In 2020, Google announced it will discontinue the use of third-party cookies in its Chrome browser. In their place will eventually integrate new browser features, collectively referred to as the "Privacy Sandbox." The purpose of this is to better safeguard the privacy of Internet users. Indeed, the use of third-party cookies leads Internet users to lose control over their personal data, resulting in function creep (1), according to Google. This decision has caused quite a stir, as the current mode of online behavioral advertising - which is almost entirely based on the use of third-party cookies - will have to be changed drastically. This article explains exactly what the Privacy Sandbox entails and how it affects the traditional way of online behavioral advertising.
The online advertising industry has grown into a billion-dollar industry over the past three decades. Consequently, online behavioral adverstising has become indispensable today. By building profiles of Internet users on a large scale, it is possible to show them personalized online advertising messages. This, for example, is in contrast to contextual advertising, where the type of advertising is determined by the content of the website in question.
Online behavioral advertising generally takes place by means of third-party cookies (2). Each third-party cookie contains one or more online identifiers (3) through which a particular Internet user can be distinguished from others. The third-party cookie thereby collects information about the Internet user's surfing behavior, device and location. Combined with the other information that ad tech parties, such as Data Management Platforms (DMPs) (4 ) , have about this Internet user, extremely detailed profiles can be created. As a rule, the more comprehensive the Internet user's profile, the higher a specific advertiser's bid will be to show this person their ad. However, this ecosystem now seems to be disappearing overnight with the introduction of the Privacy Sandbox by Google.
Google plays a significant role in the world of online behavioral advertising. Both on the side of publishers who want to sell ad space (the supply side) and on the side of advertisers who want to show their ads on the publisher's platform (the demand side), it has made deep inroads by offering (mostly) free services in this area.
Google also operates the world's most popular browser (Chrome) and the Android mobile operating system. Google also operates some of the world's most popular online services (Google Search, YouTube, Google Maps). Consequently, the vast majority of players in the online advertising world are dependent on Google and forced to move with the effects of the Privacy Sandbox.
The Privacy Sandbox, as it were, is a project that will test various proposals for cookie-free browser features in Chrome. The idea is that Internet users with a Chrome browser will still see personalized online ads. However, no longer through the use of third-party cookies, but through alternative methods, such as APIs. (5)
Currently, the "Federated Learning Of Cohorts" proposal is being tested on a small scale in the United States. In short, this involves Google creating different "cohorts" into which an Internet user can be placed. This is similar to the use of segments in the current ad tech ecosystem (6). However, in Google's Federated Learning Of Cohorts, this is done without the use of third-party cookies. Google collects information about Internet users and their interests by monitoring browsing behavior through the Chrome browser. Based on this, Google can determine which "cohorts" the particular Internet user belongs in. This is similar to how a DMP works in the traditional system. These 'cohorts' are then shared with players in the online advertising world by means of an API. Thus, these parties only get to see that a particular Internet user falls under a particular cohort. It is impossible for them to verify which Internet user this is: the online identifiers used by them in the context of the third-party cookies are missing in this scenario. Thereby, the role of a DMP - as Google actually assumes this role - seems likely to become redundant.
The Privacy Sandbox is not uncontroversial. Whereas previously the other market players in ad tech were still able - to a certain extent - to set up their ad monetization in their own way, Google seems to be taking over this part of online behavioral advertising (too) completely. All this under the guise of Internet network user privacy. The question that arises is to what extent this new Privacy Sandbox initiative will develop further, specifically as far as Europe is concerned. Both from the perspective of privacy law (7) and competition law. In any case, it is clear that the other players in the online advertising world will have to adjust their ad monetization practices considerably once the Privacy Sandbox initiative becomes a reality.
Whether and when one or more Privacy Sandbox proposals will be finally implemented is unclear at this time.
(1) The phenomenon of using personal data for purposes other than those for which they were originally collected.
(2) These are cookies placed by a party other than the website owner on the peripherals (e.g. computer, phone, tablet) of the Internet user when visiting the relevant website. This includes third-party cookies from parties such as Supply Side Platforms (SSPs), Data Management Platforms (DMPs) and Demand Side Platforms (DSPs) involved in selling ad inventory and responding to bid requests. Only the party that placed the cookie can read the information stored in it.
(3) For example, a cookie ID, IP address, an advertising/mobile ID or a proprietary unique identifier (UID) generated by the "placer" of the cookie. Cookie syncing allows different ad tech players to compare their UIDs to recognize Internet users and make personalized bids.
(4) A DMP is a platform whose purpose is to collect as much personal data of individuals as possible from various online and offline sources with the goal of building the richest possible profiles and segments and selling this information to players in the ad tech ecosystem.
(5) An API (Application Programming Interface) is a software interface that allows two applications to communicate with each other. Through the API, Google can share the cohorts into which a particular Internet user is placed with the other ad tech players.
(6) For example, these could be segments by demographics, location or lifestyle (e.g., "male," "Amsterdam," "luxury cars").
(7) The monitoring of browsing behavior of Google Chrome users in order to classify them into certain cohorts qualifies as processing of personal data to which the General Data Protection Regulation (GDPR) applies. This processing of personal data will most likely only be allowed on the basis of internet users' consent. This consent must have been given specifically, informed, freely and unambiguously (cf. Article 4(11) AVG). The question is to what extent this is possible in practice and (thus) whether consent can be validly obtained by Google.
