and any successor product;“Google First-Party Personal Data” means Personal Data from (a) Google’suser-facing services; and (b) Google’s services available on the Android operating
system as deployed in smartphones, connected televisions or other smart devices;“Group” includes those companies with which any of Alphabet Inc., Google UK
Limited or Google LLC has the links described in section 129(2)(b) of the EnterpriseAct 2002 and thus constitute a “group of interconnected bodies corporate”, within
the meaning of the Enterprise Act 2002;“ICO” means the Information Commissioner’s Office;“Monitoring Statement” means the quarterly statement prepared by Google (or, if
appointed, by the Monitoring Trustee) validating the internal measures that Google
operates to remain compliant with the Commitments;“Monitoring Trustee” means a person appointed in accordance with paragraph32(b) below;“Non-Google Technologies” means technologies (including, but not limited to,individual user-level identifiers) designed, developed and implemented by parties
other than Google as alternatives to Third-Party Cookies, to enable users to be
tracked for the Targeting or Measurement of advertising on the web;
“Personal Data” means personal data as defined in the Applicable Data Protection
Legislation;“Privacy Budget” means the Chrome proposal aimed against covert tracking thatenables the information disclosed about a user or device by fingerprinting surfaces
to be limited by reference to a specified budget, and any successor technology
having the same objective;“Privacy Sandbox” means Google’s proposals relating to the Removal of
Third-Party Cookies, the design, development and implementation of theAlternative Technologies, and the changes to Chrome listed at Annex 1, including
Gnatcatcher and the Privacy Budget;“Purpose of the Commitments” has the meaning given in paragraph 7 below;

34 February 2022
“Quantitative Testing” means testing which would provide quantifiable metrics incomparison to the situation existing before implementation of the Privacy Sandbox
proposal concerned that are materially informative for the application of theDevelopment and Implementation Criteria;“Removal of Third-Party Cookies” and “Removal” refer to Chrome ending
support for Third-Party Cookies or clearing Third-Party Cookies more frequently
than every 90 days, whichever is first;“Search Ads 360” means Google’s search management platform for advertisers
marketed under that name at the Effective Date, and any successor product;“Targeting or Measurement” means the targeting or measurement of digitaladvertising, including but not limited to frequency capping, reporting andattribution;“Third-Party Cookies” means cookies which are created by a website other than
the website that the user is visiting;“W3C” means the World Wide Web Consortium;“Working Day” means any day other than a Saturday, Sunday or any other day thatis a public holiday in England.
C. Purpose of the Commitments
7. The “Purpose of the Commitments” is to address the competition concerns
identified by the CMA during its investigation, namely that, without sufficientregulatory scrutiny and oversight, the Privacy Sandbox proposals could:
a. distort competition in the market for the supply of ad inventory and in
the market for the supply of ad tech services, by restricting thefunctionality associated with user tracking for third parties while
retaining this functionality for Google;
b. distort competition by the self-preferencing of Google’s own advertisingproducts and services and owned and operated ad inventory; andc. allow Google to deny Chrome web users substantial choice in terms ofwhether and how their Personal Data is used for the purpose of
Targeting or Measurement and delivering advertising to them.
8. Google will design, implement and evaluate the Privacy Sandbox proposals bytaking into account the following factors (the “Development and Implementation
Criteria”), which will inform the answer to the question of whether or not the44 February 2022
Purpose of the Commitments has been achieved. The Development and
Implementation Criteria are:a. impact on privacy outcomes and compliance with data protection
principles as set out in the Applicable Data Protection Legislation;b. impact on competition in digital advertising and in particular the risk of
distortion to competition between Google and other market
participants;
c. impact on publishers (including in particular the ability of publishers togenerate revenue from advertising inventory) and advertisers (including
in particular the ability of advertisers to obtain cost-effective
advertising);
d. impact on user experience, including the relevance of advertising,transparency over how Personal Data is used for advertising purposes,
and user control; ande. technical feasibility, complexity and cost involved in Google designing,developing and implementing the Privacy Sandbox.
9. These Commitments are organised as follows:a. Section D provides for transparency and consultation with third parties;
b. Section E provides for involvement of the CMA in the Privacy Sandbox
proposals;c. Section F provides for a standstill before the Removal of Third-Party
Cookies;d. Section G provides for Google’s use of data;e. Section H provides for non-discrimination; andf.

