Thread · 15 tweets · 8 Jan 2021

The UK’s competition authority, @CMAgovUK, has opened an investigation into Google’s “Privacy Sandbox”. This is a fascinating topic at the intersection of privacy and market power. If they act, it could be either great or terrible for consumers. 🧵 gov.uk/government/new…

What is the “Privacy Sandbox”? It’s the name of a loose bundle of proposals from Google to improve privacy in advertising. Before diving in, a few misconceptions about the PS need to be addressed.

❌ The Privacy Sandbox is a "fait accompli". No, it is being actively discussed and nothing unilateral has yet happened. Chrome has done unilateral in the past, but not this time (at least not yet). The discussions in standards groups are very active, with more to come.

❌ The Privacy Sandbox is entirely Google-driven. The PS is the (slightly weird) name Google gave to its set of proposals, but it is only one set of proposals. The Privacy CG and WebAdv group are looking at a whole range of proposals and more are coming.

❌ The PS is all about removing third-party cookies. No, it’s mostly about alternatives to techniques that rely on 3P cookies (3PC). Removing 3PC is an effort pioneered by Apple, then Mozilla and Microsoft, and now Google, and enjoys very broad support in the Web community.

❌ Removing 3P cookies breaks the Web. False. Web standards have long assumed that 3PC were a problem and that browsers should take steps to control or avoid them. See for instance RFC6265: tools.ietf.org/html/rfc6265#s….

So, what of this @CMAgovUK investigation? Well, third-party cookies are currently used a lot in the ad market. Removing them while Google keeps access to other data gathered from other contexts *could* create competition issues. But keeping them is not the answer.

To begin with, 3P cookies are used for cross-context tracking, which consumers viscerally hate. If people had any real choice, 3PC would be dead & buried. Their continued existence is the sign of a dysfunctional market already, captured by intermediaries.

Then, the quality of service offered by the digital ad market is abysmal. This is a very long topic, but just look at this thread from @Chronotope for a few examples. It’s an opaque and broken system.

One thing that @CMAgovUK could do is to block the removal of 3P cookies and push for a return to the status quo. That would entrench a market that is bad for users, has been destroying news media revenues, and is heavily opaque and fraudulent.

Advertising is an absolutely essential part of the Web. It needs to serve users, publishers, advertisers, and intermediaries — in that order. Under the status quo, that order is reversed. This has not been great.

Alternatively, @CMAgovUK could let Chrome go ahead with pro-consumer changes but require that Google comply with the purpose limitation requirements of the GDPR. @johnnyryan beat me to it:

Broad access to data across contexts helps large players and devalues the offering of smaller ones. Enforcing “Vegas Rules” where what happens in a context stays in that context is what consumers want, and also what makes an audience valuable. Oh, and it's the law.

We are faced with the first chance in a long time that we have to shift the ad market in a direction that is friendly to users and sustainable for publishers. I can only hope that the @CMAgovUK will consider this over entrenched interests.

Addendum: several of you pointed out that I forgot Brave in listing browsers that block 3PC. I meant to and forgot. They've been pushing the envelope on browser privacy for a long time, excellently.