Inside Google's Q1 2025 Privacy Sandbox Report

Google's Q1 2025 Privacy Sandbox Progress Report, submitted to the UK's Competition and Markets Authority (CMA) on April 29, 2025, offers a comprehensive window into the company's evolving strategy regarding third-party cookies and privacy-enhancing technologies. This document, covering January through March 2025, reveals significant insights into the challenges, stakeholder feedback, and ultimate direction of Google's ambitious privacy initiative.

The report was prepared as part of Google's commitments to the CMA under paragraphs 12, 17(c)(ii) and 32(a). It covers four main areas:

1. Progress on the Privacy Sandbox proposals
2. Updated timing expectations
3. Explanations of how Google has considered third-party observations
4. A summary of interactions between Google and the CMA

The document begins with an overview explaining that Google has been keeping the CMA updated through regular Status Meetings scheduled in accordance with paragraph 17(b) of the Commitments. It notes that Google maintains developer documentation providing overviews for core private advertising features and cookie changes, along with API implementation and status information.

The Pivotal Timing Announcement

The most consequential section of the report concerns "Updated Timing Expectations." Here, Google confirms a major strategy shift announced in April 2025 (just after the reporting period ended):

"In April 2025, Google published a blog post on Next steps for Privacy Sandbox and tracking protections on Chrome, announcing that Google has made a decision to maintain the current approach to offering users third-party cookies in Chrome, and will not be rolling out a new standalone prompt for third-party cookies. Users can continue to choose the best option for themselves in Chrome's Privacy and Security Settings."

This represents a fundamental change to the Privacy Sandbox initiative's original purpose of replacing third-party cookies with privacy-preserving alternatives. The report acknowledges this shift by stating: "In light of this update, we understand that the Privacy Sandbox APIs may have a different role to play in supporting the ecosystem. We'll engage with the industry to gather feedback and share an updated roadmap for these technologies, including our future areas of investment, in the coming months."

Importantly, the report confirms that "No updates were made to the Privacy Sandbox Timeline in Q1 2025," suggesting that the decision to maintain third-party cookies was finalized only after the reporting period ended.

Detailed Stakeholder Feedback by Category

The most illuminating section of the Q1 report captures extensive feedback from third parties, organized by category and specific API. This feedback offers crucial insights into the challenges that likely contributed to Google's pivot away from cookie deprecation.

General Feedback on Privacy Sandbox

Several fundamental concerns were raised about the Privacy Sandbox approach:

1. User Choice Uncertainty: Stakeholders expressed that "It is unclear what Google's updated approach to elevate user choice will look like, how it will be presented to users, and the anticipated opt-in/opt-out rates." Google responded that it would "provide further updates as available."
2. Fingerprinting Concerns: There was feedback that "Google has shared no information with publishers or marketers about how they can rely on any alternatives to Google's Ad Systems without using more risky consumer identity as a common match key (ie fingerprinting)." Google pointed to "several, non-Google Ad Systems that are offering solutions to publishers and marketers which are built in part on Privacy Sandbox APIs."
3. Google Control: Perhaps most significantly, stakeholders argued that "The Privacy Sandbox APIs would replace internet data ingredients with Google's own finished products. Since Google's alternative is an API, it is offering access to a product that it owns and controls, and one that is subject to terms and conditions that Google has discretion over. That is not a substitute for components that are used by others to make their own finished products." Google responded that the APIs "have been developed and implemented following extensive engagement with regulators and a wide range of ecosystem stakeholders."
4. Regulatory Compliance: Questions were raised about "whether Google's updated approach to 3PCs on Chrome will meet certain regulatory requirements, which may impact stakeholders consent management platform experience."
5. Testing Pause: Concerning feedback revealed that "Ad techs have paused Privacy Sandbox API testing and are seeking stronger reasons to reinvest in these technologies for product and marketing activities." This suggests a significant lack of industry confidence in the initiative prior to the April 2025 announcement.

