Fighting over cookies in the Sandbox: will competition or privacy prevail?

Last Monday, it was announced that a coalition of technology and publishing companies has made a formal complaint to the UK Competition and Markets Authority (CMA) about Google’s “Privacy Sandbox”, asking the CMA to open an antitrust investigation and immediately impose interim measures forcing Google to pause the rollout, currently planned for early 2021. The complaint strikes at the very heart of the as yet unresolved conflict between privacy and competition concerns. There is legal pressure on both sides of the debate: while the complaint asks the CMA to preserve the ability for third-party tracking of individuals' online activity, the UK Information Commissioner's Office (ICO) is facing legal action from the Open Rights Group, who allege the ICO should be doing more to stop it.

This latest complaint will force the CMA to grapple with difficult questions it may have hoped to delay having to answer until after proposed legislative reforms. For observers, it will be a fascinating case to watch.

Google’s Privacy Sandbox: he said, she said

Google describes its Privacy Sandbox as having the mission to “create a thriving web ecosystem that is respectful of users and private by default”. It comes in the context of an increased focus on cookies from privacy regulators in the EU, and Google says it wants to overcome “the pervasive cross-site tracking that has become the norm on the web” through introducing “new functionality to serve the use cases that are part of a healthy web”. This will involve placing “more and more restrictions on the use of third-party cookies… and eventually deprecat[ing] them entirely”.

Google’s promise is that the Privacy Sandbox will give more privacy to individuals, while preserving the ability for digital advertising to target web users. However, third-party cookies are the lifeblood of the current online targeting ecosystem, so this could have significant ramifications for the various players in the AdTech industry.

The complaint alleges that the Privacy Sandbox has “nothing to do with privacy and everything to do with moving the whole digital advertising industry off the open web”. It states that the proposed changes would “deny news publishers access to the cookies they use to sell advertising, thereby cutting their revenues by an estimated two-thirds”, with regional titles hardest hit and implications for journalism too.

Privacy or competition: like picking a favourite child?

The conflict between competition and privacy regulation has its roots in the fact that they have fundamentally different drivers. Privacy regulation seeks to protect individuals directly: it begins from the premise that privacy is a fundamental human right which should not be unduly infringed. Privacy regulation is not satisfied by the explanation that individuals might make rational decisions to "trade" their privacy for access to a (generally free) service; these individual decisions are considered to result in both individual and collective harm. Competition law on the other hand seeks to protect consumers indirectly: it begins from the premise that competition is the best way to achieve good outcomes for consumers, and therefore its aim is to protect consumers through protecting competition itself. Historically, these two branches of regulation operated in their own silos, but as access to personal data becomes ever more important to businesses, the two are increasingly coming into conflict.

While both privacy and competition regulators have raised vocal concerns about the concentration of personal data in the hands of a few platforms, their solutions to the problem are different. For example, the textbook competition “solution” of opening up access to essential facilities or inputs is in direct conflict with the privacy “solution” of data minimisation. From a privacy perspective, it would be preferable for any tracking information to be shared with the smallest number of people possible, while the broad sharing of the information is likely to be necessary to create a competitive AdTech market given the complex and multi-layered nature of that ecosystem. Within the current framework, these issues appear to be largely irreconcilable.

Over to you, CMA…

The CMA is no stranger to the issues raised in the complaint. Its Final Report in its Digital Advertising Market Study was released in July this year, and in it the CMA says that it is working with the ICO on competition neutrality in the design and application of data protection regulation, and specifically calls out Google’s Privacy Sandbox. But at that time, the CMA chose to pursue reform rather enforcement. 

The CMA is currently working further on reform recommendations, alongside the ICO, in its Digital Taskforce, which is expected to report to the Government at the end of the year. On Friday, it was announced that from April 2021, the CMA will house a new Digital Markets Unit (DMU), specifically tasked with managing a "code of conduct" for platforms with so-called "strategic market status" (including Google), but details of what rules the DMU will administer and how, remain vague. The official line out of the CMA has been that it is waiting for reform before pursuing enforcement action, but that it will take enforcement action if the Government doesn’t bring forward reforms by the end of next year (see our previous post here). The complaint suggests that would be too little, too late.

The CMA has said it is taking the complaint very seriously and considering whether to open a formal antitrust investigation. If it does, the CMA will need to tackle head-on the apparent conflict between privacy and competition concerns, and it's not clear a "remedy" would be available that would satisfy "both camps". 

As to the prospect of swift action through use of interim measures, while greater use of interim measures is certainly on the agenda in the UK (as around the world), we’re yet to see the CMA really flex its muscle. In a recent case in the pharma sector the CMA was able to extract a commitment to pause the planned withdrawal of a drug with the mere threat of interim measures, and quickly negotiated commitments on price and continued supply. But that case was about domestic supply of a single drug: it’s hard to see whether the CMA alone would really wield such power against Google, and whether even formal “interim measures” from the CMA could stop to the planned global rollout of Google’s Privacy Sandbox.