Written By: Joshua Koran
1. What just happened?
On June 13, 2025, The UK’s Competition and Markets Authority (CMA) published two announcements that could reshape the future of the internet.
First, the CMA published consolidated findings on how Google’s Sandbox impacts the monetization of rival publishers’ ad inventory when compared to their use of rival ad tech provider solutions. The CMA found that without third-party cookies (TPCs), regardless of whether Google’s Sandbox was deployed, “Advertiser spend fell” by double-digit percentages. “Spend fell particularly steeply on remarketing campaigns,” with corresponding drops in impression volumes and CPMs. Consequently, “publisher revenue per impression fell” by similar double-digit percentages.
This is relevant given that marketers shift spend away from lower-effective options to those that deliver better return on investment (ROI). The CMA’s testing analysis revealed that “that Google’s owned and operated advertising businesses would be less affected by these changes than its open display businesses.” Additionally, testers documented significant latency impacts on rivals’ properties ranging from double to triple digits. The CMA concluded, “Overall, Google’s tests showed that market outcomes were worse without TPCs than with TPCs” (https://assets.publishing.service.gov.uk/media/684bee68df3ce2ce31e3f948/Summary_of_testing_of_Google_Privacy_Sandbox_proposals.pdf).
The is important because if rival publishers would not willingly adopt Google’s Sandbox when given a choice, this raises the question of whether the CMA still needs to oversee Google’s ongoing development of its Sandbox. This brings us to the CMA’s second announcement: requesting industry feedback on Google’s May 2025 request for an early release from its Commitments (https://www.gov.uk/government/news/cma-consults-on-releasing-google-from-privacy-sandbox-commitments).
The CMA is now considering the degree to which the safeguards in the Commitments remain important to protecting competition across digital markets and is inviting feedback before making a final decision.
2. How did we get here?
Following Google’s recent defeats in its Search and Ad Tech antitrust cases, it is timely to revisit the history of the CMA’s investigation into Google’s Sandbox.
CMA’s Competition Concerns. This investigation began with concerns first raised by MOW in 2020, (https://movementforanopenweb.com/marketers-for-an-open-web-calls-on-uk-competition-and-market-authority-to-block-googles-privacy-sandbox) regarding Google’s plan to remove support for “ingredients” of open standards of interoperable communication and replace them with “with Google’s own finished products…. subject to terms and conditions that Google has discretion over.” (https://assets.publishing.service.gov.uk/media/6811f0ac0a8696a367e72730/Privacy_Sandbox_Progress_Report_to_the_CMA_2025_Q1.pdf)
While Google’s plans covered how different business-to-business (B2B) market actors could continue to use multiple forms of interoperable standards (IP addresses, URL strings, User Agent Strings), a key focus in the case was on TPC storage. TPC files contain match keys that enable real-time B2B communication—a fundamental technology for digital ecosystems. Originally scheduled for 2022, this change in support for open standards carried profound competitive implications.
“The CMA is concerned that through the Privacy Sandbox Proposals, if implemented without sufficient regulatory scrutiny and oversight, Google would be likely to abuse its apparent dominant position by leveraging its position in the supply of web browsers to foreclose competition in the markets for digital advertising and exploit web users…” (https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf).
Relevant Markets. The CMA carefully defined the scope of its investigation, explaining: “The CMA considers that, for the purposes of this Investigation, the relevant product market is likely to be that for the supply of display ad inventory to advertisers. However, the CMA considers that Google’s position in the separate market for search advertising is also relevant for the purpose of assessing Google’s incentives and the competitive effects of its proposals.” The CMA noted that “In a scenario where Google’s Proposals reduce the attractiveness of display advertising, some advertisers might switch a share of their purchases to search advertising” (https://assets.publishing.service.gov.uk/media/60c21e54d3bf7f4bcc0652cd/Notice_of_intention_to_accept_binding_commitments_offered_by_Google_publication.pdf).
The CMA identified concerns with Google’s abuse of its dominant position in consumer-facing platforms (Search, Android, and Chrome) and B2B Ad Systems to distort competition in numerous, related digital markets. “CMA’s preliminary view is that the main relevant product markets for the purposes of this investigation are: (i) the supply of web browsers to web users and publishers; (ii) the supply of display ad inventory to advertisers; (iii) the supply of search ad inventory to advertisers; and (iv) markets relating to the supply of ad tech services to publishers and advertisers” (https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf).
The investigation revealed that “Google’s ad tech services could benefit from increased interoperability when interacting with the Privacy Sandbox solutions compared to rivals (eg reduced latency), or Google could use its control over the device on which the auction will take place (eg Android devices) to grant its own services a technical advantage” (https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf).
This vertical integration raised concerns about market concentration, with the CMA warning that Google’s plans risked causing “spend to become even more concentrated on Google’s ecosystem at the expense of its competitors” (https://www.gov.uk/government/news/cma-to-investigate-google-s-privacy-sandbox-browser-changes). The CMA found that “without modification” Google’s designs would “reinforce its position in open display advertising,” ultimately harming consumers through reduced innovation and higher advertising costs.
Binding Commitments. In February 2022, the CMA secured binding Commitments from Google. As seen from the above, this was never a case about just cookies. Instead, Google’s Commitments established crucial safeguards to protect competition across digital markets well beyond just Chrome. The broad scope of the Commitments covered the discriminatory use of data or functionality from changes to its browser, Sandbox technologies and Ad System policies that would “distort competition by the self-preferencing of Google’s [1] own advertising products and services and [2] owned and operated ad inventory.”