Protected Audience API (PA API) Feedback

The Protected Audience API, a cornerstone of the Privacy Sandbox designed to enable interest-based advertising without cross-site tracking, received substantial criticism:

1. Google Advantage: Stakeholders argued that "Google will not send any GAM/AdX demand to a publisher who wishes to rely on a rival publisher ad server" and that "Information from PA API will be available to GAM but restricted for rival SSPs." They suggested this creates an unfair advantage for Google's ad systems.
2. Top-Level Seller Issues: Critics noted that "The Top-Level Seller (TLS) has access to information that none of the other component sellers have access to, raising concerns about unequal access to information." They argued that while "any entity can be the TLS, in order to access AdX demand, publishers are required to use GAM as the publisher ad server."
3. Security Concerns: The report states that "Attacks on PA API bids are fundamentally disqualifying for on-device bidding and auctions, this issue is not considered resolved by stakeholders."
4. Performance Challenges: Multiple stakeholders expressed concerns about latency and performance, with Google noting that "Chrome PA API auctions are 35% faster year-over-year."

Attribution and Measurement Feedback

Measurement capabilities received particularly pointed feedback:

1. Real-Time Data Limitations: Stakeholders emphatically stated that "The lack of real-time data impacts everyone in the industry. Delaying real-time data is a serious problem for advertisers, buyers move to platforms that have Google Analytics as it is the only place they can get proof of reaching audiences."
2. Implementation Difficulties: While testing Attribution Reporting API (ARA), issues were discovered including "insufficient granular reporting leading to noisy data and inflexible campaign optimization, high thresholds excluding smaller advertisers, and difficulty comparing campaigns due to inconsistent Key Performance Indicators."
3. Cookie Dependency Questions: Questions were raised about "the dependency of ARA on 3PCs, specifically regarding whether it remains in a testing phase requiring these 3PCs."

IP Protection (formerly Gnatcatcher) Feedback

The IP Protection component, designed to mask users' IP addresses, generated significant concerns:

1. Privacy Contradiction: Some argued that "Leaving IP addresses available for Google to use contradicts its stated privacy goals. Even though Google says that it anonymises data through IP Protection, users must be logged in to Chrome to use IP Protection, so Google still learns their identities."
2. Alternative Tracking: Stakeholders noted that "The use of IPs is a step in the wrong direction. They cannot be deleted from the browser, like cookies, and users don't have the same transparency controls as they do with cookies. If cookies go away, the industry will move to using IPs as an alternative solution, prioritising self-preservation over privacy."
3. Fraud Detection Impact: Concerns were raised about how "IP Protection could affect fraud detection systems" with questions about how "users see proxy IPs or a header" and whether "SSPs and DSPs see the same proxy IP address for a given use."

Google's Interactions with the CMA

The report details extensive engagement between Google and the CMA during Q1 2025, noting that "Google and the CMA collaborate on the agendas for each meeting to ensure that adequate attention is given to each topic." It mentions that "Google and the CMA typically engage with each other on at least a weekly basis" through various channels.

The CMA shared numerous stakeholder concerns with Google, including:

1. Standard-Setting Behavior: "Stakeholder feedback that Google's behaviour in standard-setting organizations is an abuse of dominance, as Google is using its influence to develop proposals that could potentially harm competition."
2. Implementation Progress: "Stakeholder feedback that Google's designs for Privacy Sandbox have not made sufficient progress towards widespread implementation and adoption and that Google's efforts to comply with antitrust laws have shifted the burden to its competitors."
3. Self-Preferencing: Concerns that "Google should also introduce the new user choice mechanism on its owned and operated properties to incentivise Google to design the Privacy Sandbox proposals in an effective way."
4. Google's Own Adoption: "Google has not yet provided a timeline for when its own SSP or DSP would shift to using its Privacy Sandbox technologies, which raises doubts as to why any competitors should continue testing a solution that Google itself does not consider fully ready for its own systems."

Google provided responses to these concerns, generally maintaining that it remains committed to developing the Privacy Sandbox in a way that doesn't distort competition while enabling privacy-preserving advertising.

Compliance Statement

The report concludes with a compliance statement from Renée M. DuPree, Director of Competition Compliance of Google LLC, confirming that for the three months to March 31, 2025, Google complied with obligations relating to:

1. Google's use of data (paragraphs 25, 26, and 27 of the Commitments)
2. Google's non-discrimination commitments (paragraphs 30 and 31)
3. Google's commitment regarding anti-circumvention (paragraph 33)

The statement notes that "Any failures to meet the Commitments during this three-calendar-month period were notified to the CMA within five Working Days of Google becoming aware of them," though it indicates "Not applicable" for any breaches.

