It’s been a busy few weeks for those following Google. It all started with the Privacy Sandbox team announcing a pivot away from phased third-party cookie deprecation in Chrome to one driven by user prompts … for settings they already have. 

By now, many hot takes on the Sandbox announcement have already been written. But I do still think there’s one angle that’s gone uncovered. 

Has the commitment to perfection over progress led to the current state of play at the Sandbox? And if so, has the pursuit of perfection caused irreparable harm to the industry’s opportunity to provide better online privacy for consumers?

As a Xoogler, I know Googlers care about privacy. So do large portions of the business itself, to the extent that market realities allow. 

Google’s privacy program, composed of dedicated privacy engineers, product and privacy attorneys and deeply intertwined launch processes, is unrivaled. Every advanced mathematical and coding technique, written and technical policy and otherwise privacy-preserving buzzword and methodology are de rigueur, and ensured active before launch. 

But over time, it seems, the desire for perfect privacy and a relative inflexibility about it became the enemy of progress. Google’s commitment to fostering expertise in mathematical privacy and anonymity has bred admirable idealism and fueled responsible data practices that are achievable at highly regulated, multitrillion-dollar companies. 

I fear, however, that it also bred a belief among Googlers that an ecosystem full of smaller businesses working to fund independent publishers was similarly capable of those same data practices. And that, if those smaller businesses are either incapable of the same technical lift as Google or unwilling to implement it, they simply need to adapt. 

The impact on the industry

Conversations with the Sandbox team suggest such rigid beliefs were a part of most of Google’s design decisions. 

Transparency and Consent Framework strings, essential to ensuring legal data processing and ad serving in Europe, carried too many bits of data to ensure anonymity. Sequential auctions would be prioritized, despite significant latency concerns and Google having spec’d cloud-based trusted execution environments years ago.

As the project dragged on, statements like, “Privacy Sandbox was never intended to be a replacement for cookies” became more common. This was all despite the deprecation of third-party cookies in Chrome under the CMA’s oversight being very much tied to Google’s commitments, including support of independent publishers and the advertising industry.

The promise of the Sandbox was that content publishers would continue to flourish through advertising revenue even while users gained a degree of newfound privacy in the open web. 

However, by pushing deadlines, committing exclusively to a burdensome on-device architecture and failing to engage the supply side earlier, Google didn’t create the conditions necessary to progress to the CMA Commitments-mandated standstill period and, subsequently, removal of third-party cookies by Q1 2025. 

Through idealism, and refusal or failure to support some everyday advertising practices at the outset – very much in the name of perfect privacy – Google has damaged participation in Sandbox from swaths of advertisers needed to move the ball forward.

Unintended consequences

The tension between the perfect-privacy Googlers in the Sandbox, its own more pragmatic Ads division and the rest of the industry has been palpable for years. 

The breaking point came when rigorous testing of the Sandbox showed something obvious: Replacing the proven cloud- and cookie-based auction model with on-device operations is hard. 

There is more work to be done by Google in bringing forward features that alleviate these concerns and better engage the supply partners who most directly fund publishers. All of this work is possible, though, especially for a company specializing in solving the world’s hardest problems. 

However, the decision not to compromise on perfection, and the resultant uncertainty over how and when the ecosystem loses third-party cookies in Chrome, has cost Google more than credibility and goodwill with open-web participants. 

Google’s uncertainty has also stoked the fire of developing tracking methodologies that are often opaque, unregulatable and invasive. These methods are immune to Sandbox APIs and the cookie deprecation Google still envisions. Google Tag Manager is already following this path with its first-party mode open beta that will allow for opaque server-to-server transactions between publishers and Google.

The end?

By stating that the Sandbox was never intended to be a replacement for cookies and inserting new-in-kind uncertainty in the timeline of cookie deprecation for its own purposes, Google has ensured continued skepticism of the Privacy Sandbox, even from its own advertising units. 

That skepticism doesn’t have to be the last word: A good-faith reengagement of the industry by Google, recommitment to its obligations under the CMA and putting in the hard work (and the time and compromise) needed to round out the Sandbox’s capabilities can still win the day. And we can still provide users with a more private internet than they experience today. 

Absent Google’s reengagement with the industry, the Sandbox initiative now risks accomplishing the exact opposite of its original goal. And internet users across all browsers and browsing methodologies will be the poorer for it.

Article originally posted on AdExchanger