Sections I to M provide for reporting and compliance; duration; variationor substitution; effect of invalidity; and governing law and jurisdiction.

D. Transparency and consultation with third parties
10. Having agreed the wording with the CMA, by the day the Commitments Decision is
published, Google will make a public statement in a blog post, a dedicatedmicrosite or equally prominently (to which a link may be added in the CMA’s
webpages) specifying:5

4 February 2022
a. that Google’s stated objectives in developing the Privacy Sandbox
proposals are to make the web more private and secure for users, while:i.

supporting the ability of publishers to generate revenue fromadvertising inventory and the ability of advertisers to securevalue for money from advertising spend;ii.

supporting a good user experience in relation to browsing the
web and digital advertising;iii.

providing users with substantial transparency and control overtheir data as they browse the web; andiv.

not distorting competition between Google’s own advertisingproducts and services and those of other market participants;b. the Development and Implementation Criteria;c. that Google will design, develop and implement the Privacy Sandbox inline with the Development and Implementation Criteria; andd. that Google will involve the CMA on an ongoing basis in relation to thedesign, development and implementation of the Privacy Sandbox (andrelated announcements) and Google will also regularly consult withpublishers, advertisers and ad tech providers pursuant to paragraphs 11,
12 and 17(c)(v) below.
11. Google will publicly disclose the timing of the key Privacy Sandbox proposals as set
out in Annex 1. Google will also publicly update the information provided for in
Annex 1 as timings change or become more certain. Such disclosures may be madein particular within the blink-dev discussion group, within the W3C, within any
other fora and/or in a blog post, a dedicated microsite or equally prominently. Suchdisclosures will aim to enable publishers, advertisers and ad tech providers to
influence the Privacy Sandbox and to adjust their business models, including by
providing sufficient advance notice of the proposals and publishing key
information. Google will use its best endeavours to ensure that blog posts andPrivacy Sandbox microsite updates relating to origin trials for, the timing of, and any
key changes to, the Privacy Sandbox proposals as set out in Annex 1 will contain an
express reference to these Commitments and a brief explanation of theinvolvement of, and regulatory oversight provided by, the CMA in consultation with
the ICO. Google will provide a single webpage from which all such disclosures canbe accessed.

6

4 February 2022
12. Google will publish on a dedicated microsite a process for stakeholder
engagement in relation to the details of the design, development andimplementation of the Privacy Sandbox proposals and report on that process
publicly, as well as to the CMA through the quarterly reports described inparagraph 32(a) below. As part of that process, Google will take into consideration
reasonable views and suggestions expressed to it by publishers, advertisers and ad
tech providers, including (but not limited to) those expressed in the W3C or any
other fora, in relation to the Privacy Sandbox proposals, including testing, in order
to better apply the Development and Implementation Criteria in the design,development and implementation of the Privacy Sandbox proposals.
13. Google will, at the CMA’s request, seek to facilitate the involvement of the CMA in
discussions on the Privacy Sandbox in the W3C or any other fora. In relation to its
ongoing participation in the W3C, Google intends for the Privacy Sandbox
proposals to proceed, when appropriate, to the relevant Community, Business andWorking Groups in accordance with W3C processes.
14. Google will instruct its staff and agents not to make claims to other market playersthat contradict these Commitments. Google will provide training to its relevant
staff and agents to ensure that they are aware of the requirements of theseCommitments.
E. Involvement of the CMA in the Privacy Sandbox proposals
15. Google will engage with the CMA in an open, constructive and continuous dialogue
in relation to the development and implementation of the Privacy Sandbox
proposals, with a view to achieving the Purpose of the Commitments, taking into
account the Development and Implementation Criteria.
16. Updates to the timeline at Annex 1 will be provided to the CMA in accordance withparagraph 32(a) below. This is to assist the CMA in planning its own involvement in
the process.
17. Google and the CMA will organise their dialogue by mutual agreement. Suchdialogue will in particular involve:a. Efforts to identify and resolve concerns quickly.
i.