Connecting the Q1 Report to the April Decision

While the April 2025 decision to maintain third-party cookies falls outside the January-March reporting period, the extensive feedback documented in the Q1 report provides compelling context for Google's pivot. The accumulated technical challenges, competitive concerns, and regulatory scrutiny appear to have reached a tipping point, especially in light of the DOJ's April 17 monopoly ruling.

The feedback captured in the Q1 report reveals an industry deeply skeptical about the Privacy Sandbox's viability as a replacement for third-party cookies. Testing results demonstrated performance issues, implementation barriers, and potential competitive imbalances that favored Google's own advertising systems.

For publishers and advertisers, Google's April announcement (referenced in the Q1 report) provides immediate clarity after years of uncertainty. The decision to maintain third-party cookies while continuing to develop Privacy Sandbox APIs creates a dual-track approach that allows time for further refinement of privacy-preserving technologies without disrupting the existing digital advertising ecosystem.

The Q1 2025 report ultimately serves as a detailed record of the final chapters in Google's original Privacy Sandbox strategy, documenting the accumulated concerns that led to the April pivot. For the digital advertising industry, this report offers invaluable insights into the complex technical, competitive, and regulatory challenges of transforming online privacy while maintaining a functioning advertising ecosystem.

Timeline

August 2019: Google first announces the Privacy Sandbox initiative as a way to strengthen online privacy while ensuring a sustainable, ad-supported internet.

January 2020: Google reveals plans to phase out third-party cookies in Chrome within two years, setting an initial target of 2022 for complete deprecation.

Google reveals the Privacy Sandbox timeline

Google says the timeline details the Privacy Sandbox milestones on the path to phasing out third-party cookies in Chrome.

PPC LandLuís Rijo

January 2021: The UK's Competition and Markets Authority launches a formal investigation into Privacy Sandbox under Chapter II of the Competition Act 1998. The investigation concerns Google's proposals to remove third-party cookies while transferring key functionality to Chrome.

February 2022: Google accepts legally binding commitments with the CMA to address competition concerns. These commitments require Google to develop and implement the Privacy Sandbox in ways that don't distort competition or improperly favor Google's own businesses.

July 2022: Google announces the first major delay to cookie deprecation, shifting the timeline to 2024.

February 2024: The IAB Tech Lab releases a comprehensive analysis of Privacy Sandbox, identifying significant limitations including measurement challenges, brand safety concerns, and technical complexity.

IAB Tech Lab releases final analysis of Privacy Sandbox fit gaps

The IAB Tech Lab released a final analysis of Privacy Sandbox, expressing concerns that it may hinder effective advertising for publishers and brands.

PPC LandLuís Rijo

July 2024: Google shifts its approach, announcing that instead of removing third-party cookies, it would allow users to choose whether to retain them. This marks the beginning of the retreat from full cookie deprecation.

Google unveils new path for Privacy Sandbox: user choice takes center stage

Google’s Privacy Sandbox shifts focus to user choice, delaying again third-party cookie deprecation in Chrome.

PPC LandLuís Rijo

September-October 2024: The CMA indicates that competition concerns remain under Google's revised approach, and that the current commitments would need to be updated to reflect changes in Google's plan.

October 2024 to February 2025: Discussions between Google and the CMA on changes to the commitments continue, as documented in the case updates from the CMA's investigation.

January to March 2025: During this Q1 reporting period, Google continues collecting extensive feedback from third parties about Privacy Sandbox components, revealing significant concerns across multiple areas of the initiative.

April 2025: Google publishes a blog post announcing that it "has made a decision to maintain the current approach to offering users third-party cookies in Chrome, and will not be rolling out a new standalone prompt for third-party cookies." This effectively terminates the plan to deprecate third-party cookies altogether.

April 29, 2025: Google submits its Q1 2025 report to the CMA confirming the decision and stating that "In light of this update, we understand that the Privacy Sandbox APIs may have a different role to play in supporting the ecosystem."