The CMA’s second update report sets out the progress made by Google to date and highlights areas of focus where potential concerns have been raised, including through feedback from the wider industry.

Based on the evidence the CMA currently has available, the regulator considers that from 1 July 2022 to 30 September 2022 (the relevant reporting period) Google has complied with the Commitments it made in February 2022. Google is reporting on the basis of calendar quarters, so any developments in October 2022 will be covered in Google’s next quarterly report.

Based on all the work undertaken to date, and submissions/feedback that the CMA has seen, the regulator says that its current overall priorities are:

1. ensuring Google designs a robust testing framework for its proposed new tools and APIs; to effectively shape quantitative testing, the CMA will be seeking feedback from market participants on the design of effectiveness testing;
2. continuing to engage with market participants to understand concerns raised by them, challenging Google over its proposed approaches and exploring alternative designs for the Privacy Sandbox tools which might address these issues; and
3. embedding the Technical Expert (S-RM) into the monitoring regime; the Technical Expert’s role will be primarily analysing data access and flows within Google’s systems, ensuring robust technical access controls and security are in place, and supporting the Monitoring Trustee by providing additional ad tech expertise.

The CMA welcomes further engagement from market participants, in particular those with concerns about any element of the design or implementation of the Privacy Sandbox as set out in the Commitments.

The CMA says that it has begun to reach out to many market participants already, including on the design of experiments to test the Privacy Sandbox tools, but would welcome any further views from the wider ecosystem. The CMA is currently seeking to:

1. encourage those who plan to eventually adopt and use the Privacy Sandbox technologies to engage with any testing they have the capability to carry out early; and
2. receive feedback on its plans for the assessment that will be outlined in a separate note on experimental designs to be published shortly and understand stakeholders’ capability to conduct quantitative tests.

The CMA has also published Google’s Q3 report on its compliance with the binding commitments.

To access the CMA’s update report and for details on how to submit feedback, click here. To read Google’s Q3 report, click here.