Google will proactively inform the CMA of changes to the Privacy
Sandbox that are material to ensuring that the Purpose of theCommitments is achieved.

ii.

Google will work with the CMA without delay to seek to resolve
concerns raised and address comments made by the CMA with a7

4 February 2022
view to achieving the Purpose of the Commitments. Google will
inform the CMA of how it has responded to those comments.
iii.

In the event that Google and the CMA cannot reach mutual
agreement or resolve concerns within 20 Working Days of a
notification in writing by the CMA, unless extended by mutual
consent, the CMA may take action pursuant and subject to theprovisions of section 31B(4) of the Act.

b. Status meetings. Google and the CMA will schedule regular meetings at
least once a month until the Removal of Third-Party Cookies and atregular intervals thereafter to discuss progress on the Privacy Sandbox
proposals.
c. Testing. During the period from acceptance of these Commitments until
the Removal of Third-Party Cookies, Google will seek to agree with the
CMA parameters and other aspects2 which are material for the design ofany significant tests for evaluating the effectiveness of the Alternative
Technologies, and of other Privacy Sandbox proposals at Annex 1 thatare amenable to Quantitative Testing, according to the Development and
Implementation Criteria. Such testing will be carried out on the following
basis:

2i.

Google will test the effectiveness of individual Alternative
Technologies and of other Privacy Sandbox proposals at Annex 1that are amenable to Quantitative Testing, and will also, before
triggering the standstill period as set out in paragraph 19 below,
test their effectiveness in combination to fully assess the impactof the Removal of Third-Party Cookies.

ii.

Google will involve the CMA in the design of such tests of
Alternative Technologies and of other Privacy Sandbox proposals
at Annex 1 that are amenable to Quantitative Testing, and will
share with the CMA the results of such tests and, to the extent
necessary for the CMA to understand and evaluate the results,
explanations of the data used and underlying analyses as well as,
on request and where practicable, relevant analyses retained in
Google's systems for the purpose of the experiment results.
Google will work with the CMA to enable the CMA to understandand have confidence in the results. Google will take into accountreasonable views and suggestions expressed by stakeholders in

Other aspects means data and benchmarks which are material for the design of any significant tests.

8

4 February 2022
relation to the testing of the Privacy Sandbox proposals, inaccordance with paragraph 12.
iii.

If Google and the CMA cannot reach an agreement regarding
appropriate testing parameters the CMA may notify Google of its
preferred parameters.

iv.

If Google does not within 20 Working Days, unless extended bymutual consent, agree to carry out a test according to the CMA’s
parameters, the CMA may take action pursuant and subject tothe provisions of section 31B(4) of the Act.

v.

In consultation with the CMA, Google will publish the results oftests that are material to evaluating the effectiveness of theAlternative Technologies and of other Privacy Sandbox proposals
at Annex 1 that are amenable to Quantitative Testing byreference to the Development and Implementation Criteria. The
publication will be made in a blog post, a dedicated microsite orequally prominently. When Google publishes the results of thesetests, it will also publish a description of the underlying data andmethodology used that is sufficiently granular to enablepublishers, advertisers and ad tech providers to understand theresults and obtain an informed view of the relevance of the test
and its outcome for their own businesses. For the avoidance of
doubt, Google will not publicly disclose personal data, Google
proprietary software code or algorithms or other businesssecrets. However, Google may need to disclose such data to the
CMA if such data is necessary for the CMA to assess theeffectiveness of the Alternative Technologies and of other
Privacy Sandbox proposals at Annex 1 that are amenable to
Quantitative Testing.

vi.

