Google gave third-party cookies yet another stay of execution. And the digital ad industry is not shocked.
For companies that have been testing Google’s cookie alternative, the Chrome Privacy Sandbox, another delay was starting to feel inevitable, even before Google shifted its deprecation deadline Tuesday to an undisclosed date “early next year,” citing “ongoing challenges…reconciling divergent feedback.”
There are still just too many unanswered questions for the rollout to have moved ahead as planned.
For example, more than 350 issues remain open in Privacy Sandbox GitHub repositories, where programmers voice their concerns, said Raptive Chief Strategy Officer Paul Bannister.
Meanwhile, the UK’s Competition and Markets Authority (CMA), which is providing regulatory oversight for the Sandbox rollout, has given ad tech vendors and publishers until the end of June to submit feedback. Waiting for that feedback was one reason Google cited in missing its deadline. So far, the CMA has received input from at least 21 ad tech companies, publishers and industry groups.
But Google has thus far made no changes in response to issues flagged by the CMA in its Q4 2023 oversight report, according to Bannister. And the CMA’s Q1 2024 report, which released today, reaffirmed several of these lingering issues.
Much of that feedback highlighted anticompetitive concerns that seem to put Google at an advantage in Sandbox ad auctions. And the industry and the CMA have also raised red flags about the Sandbox’s detrimental effects on publisher CPMs and the level of control media owners will have over auction dynamics.
AdExchanger spoke to several sources who have been testing the Privacy Sandbox about the most contentious points of the new technology and where Chrome’s quest for a cookie alternative should go from here.
In short, Google’s plan to fully phase out cookies by the end of this year never really made sense to many who were testing it. Tech vendors in particular are breathing a sigh of relief.
“Spending the time to get things right and work out the gaps is the right call,” said PubMatic SVP of Marketplace and Addressability Andrew Baron.
On the now-abandoned timeline, the CMA would have decided whether Google could proceed with its deprecation plan by mid-year. If allowed, Google would have removed cookies from Chrome just in time for the busiest part of the marketing calendar.
“Making a major change like this in Q4 of an election year would not have been a good idea,” said Bannister.
Google also only introduced a test audience for the Privacy Sandbox in January, when it deprecated cookies for 1% of Chrome traffic.
Meaning the industry would have had just six months to collaborate with Google and the CMA on completely overhauling 20 years’ worth of ad tech progress and infrastructure, said Audigent Founder and CEO Drew Stein.
While the 1% of traffic test was sufficient for testing the mechanics of the Sandbox, it was “not robust enough to fully understand its impact on market dynamics like CPMs and fill rates,” said GumGum CTO Ken Weiner.
SSPs and DSPs also seemed to differ on how large the test audience needed to be to derive real insights.
The 1% pool was enough for SSPs because of their visibility into ad auctions, said Index Exchange President and CEO Andrew Casale, but buyers told him they needed a cookieless audience closer to 5% to assess the Sandbox’s impact on market dynamics.
Pressure on the CMA
It’s clear not everyone in the ecosystem felt they had the time or resources to adequately test the Privacy Sandbox, which could arguably extend to the CMA itself.
Companies have had trouble getting clarity on the CMA’s expectations for how Chrome would ramp up from 1% cookie deprecation to 100%. And they’ve also had trouble nailing down the CMA’s competitive criteria for kiboshing the Sandbox rollout.
“There are still things that have to be looked at, and areas where [the CMA] asked for more time to consider things,” said Quantcast CEO Konrad Feldman. However, the CMA should be given credit for collaborating with the industry and taking on the task of overseeing a complete overhaul of the ad tech ecosystem, he added.
Though every facet of its oversight wasn’t clear, the CMA has been open not just to receiving feedback but also facilitating testing. For example, the CMA provided an A/B testing framework that seemed very well thought out, Casale said.
The CMA’s heaviest lift, though, is evaluating the Sandbox’s under-the-hood impacts on competition within ad auctions and the resulting downstream effects on publishers.
