Google is expanding its Privacy Sandbox to Android devices and the UK’s antitrust watchdog is set to play a crucial role in ensuring that the tech giant does not abuse its market dominance in the process.
On Wednesday (16 February), Google presented a multi-year initiative to introduce to Android its Privacy Sandbox, an initiative aimed at “building a more private, open web.”
Until now, the Privacy Sandbox initiative was limited to the web, with a view to restricting cross-site tracking performed by third party cookies via Google’s web browser Chrome. The move to Android is explicitly building on this experience.
“Google appears to follow a similar philosophy for the app ecosystem: replacing existing identifiers that power digital advertising (the Android Advertising ID) with alternative solutions that are said to improve privacy,” said Damien Geradin, founding partner at Geradin Partners.
The blog post announcing the change noted that more than 90% of the apps available on the Google Play app store are free, also thanks to digital advertising. However, the announcement added that the app ecosystem remains healthy, “the industry must continue to evolve how digital advertising works to improve user privacy.”
The new setting will limit the sharing of personal data with third parties and work without cross-party identifiers, including Google’s advertising ID.
“It is not clear what Google had in mind,” said Johnny Ryan, a senior fellow at the Irish Council for Civil Liberties. “Google has a habit of presenting momentous changes to the market in vague terms.”
The blog post criticized Apple’s App Tracking Transparency system, a feature introduced last year demanding user consent for apps to track them when not in use. The iPhone-maker’s policy is labelled as ‘blunt’ and ‘ineffective’, leading to “worse outcomes for user privacy and developer businesses”.
By contrast, Google’s declared intent is to develop advertising solutions compatible with privacy, inform the user and give developers and businesses a chance to succeed in the app ecosystem.
“These solutions are of course not there yet – and Google will have to show that they are effective replacements for existing features,” Geradin added.
With its attempt to change the web tracking systems based on cookies, competitors feared that Google might leverage its dominant position in the web browser market to expand its advertising revenues.
Last year, the UK’s Competition and Markets Authority (CMA) opened an investigation to assess the potential impact of Chrome’s new privacy settings on the advertising market.
In response, Google offered a series of public commitments, including avoiding self-preferencing and offering regulatory oversight to the UK’s antitrust and data protection authorities. The CMA will also need to greenlight the final arrangement.
Last week, the CMA accepted these commitments and stated it would closely monitor their application.
For ICCL’s Ryan, the intervention of competition authorities is the result of a failure by data protection authorities, particularly the Irish one, to properly supervise Google’s compliance with the EU’s privacy rules set in the GDPR.
“Had data protection authorities upheld their responsibilities, both Google and its competitors would have been prevented from using the data unlawfully, and Google would not be able to rely on its internal data free-for-all to advantage its business,” Ryan said.
With an estimated market share of two-thirds of global internet traffic, Chrome is the most used web browser. The expansion to Android is bound to raise similar questions, as the operating system market has an even stronger position with an estimated 70% of all mobile users.
In what seems an attempt to anticipate these concerns, Google stated that it would apply the same principles of its commitments before the UK CMA to the Privacy Sandbox on Android.
“This means the CMA will likely play a key role in ensuring that the Privacy Sandbox on Android does not end up favouring Google’s advertising business at the expense of rivals,” Geradin said.
App developers are now invited to provide their feedback, which will be collected and integrated into a beta version of the new system, to be released before the end of 2022.
“We appreciate the deliberative process Android is taking to publish new proposals and solicit feedback from the ecosystem,” Bob Meese, the chief business officer at language-learning app Duolingo, said in a statement.
Google anticipated that the phase-out from the current system would last at least two years and that future changes would be announced with “substantial notice”.
However, the new privacy policies on both Android and Chrome will need to take into account the EU’s Digital Markets and Digital Services Acts, which, among other things, might include provisions on targeted advertising and data access.
[Edited by Zoran Radosavljevic]