This provision shall not prevent Google from carrying out
alternative tests on the basis of its own parameters and design.
However, Google will provide the CMA with sufficient advancenotice of any intention to carry out any such alternative tests,
explain the nature of any such tests and discuss with the CMA
whether (and if so how) Google should publish the results of any
such tests.

d. User controls. At least once a quarter, Google will update the CMA on
its plans for user controls in relation to the Privacy Sandbox proposals,

9

4 February 2022
including default options and choice architectures, and it will share with
the CMA the user research and testing which underpins its decisions onuser controls. Google will take into account any observations the CMA
may make with a view to ensuring that the Purpose of the Commitments
is achieved.
18. The ICO. Google acknowledges that the CMA will involve the ICO to achieve the
Purpose of the Commitments as agreed between the CMA and the ICO andsubject to applicable legislation. The CMA will consult the ICO before issuing any
notification under paragraph 21 below.
F. Standstill before the Removal of Third-Party Cookies
19. Google will not implement the Removal of Third-Party Cookies before the expiry ofa standstill period of no less than 60 days after Google notifies the CMA of its
intention to implement their Removal. Google may increase the length of such astandstill period at any time between giving such notice and the period’s expiry. At
the CMA’s request, Google will increase the length of this standstill period by afurther 60 days to a total of 120 days.
20. Before the Removal of Third-Party Cookies, Google will not implement Gnatcatcher
without making reasonable efforts to support websites’ ability to conductanti-spam and anti-fraud efforts and to tailor their websites based on users’ coarse
geographic location (i.e., country or region), or enforce the Privacy Budget.3
21. During the standstill period, the CMA may notify Google that competition law
concerns remain such that the Purpose of the Commitments will not be achieved.
Google will work with the CMA without delay to seek to resolve concerns raised
and address comments made by the CMA with a view to achieving the Purpose of
the Commitments. Google will inform the CMA of how it has responded to thosecomments.
22. If Google and the CMA do not resolve those competition law concerns during thestandstill period referred to in paragraph 19 above, the CMA may take action
pursuant and subject to section 31B(4)(a) of the Act. In such circumstances the
CMA will have reasonable grounds for believing that there has been a materialchange of circumstances since the Commitments were accepted.
23. Nothing in these Commitments prevents the application of any part of section
31B(4) or other provisions of the Act.
3

As part of this, before the Removal of Third-Party Cookies Google will allow publishers, advertisers andad tech providers to make unlimited requests (and receive responses) for User-Agent Client Hints, so that
all of the information available in the user-agent string as of the Effective Date would remain accessible
during the period prior to the Removal of Third-Party Cookies.

10

4 February 2022
24. Where section 31B(4) applies, the CMA may continue the investigation, make adecision within the meaning of section 31(2) of the Act, or give directions under
section 35 (interim measures) of the Act.
G. Google’s use of data
25. Chrome browsing history commitment. After Chrome ends support for
Third-Party Cookies, Google commits not to use Personal Data from a user’s
Chrome browsing history, including synced Chrome history, in its Ads Systems to
track that user for the Targeting or Measurement of digital advertising on either
Google owned and operated ad inventory or ad inventory on websites not owned
and operated by Google.
26. Google Analytics data commitment. After Chrome ends support for Third-Party
Cookies, Google commits not to use a user’s Personal Data from a customer’s
Google Analytics account in its Ads Systems to track that user for the Targeting or
Measurement of digital advertising on either Google owned and operated ad
inventory or ad inventory on websites not owned and operated by Google.4
27. Additional commitments regarding ad inventory on websites not owned andoperated by Google. After Chrome ends support for Third-Party Cookies, Google
commits not to track users to Target or Measure digital advertising on ad inventory
on websites not owned and operated by Google using either (i) Google First-Party
Personal Data or (ii) Personal Data regarding users’ activities on websites other thanthose of the relevant advertiser and publisher.5
28. After Chrome ends support for Third-Party Cookies, Google intends to use theAlternative Technologies for the Targeting or Measurement of digital advertising on
ad inventory on websites not owned and operated by Google.
29. For the avoidance of doubt:a.

nothing in paragraphs 25-27 above prevents Google from using the datatypes listed to prevent spam and fraud; andb.