For example, the Topics API showed a data advantage to large, multitopic sites – such as YouTube, which is owned by Google, said Raptive’s Bannister.
And multiple sources said they have expressed concerns to the CMA about Google Ad Manager’s (GAM) status as top-level seller for Privacy Sandbox auctions. Critics argue it’s possible Google would be able to outbid other SSPs’ bid prices because GAM’s status lets it run its own auction – with its own demand sources – after other SSPs have run theirs.
Plus, the Privacy Sandbox’s now well-documented latency issues on ad rendering will have a detrimental effect on publisher revenue.
The Sandbox adds seconds of render time to each ad impression, according to Raptive’s latest testing data. If that latency causes an ad auction to time out before an impression is served, the publisher doesn’t get paid.
Early tests indicate CPMs for Sandbox auctions were 30% lower than CPMs for impressions where a third-party cookie was present. Latency contributes to this shortfall.
Much of this latency comes from the Privacy Sandbox moving the ad auction to the client side. It happens within the Chrome browser, which keeps any data related to serving an ad confined to a user’s device. The problem is people’s devices do not have the same computing power as thousands of computers sitting on a cloud service like Amazon Web Services (AWS), said Audigent’s Stein.
Instead of running the auction within the browser, publishers could use a trusted execution environment (TEE) to run the auction server side in the cloud. Doing so would increase the processing power available for the auction and therefore reduce latency.
While the Privacy Sandbox does allow for some auction mechanics to run server side in a TEE, Google currently only permits TEEs that run on either AWS or Google Cloud Platform, said Index’s Casale.
That’s a competitive concern for companies like Index, which offers its own cloud-based TEE for publishers.
Bannister echoed this concern from the publisher perspective, suggesting Google should allow TEEs provided by Microsoft Azure, Magnite, Cloudflare and others. But it remains to be seen whether Google will remove the TEE limitation.
Going forward
All that being said, it’s still unclear to those testing the Sandbox what issues will meet the CMA’s requirements for anticompetitive concerns or publisher impacts.
“If the open internet is a little bit worse for advertisers, money will go to non-open internet sources like Google,” said Quantcast’s Feldman. “But assuming competition will be impacted, how much of an impact is too much? It’s just not clear.”
Although the CMA has regulatory authority, the industry is mostly looking to Google for answers. That’s because every other web browser simply got rid of cookies without coming up with a replacement signal. So, marketers have a vested interest in collaborating with Google on making the Sandbox work because Chrome is the only major web browser that’s trying to roll out a cookie alternative.
But the solution will only work for everyone, said Audigent’s Stein, if Google stops thinking of advertising as a zero-sum game and reembraces the collaboration with the ad tech industry that helped position it as a dominant player in the first place.
The half-baked nature of the Privacy Sandbox rollout illustrates just how far Google has fallen when it comes to prioritizing its ad tech platform and collaborating with the industry, said a source familiar with testing who asked to remain anonymous.
“Frankly, if you look at their ad stack, it feels like an area they’ve almost been ignoring,” with Google making few major upgrades to its SSP and DSP as of late, they said. “This has been [Google’s] first big change in a long time, which is one of the reasons they’re a little bit stuck.”
Though some respondents feel Google has been receptive to feedback and is taking its responsibility seriously, despite repeated delays.
“While it’s frustrating to marshal resources toward a moving target,” said Yieldmo SVP of Product Management Mark McEachran, “it’s great to see that Google recognizes it hasn’t fully addressed the needs of the modern advertising ecosystem.”
However, no matter which way the Sandbox ultimately shakes out, the industry shouldn’t rest on its cookie-enriched laurels.
“This delay does not mean advertisers get to keep stapling user IDs to people forever,” said Basis Technologies VP of DSP Product Ian Trider. “Lots of people may be hoping Google will be forced by the CMA to let third-party cookies keep existing forever. That is almost certainly not going to happen.”
