Competition and Markets Authority battles with cookies and privacy

Following complaints from marketing and publishing organisations, the Competition and Markets Authority (CMA) has announced that it will investigate proposed changes to Google’s Chrome browser.

This is one of the first investigations after the formation of the CMA’s Digital Markets Unit. The unit, established in December 2020, was set up to help curb anti-competitive practices by the tech giants.

The CMA said it had received complaints from a number of organisations including Marketers for an Open Web Limited, a group of newspaper publishers and technology companies, which allege that, through the proposals, Google is abusing its dominant position.

It said the investigation will assess whether the proposals could cause advertising spend to become even more concentrated on Google’s ecosystem at the expense of its competitors. 

Although third-party cookies play a fundamental role online and in digital advertising, there are concerns about their legality and use from a privacy perspective.

In 2020, Google began rolling out an update to Chrome, which limited cross-site tracking by treating cookies that do not include a “SameSite” label as first-party only, and requiring cookies to be labelled and accessed over HTTPS in order to be available in third-party contexts. The company said the same system is being rolled out on Microsoft Edge and Firefox web browsers.

Once the roll-out is complete across all three, Google claimed that third-party cookies would no longer be needed by the 99.9% of registered domains that do not require them, which would improve privacy and security for the vast majority of sites on the web.

Google also said it plans to roll out a further update to Chrome in 2021, which it said would strengthen protection against additional types of network attacks that could hijack the users’ privileged credentials to perform malicious actions on their accounts. “We’re also rolling out changes in Chrome to mitigate deceptive and intrusive tracking techniques, such as fingerprinting,” the company wrote in a blog post.

In effect, Google’s changes – known collectively as the Privacy Sandbox project – would disable third-party cookies on the Chrome browser and Chromium browser engine and replace them with a new set of tools for targeting advertising and other functionality.

However, in its recent market study into online platforms’ digital advertising, the CMA highlighted a number of concerns about their potential impact, including that they could undermine the ability of publishers to generate revenue and undermine competition in digital advertising, entrenching Google’s market power.

The CMA said it had been considering how best to address legitimate privacy concerns without distorting competition in discussions of the proposals with the Information Commissioner’s Office (ICO), through the Digital Regulation Cooperation Forum. As part of this work, the CMA said it had been in discussions with Google to gain a greater understanding of the proposed browser changes. The current investigation will provide a framework for the continuation of this work, and, potentially, a legal basis for any solution that emerges.

Andrea Coscelli, chief executive of the CMA, said: “As the CMA found in its recent market study, Google’s Privacy Sandbox proposals will potentially have a very significant impact on publishers like newspapers, and the digital advertising market. But there are also privacy concerns to consider, which is why we will continue to work with the ICO as we progress this investigation, while also engaging directly with Google and other market participants about our concerns.”

The CMA said it has an open mind and has not reached any conclusions at this stage as to whether competition law has been infringed. It said it would continue to engage with Google and other market participants to ensure that both privacy and competition concerns can be addressed as the proposals are developed.