Privacy Sandbox: Unlocking the potential of a more private internet

Building a more private internet is no longer an option; it's necessary. People are increasingly aware of how their data is used online, and their expectations for privacy are growing.  

Over the past three decades, we've seen remarkable innovation around the internet: accessible and equitable information, the mobile age, and now generative AI. It is time to advance this technology and migrate the internet into a more private one. 

Change can be challenging, but as an industry, we can unlock innovative solutions that both protect people's privacy and continue to support a free and open internet. Our Privacy Sandbox team thinks deeply about balancing these needs, and we continue progressing. 

This week, we announced that at the beginning of 2024, we will test Tracking Protection, a new feature that limits cross-site tracking by restricting website access to third-party cookies by default. We will roll this out to 1% of Chrome users, a key milestone in our Privacy Sandbox initiative to phase out third-party cookies for everyone in the second half of 2024, subject to addressing any remaining competition concerns from the UK’s Competition and Markets Authority.

The role of third-party cookies

Third-party cookies have been a fundamental part of the web for nearly three decades. While they can be used to track your website activities, sites have also used them to support a range of online experiences—like helping you log in or showing you relevant ads.  

With the Privacy Sandbox, we're taking a responsible approach to phasing out third-party cookies in Chrome. We've built new tools for sites that support critical use cases and provided time for developers to make the transition. And we're starting with a small percentage of Chrome users so developers can test their readiness for the web without third-party cookies.  

As we count down to the next stage of removing third-party cookies, it's essential to be clear what Privacy Sandbox is and isn't

What Privacy Sandbox is and isn't

First, Privacy Sandbox works the same for everyone. All businesses and ad tech platforms – including Google Ads – have the same access to data and capabilities simultaneously. 

Second, it is not a standalone ad tech solution for marketers and publishers. With Privacy Sandbox, Chrome and Android provide the building blocks that ad tech providers can incorporate into their products – alongside other privacy-safe signals, like contextual and first-party data. Just like today, ad tech companies will craft a wide range of innovative solutions, using the best of these technologies to meet the needs of their customers.  

And finally, Privacy Sandbox is not another type of tracking: It significantly improves privacy compared to third-party cookies and other cross-site identifiers.  

It uses a range of Privacy Enhancing Technologies — like Data Aggregation, On-Device Processing, Differential Privacy, Data noise, and Trusted Execution Environments — to protect user information while providing helpful functionality for developers. By doing this, Privacy Sandbox hides the user's identity and minimizes data collection.  

That is in direct contrast to cross-site identifiers — whether based on signals like IP addresses or user data like email addresses. These enable users to be re-identified across different websites and effectively allow unlimited cross-site data collection. 

Industry support is critical  

Testing is critical to the success of the Privacy Sandbox, and we've worked with more than 3,000 partners globally to test our open-source solutions and APIs for over two years. In particular, we're very encouraged by the industry's increased interest in Protected Audience API (formerly FLEDGE) testing. Protected Audience API is a Privacy Sandbox technology that enables on-device auctions by the browser to choose relevant ads from websites the user has previously visited. It is designed so third parties cannot track user browsing behaviour across sites.  

We're working with multiple SSPs (supply-side platforms), DSPs (demand-side platforms) and others across the industry to increase live testing in the coming months. We are seeing that as demand-side testing ramps up, supply-side interest in testing is also growing. We expect this virtuous cycle to accelerate as SSPs finish integration in the coming months and add more inventory.   

In Singapore, we forged a new joint partnership with IMDA earlier in the year to help Singapore businesses prepare for a privacy-first future. Through this partnership, Singapore businesses can test Google's Privacy Sandbox solutions within IMDA's Privacy-Enhancing Technologies (PET) Sandbox. Companies can use or share data in this secure environment without disclosing sensitive information.  

Since its launch, the programme has received widespread interest. We are working with companies across industries, web publishers and mobile applications to help them migrate to a more private internet. With third-party cookie deprecation, there are two critical areas of focus to be prepared for:

Firstly, all companies are auditing and updating their site domains with Google's Privacy APIs to ensure continuity of user experience and journeys. Secondly, companies dependent on an advertising-based economy are testing and implementing Google's privacy-preserving Advertising APIs to ensure continuity without the use of 3rd party cookies and cross-site targeting.   

We believe privacy is at the centre of our vision for the web, but compromising the ability to keep content freely accessible to consumers is not an option. As we work to make the web more private, we continue to ensure businesses have the tools to produce high-quality content accessible across the internet.  

Without universally accessible news articles, videos, educational information, community sites and more, the web loses the very thing that made it worth protecting in the first place. With Tracking Protection and all of the features we launch in Chrome, we will continue to work to preserve a web that remains universally accessible to everyone — and private by default for every user.  

Kunal Guha is the director of privacy partnerships for APAC at Google.