Section G of these Commitments is without prejudice to the operation of
any other part of the Commitments, including Section H, or to the4

Google Analytics plans to continue to allow Analytics customers to use their respective first-party data
to support publisher monetization within their own respective websites. Google Analytics does not use
Personal Data across unaffiliated publishers for publisher monetization and, in accordance withparagraph 26, commits not to do so in the future. This does not preclude the possibility that a customer
may choose to share or export their own Analytics data, including through a linked Google Ads account,
for ads Targeting and/or Measurement.
5This includes data uploaded by an advertiser to Customer Match in accordance with Google’s Customer
Match policy.

11

4 February 2022
application of the Applicable Data Protection Legislation. Section G does
not prevent Google from using the Alternative Technologies in the same
way as other market participants are able to do.
H. Non-discrimination
30. Recognising that in accordance with paragraph 8 above Google will design,develop and implement the Privacy Sandbox proposals in a manner that is
consistent with the Purpose of the Commitments and takes account of theDevelopment and Implementation Criteria, Google will ensure that it does not
distort competition by discriminating against rivals in favour of Google’s
advertising products and services. In particular, Google will not:a. design and develop the Privacy Sandbox proposals in ways that will distortcompetition by self-preferencing Google’s advertising products andservices;b. implement the Privacy Sandbox in ways that will distort competition by
self-preferencing Google’s advertising products and services; orc. use competitively sensitive information provided by an ad tech provider or
publisher to Chrome for a purpose other than that for which it wasprovided.
For the avoidance of doubt, Privacy Sandbox proposals that deprecate Chrome
functionality will remove such functionality for Google’s own advertising products
and services as well as for those of other market participants.
31. Google will not change its policies for customers of Google Ad Manager, Campaign
Manager 360, Display & Video 360 or Search Ads 360 to introduce new provisions
restricting a customer’s use of Non-Google Technologies before the Removal of
Third-Party Cookies, unless in exceptional circumstances (such circumstances tobe discussed with the CMA) or as required by law. For the duration of theCommitments, Google will inform the CMA ahead of any such change to thesepolicies.
I.

Reporting and compliance

32. Google will:a. provide the CMA with quarterly reports within three Working Days of theend of each three-calendar-month period following the Effective Date
about: progress on the Privacy Sandbox proposals; updated timing
expectations; substantive explanations of how Google has taken into

12

4 February 2022
account observations made by the CMA and by third parties pursuant toparagraphs 12 and 17(c)(ii) of these Commitments; and a summary of theinteractions between the CMA and Google pursuant to paragraphs 17
and 21 of these Commitments, including in particular a record of any
concerns raised or comments made by the CMA and the approachretained for addressing such concerns or comments pursuant toparagraphs 17(a)(ii) and 21. The quarterly reports will include a signed
Compliance Statement in respect of paragraphs 25-27, 30-31 and, withrespect to those provisions, paragraph 33 of these Commitments. The
Compliance Statement will be signed by the CEO (or an individual withdelegated authority) on behalf of each company giving theCommitments and will be in the form included in Annex 2 to theseCommitments;
b. appoint at its own cost in consultation with the CMA (and subject to theongoing approval of the CMA), a monitoring trustee to monitor
compliance with paragraphs 25-27, 30-31 and, with respect to those
provisions, paragraph 33 of these Commitments and instruct this trustee
to provide the CMA with a quarterly Monitoring Statement in the form ofAnnex 3 to these Commitments within three Working Days of the end ofeach three calendar month period following the Effective Date;c. promptly notify the CMA, as soon as practicable (and, at the latest within
five Working Days) by email at RemediesMonitoringTeam@cma.gov.uk, if
it becomes aware of any breach of the Commitments, and commits toproviding full information concerning the nature and duration of suchbreach. Google will not be taken to be aware of a breach for areasonable period during which it is considering whether conduct is or is
not in compliance;6d. promptly take all actions reasonably required, in consultation with the
CMA, to remedy a breach; ande. provide to the CMA any information and documents which the CMA
requests for the purposes of enabling the CMA to monitor and review
the operation of the Commitments or any provisions of theCommitments or for the purposes of their enforcement.
33. Alphabet Inc., Google UK Limited and Google LLC will not in any way, whether byactions or omissions, directly or indirectly, circumvent any of the Commitments.
6

