Privacy Sandbox

Proposals in the Privacy Sandbox follow the idea of k-anonymity and are based on advertising to groups of people called cohorts instead of tracking individuals. They generally place the web browser in control of the user's privacy, moving some of the data collection and processing that facilitates advertising onto the user's device itself. There are three focuses within the Privacy Sandbox initiative: replacing the functionality of cross-site tracking, removing third-party cookies, and mitigating the risk of device fingerprinting. == History ==

The first announcement of the Privacy Sandbox initiative took place in August 2019. The initiative included a number of proposals, many of which had bird-themed names which were changed once the corresponding feature reached general availability. The initial plan was for Privacy Sandbox to be long-term plan to deploy a set of standards that would help advertisers (like Google) to perform targeted advertising without exposing the user to privacy-invasive technologies like third-party cookies. Over the next two years, Google worked with the World Wide Web Consortium (W3C) to experiment and propose standards for the web. Work on the Privacy Sandbox initiative during these two years included the development of the TURTLEDOVE and the subsequent FLEDGE proposals, both which centered around providing APIs to enable privacy preserving advertising, the tightening of the SameSite cookie policy, the introduction of private state tokens and the development of the Client Hints proposal. In 2021, Google committed to a timeline to implement and deploy the technologies to its Chrome browser by the end of 2022 with an expected third-party cookie deprecation date of 2023. Following the 2021 announcement, Google's Privacy Sandbox proposals came under scrutiny from privacy-advocacy groups like the Electronic Frontier Foundation and competition regulatory bodies like the United Kingdom's Competition and Markets Authority (CMA). In response to the privacy concerns, Google discontinued proposals like Federated Learning of Cohorts (also known as FLoC) and replaced it with the Topics API. The CMA would also stipulate that Google write quarterly reports of its progress on Privacy Sandbox with the CMA acting as an oversight body helping shape the Privacy Sandbox proposals. In November 2022 CMA released a report on Google's quantitative testing of its Privacy Sandbox technologies that called for the advertising industry to adopt a common testing framework so that performance tests could be conducted more widely across multiple testing entities. Google committed to developing such a testing framework in cooperation with the CMA before its technologies became generally available in 2023. On March 31, 2022, Google announced the start of a single origin trial, for the Topic, FLEDGE and Attribution Reporting APIs. This was done to allow sites to run unified experiments across the APIs. In October 2022 RTB House published its findings of actively testing FLEDGE by adding users to interest groups. Google and Criteo, also ran tests. The report highlighted that, while positive, the FLEDGE origin trials were limited in scope. It noted that a number of essential features of FLEDGE, specifically k-anonymity requirements, were not available for testing, and would require adjustments after industry feedback. On September 7, 2023, Google announced general availability of Privacy Sandbox APIs, naming explicitly Topics, Protected Audience, Attribution Reporting, Private Aggregation, Shared Storage and Fenced Frames, meaning these features were enabled for more than half of Google Chrome users. Privacy Sandbox features were also made available on Android around the same time. Following this, in July 2024, Google announced that they would not be completely phasing out third-party cookies but rather allowing the user to opt in to blocking third-party cookies. In April 2025, Google officially discontinued the Privacy Sandbox initiative. The company confirmed it would no longer proceed with plans to remove third-party cookies from Chrome, opting to maintain existing cookie controls without introducing a new standalone consent prompt. In 2025, following Google discontinuing the Privacy Sandbox proposal, CMA decided to release Google from their legally binding commitments related to third-party cookie deprecation. Google's official Privacy Sandbox status page lists several technologies as "scheduled for phase-out". == Proposals ==

In January 2020, Google invited advertising technology companies to join the Improving Web Advertising Business Group (IWABG) of the World Wide Web Consortium (W3C) as a way to participate in the proposal process for the Privacy Sandbox. The IWABG group was chaired by Wendy Seltzer and had 258 participants in the group in August 2020, of which 33 were Google employees. == Criticism ==

Google's proposals during Privacy Sandbox surrounding privacy preserving ads have garnered significant pushback. Concerns have been raised that the proposals are anticompetitive and privacy compromising. Google's initial proposal for privacy preserving ads under the Privacy Sandbox umbrella (codenamed FLoC) received significant opposition from browser vendors. Mozilla, the company that makes Firefox, released a statement committing to not implementing FLoC or other related web advertising proposals. Apple, the makers of Safari took a negative position against the proposal. Concerns were raised that the FLoC's proposal could allow websites to track users in new ways that were previously not possible through third-party cookies, the technology that FLoC was meant to replace. Google's replacement for FLoC, known as the Topics API, faced similar criticism from various groups. Mozilla pointed out flaws in the Topics API's design, highlighting that it could allow large advertising networks to reidentify and track users by aggregating their interests across numerous websites. Apple echoed similar concerns, also noting that the proposal contradicted efforts made by other browsers to partition data on a per-site basis. Furthermore, when the proposal was initially announced, there were uncertainties about how Google or other browser vendors would establish a taxonomy of topics, a critical aspect of the API that was left underspecified. Due to Google's ownership of the browser with the largest market share, concerns have been raised about the anticompetitive nature of its proposals. Consequently, in January 2021, the Competition and Markets Authority (CMA) in the United Kingdom announced plans to investigate the Privacy Sandbox initiative, with a focus on its potential impacts on both publishers and users. CMA subsequently accepted legally binding commitments offered by Google concerning its proposals to remove third party cookies on Chrome and develop the Privacy Sandbox. The formal acceptance of these commitments by the CMA resulted in the closure of the investigation, with no decision on whether the Competition Act 1998 was infringed.{{Cite web|date=January 8, 2021|title=Investigation into Google's 'Privacy Sandbox' browser changes == References ==