In an earlier post discussing the fate of targeted advertising, I noted that much of the current debate centers around issues of competition and privacy, and the inevitable trade-offs between them. While personalized advertising promises benefits for publishers and advertisers (and in theory users that value relevant ads), it is under increasing pressure from privacy legislation. Yet, as noted in another post, it is not so much privacy legislation per se that carries the greatest weight; rather, it is the policy changes introduced by a handful of tech companies in the name of privacy, namely Google and Apple. The reason is that these companies control the most popular browsers (Chrome, Safari) and smart mobile OSs (Android, Apple) in the world, on which publishers, marketers and ad tech vendors are technologically dependent to perform advertising. The policy changes of Google and Apple have the force of de facto (privacy) regulation for online advertising.
I am very excited to announce a new paper (available on SSRN) co-authored with Damien and Theano on one of the most important policy changes that is set to alter profoundly web advertising in the near future and is motivated by privacy considerations: Chrome’s decision to phase out support for third-party cookies by 2022, accompanied by a set of proposals known as the Privacy Sandbox. To put it in a nutshell, Chrome proposes removing the ability to track users across sites in order to improve user privacy. In order to avoid breaking the ad-funded business model of the web (which relies heavily on the ability to track users across sites), Chrome has put forward a series of API proposals as an alternative (the Privacy Sandbox), which broadly speaking make the browser the central player in the ecosystem. In this paper we provide a thorough technical explanation of the issues at stake. While recognizing the privacy benefits it may bring to users (since cross-site tracking will generally be harder), we think Chrome’s policy change (at least as it stands now) is open to criticism on both privacy and antitrust grounds. First, Chrome’s change will do nothing to limit tracking taking place on popular platforms such as those operated by Google and Facebook, where the surveillance economy has reached its apotheosis. Second, Chrome’s change has the potential to distort competition among publishers (by weakening the ability of publishers to compete against the walled gardens for advertising $) and/or ad tech vendors (by making the browser – in many cases Chrome – a new form of bottleneck; note that the CMA found Google has historically used its publisher ad server to give an advantage to its own ad tech activities).
The issues raised by Chrome’s decision are very interesting and complicated at the same time, since they concern the interplay (I would say: the tension) between competition / efficiency and privacy. The tension (and trade-offs) between the two becomes obvious at the stage of remedies. Even so, we think there are remedies that can promote competition in advertising without sacrificing privacy; at the very least Google could be mandated to refrain from engaging in cross-site tracking in the post-cookie-apocalypse era (an advantage it will keep to itself by virtue of controlling Chrome, as explained in the paper). A more interesting (and delicate) question is whether Google (and potentially other platforms such as Facebook) could be mandated to refrain from combining data across its 53+ user-facing services or refrain from doing so unless it obtains explicit user consent per purpose (this could be alternatively achieved through the route of data protection legislation and the purpose limitation principle). Mandating a form of data separation would be certainly more intrusive and can result in a loss of efficiency; on the other hand, it can bring massive privacy benefits for users and has the potential to unlock competition.
One way or another, regulators will soon have to decide how to approach issues such as those raised by Chrome’s decision. They will need to take an informed decision. We hope our paper will help contribute to the debate and inform policymakers.
(Image: Thunder experience cloud)
13 thoughts on “New paper on Chrome and the Privacy Sandbox”