Such reasonable period to not exceed, absent exceptional circumstances, 10 Working Days from the dateon which Google becomes aware of the conduct in question.

13

4 February 2022
J. Duration
34. The Commitments will terminate six years from the date they are accepted by the
CMA, unless released at an earlier date in accordance with section 31A(4) of theAct.
K. Variation or substitution
35. Google may offer a variation or substitution of the Commitments as envisaged bysection 31A(3) of the Act.
L. Effect of invalidity
36. Should any provision of these Commitments be contrary to law or invalid or
unenforceable for any reason, Google will continue to observe the remaining
provisions, which shall remain valid and enforceable.
M. Governing law and jurisdiction
37. The Commitments will be governed by and construed in all respects in accordancewith English law.
38. Disputes arising concerning the Commitments will be subject to the exclusive
jurisdiction of the courts of England and Wales.
39. Each of Alphabet Inc. and Google LLC irrevocably appoints Sisec Limited, 21
Holborn Viaduct, London EC1A 2DY as its agent to receive on its behalf in Englandor Wales service by the CMA of all documents, orders, requests, notifications,proceedings or other communications connected with these Commitments. Suchservice shall be deemed completed on delivery to such agent and shall be valid
until such time as the CMA has received prior written notice that such agent hasceased to act as agent. If for any reason such agent ceases to be able to act asagent or no longer has an address in England or Wales, each of Alphabet Inc. andGoogle LLC shall forthwith appoint a substitute acceptable to the CMA and deliverto the CMA the new agent's name and address within England and Wales.
**

144 February 2022
Annex 1
Google will provide the following information in relation to the use cases set out below,
by reference to each quarter (e.g., Q1 2022, Q2 2022…):
Currently anticipated opening of application programming interface (API) origin
trial
2. Currently anticipated start of notice period prior to Removal of Third-Party
Cookies
3. Currently anticipated Use Case general availability
4. Currently anticipated Transition Period for Removal of Third-Party Cookies
1.

The use cases for which such information will be provided, and distinct APIs for which
information will be shown, are as follows (if the development of an API is discontinued,
and/or an alternative API developed, such changes will be reflected):
1.

Use Case: Fight spam and fraud on the web● Trust Tokens API

2. Use Case: Show relevant content and ads● Topics API● FLEDGE API
3. Use Case: Measure digital ads● Core Attribution API● Aggregate Reporting API with aggregate reports● Cross-Environment Attribution API● Aggregation Service Reference
4. Use Case: Improve the web platform infrastructure● First-Party Sets API● Shared Storage API● CHIPS API● Storage Partitioning● Fenced Frames API● Network State Partitioning
Information on the earliest anticipated date for availability will be provided for thefollowing measures to promote a more private web (if the development of a measure is
discontinued, and/or an alternative measure developed, such changes will be reflected):15

4 February 2022
●
●
●
●
●
●

DNS-over-HTTPS
Federated Credential Management (FedCM)
User-Agent Reduction
Gnatcatcher
Origin-Bound Cookies
Privacy Budget

