Article illustration 1

In a watershed moment for web privacy and advertising, Google is dismantling core components of its Privacy Sandbox initiative following the UK Competition and Markets Authority's (CMA) decision to release the tech giant from its regulatory commitments. Nearly five years after launching this ambitious framework to replace third-party cookies, Google confirmed it will retire:

  • The Attribution Reporting API (Chrome & Android)
  • IP Protection
  • On-Device Personalization
  • Private Aggregation & Shared Storage
  • Protected Audience API (PAAPI) (Chrome & Android)
  • Protected App Signals
  • Related Website Sets
  • SDK Runtime
  • Topics API (Chrome & Android)

Anthony Chavez, VP of Privacy Sandbox, stated the company will provide phaseout details later. Only three components survive:

  1. CHIPS (Cookies Having Independent Partitioned State): Partitions third-party cookies per-site to prevent cross-site tracking.
  2. FedCM (Federated Credential Management): Enables private website sign-ins without third-party cookies.
  3. Private State Tokens: Encrypted tokens for fraud prevention without identity tracking.

Google will also contribute its Attribution Reporting API learnings to the W3C's Private Advertising Technology Working Group for interoperable standards.

Regulatory Unwind

The CMA's exit follows Google's abandonment of third-party cookie deprecation in 2024—a core condition of the 2022 agreement addressing antitrust concerns. The regulator's consultation revealed unanimous opposition from 15 respondents, who warned Google could still leverage Privacy Sandbox to disadvantage rivals. However, the CMA concluded Google's API retirements and cookie policy reversal eliminated the competition risk.

Why This Matters

This retreat underscores the collapse of a centralized solution for post-cookie advertising. Stephen Dnes of Dnes & Felver noted: "The underlying point that rich data adds value for rivals remains." James Rosewell of Movement for an Open Web warned: "The CMA needs to keep an eye on this situation as Google is a known recidivist."

The Privacy Sandbox's disintegration leaves a fractured landscape: CHIPS and FedCM offer narrow privacy solutions, but no comprehensive alternative to cross-site tracking exists. The industry now faces prolonged uncertainty, with regulators and developers forced to navigate competing standards and Google's lingering influence over web infrastructure. As one privacy engineer lamented: 'We spent years adapting to a future that just vanished.'

Source: AdExchanger