16

4 February 2022
Annex 2
Template Compliance Statement[Note: Quarterly Compliance Statements will be provided to the CMA within three
Working Days of the end of each three-calendar-month period following the Effective
Date for the duration of the Commitments]
I, [insert full name], [Chief Executive Officer/title of authorised delegate] of Google LLC
confirm that for the three months to [amend date as appropriate], [Google] hascomplied in the preceding three-calendar-month period with the obligations relating
to:-Google’s use of data set out in paragraphs 25, 26, and 27 of the Commitments;
Google’s non-discrimination commitments set out in paragraphs 30 and 31 of
the Commitments; andGoogle’s commitment in relation to anti-circumvention in this respect set out inparagraph 33 of the Commitments.

Any failures to meet the Commitments during this three-calendar-month period were
notified to the CMA within five Working Days of Google becoming aware of them andare also listed below for completeness.
Signed………………………………………………………………………..
Full name……………………………………………………………………
Date……………………………………………………………………………
[Breaches (if any) listed on following page for completeness]

17

4 February 2022
Annex 3Outline of Monitoring Statement

A

Commitments in paragraphs 25-27

A1

A description of the technical data separation mechanisms for compliance with therequirements of these paragraphs, updated as appropriate in each successive report,
including how Google ensures that any access by Ads Systems or related individuals
for the purposes of preventing spam and fraud is limited to this use case.

A2

A summary of the Monitoring Trustee’s review of the relevant logs detailing the accesshistory of any datasets within Google that contain data relevant to these paragraphs.
This summary shall list out exhaustively any access by Ads Systems or related
individuals and provide the justification for such access. 7

A3

A description of training on permissible data access Google has carried out and theattendees of such training.

B

Commitments in paragraphs 30-31

B1

A description of the process through which Google records how the Development
and Implementation Criteria were assessed in key design decisions for relevant
products, updated as appropriate in each successive report.

B2

A summary of the Monitoring Trustee’s review of the records described in B1.

B3

A description of Google’s guidelines detailing what contacts between Chrome andAds are permissible, updated as appropriate in each successive report.

B4

A summary of the Monitoring Trustee’s review of the implementation of B3.

B5

A description of (i) the secure depository for documents partners label as containing
confidential information that will not be accessible to members of the Google Ads
organization, updated as appropriate in each successive report; and (ii) the steps
Google has taken to inform third-parties of the steps they can take to label
information as confidential.

B6

A description of any processes in addition to those in B5 that Google has carried out
to ensure that Google uses any competitively sensitive information provided by an adtech provider or publisher to Chrome only for the purpose(s) for which it wasprovided.

B7

A summary of the Monitoring Trustee’s review of the implementation of B5 and B6.

7

To the extent that, for the purposes of any Monitoring Statement, Google provides information to the Monitoring
Trustee that information will also be provided to the CMA.

18

4 February 2022

B8

A description of training Google has carried out to ensure that all relevant Chrome
staff and agents are aware of the requirements of paragraphs 25-27 and 30-31 ofthese Commitments and the attendees of such training.

B9

A description of training material Google makes available to all relevant publisher- andadvertiser-facing staff and agents to make them aware about how to communicate
around the Removal of Third-Party Cookies and the Privacy Sandbox (at least withrespect to paragraphs 25-27 and 30-31 of the Commitments).

B10

A description of the internal process that will enable relevant Google staff and agentsat least to report behaviour that is not in line with paragraphs 25-27 and 30-31 of theseCommitments.

B11

A summary of the Monitoring Trustee’s review of any reports pursuant to B8, B9 andB10 (including on any training under the requirements of paragraph 14 in relation toparagraphs 25-27 and 30-31 of these Commitments).

C

Commitment at paragraph 33

C1

A summary of the Monitoring Trustee’s review of putative circumvention ofparagraphs 25-27 and 30-31 of the Commitments.

19