The CMA mandated that Google’s proposals be assessed for their impact on “competition in digital advertising” in relation to both rival [1] ad solution providers and [2] publishers. Google could not proceed without first demonstrating that alternative solutions would address the CMA’s “competition law concerns” and the broader competitive effects of its conduct. (https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf).
The non-discrimination obligations (paragraphs 30-31) proved particularly significant, ensuring Google “does not distort competition by discriminating against rivals in favour of Google’s advertising products and services” in relation to its changes and their “impact on competition in digital advertising” (paragraph 8).
Google’s Commitments also cover Android in the definition of Personal Data (paragraph 6). When announcing these final commitments, the CMA emphasized its intention to maintain “engagement with, and input from, other market players as an important part of informing our approach to: monitoring the development and testing of the Chrome and Android Privacy Sandbox proposals” (https://competitionandmarkets.blog.gov.uk/2022/02/24/cma-secures-final-privacy-sandbox-commitments-from-google).
These safeguards were essential to protecting the open web and ensuring rivals could still effectively monetize, attribute and optimize ad inventory when using alternative interoperable, real-time communication standards necessary to compete with Google’s Ad Systems.
Nevertheless, Google’s Commitments were always time bound. When accepting Google’s Commitments, the CMA noted that “Almost half of all respondents to the First Consultation submitted that the duration set out in Section J of the Initial Commitments should be extended.” As a result, the CMA negotiated to extend protection from the initial five-year period to “a duration of six years from the CMA’s acceptance decision,” ending in February 2028
(https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf).
Commitments Enforcement. During the first two years of oversight the list of open issues with Google’s Sandbox began to grow. In February 2024, the CMA “ordered Google to pause its efforts to eliminate third-party cookies until multiple competition-related concerns are addressed. In its report, the CMA is demanding that Google ‘not design, develop or use the Privacy Sandbox proposals in ways that reinforce the existing market position of its advertising products and services, including Google Ad Manager’” (https://iapp.org/news/b/uk-cma-orders-google-to-halt-cookie-phase-out-until-agencys-concerns-met).
In July 2024, Google announced it would replace its plan to automatically remove TPC support from Chrome with new prompt screens asking consumers about supporting both B2B cookies and a subset of Google’s proprietary APIs (https://privacysandbox.com/intl/en_us/news/privacy-sandbox-update).
In September 2024, the CMA stated that despite this change, “competition concerns remain under Google’s revised approach, and that the current commitments would need to be updated to reflect the evolution in Google’s planned Privacy Sandbox browser changes” (https://www.gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes). Despite nearly a year of negotiations, Google would not offer revised Commitments.
In April 2025, Google announced it was continuing to invest in its Sandbox, given “new opportunities [for] AI-powered security protections.” Google promised to “share an updated roadmap for these technologies, including our future areas of investment.” Google also noted it would not alter support for TPCs nor introduce new consumer prompts, at this time (https://privacysandbox.com/news/privacy-sandbox-next-steps).
In May 2025, Google requested the CMA release Google from its Commitments ahead of their 2028 expiration.
The rationale for early release includes both an expectation of “relatively low uptake of the Privacy Sandbox tools” given their inferior advertising effectiveness relative to rivals’ solutions and Google’s April press release that stated it was not currently altering support for rivals’ use of key interoperable communication technologies.
As a result, the CMA is now consulting on whether to release Google from its accepted Commitments that have prevented anti-competitive outcomes.
3. What’s Next?
Regulatory Framework. Under Section 31A(4) of the Competition Act, the CMA can release Google from its Commitments if it “has reasonable grounds for believing that the competition concerns no longer arise.” Considering Google’s ongoing Sandbox development and potential browser divestiture, the CMA is now considering the importance of maintaining Google’s Commitments to protect digital markets.
Should the CMA release Google, it could reopen the case if new competition concerns arise, assuming the discovery of either a material change in circumstances, or incomplete, false or misleading disclosures by Google, using its “powers under the Digital Markets, Competition and Consumers Act 2024 as well as the Competition Act 1998.” However, these DMCAA protections would hinge on first designating at least the same scope of Google’s services covered by the Commitments, a process once started that could take over nine months. Google’s Chrome browser is not currently under any separate review to be covered under DMCAA. Moreover, reopening this case would involve the practical reality of assembling a new team, retraining them on the complex technical and economic details and trying to secure new Commitments involving both Google and any future owner of Chrome.
Effective Safeguards. The CMA should be commended for the current Commitments. Binding a dominant platform to non-discrimination principles represents a remarkable achievement. The CMA’s original reasoning remains compelling: “The Final Commitments do not seek to directly remedy the harm created by (or oblige Google to retract) any past announcement by Google. However, the CMA considers this appropriate, insofar as the aim of commitments… is to address future harm and shape future conduct.” (https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf).
While the CMA references new powers under “the new Digital Markets, Competition and Consumers Act 2024 (the ‘DMCCA’)”, the question at hand is whether any of the original risks identified by the CMA remain relating to Google’s abuse of its dominance in adjacent markets to distort competition in B2B display advertising markets in absence of the safeguards of paragraphs 30 and 31 of its Commitments.
The CMA notes that Google’s Commitments have demonstrably worked. Over the past few years, these Commitments have “protected competition by ensuring that Google designed and developed the Privacy Sandbox in a way that did not favour its own ad-tech services over those of its competitors.” Google currently has a continuing “obligation not to design or implement the new Privacy Sandbox tools in a way which discriminates in favour of its advertising businesses” (https://assets.publishing.service.gov.uk/media/6731ffb00d90eee304badaff/CMA_s_Q2_to_Q3_2024_report.pdf).
Unchanged Market Conditions. While Google changed its mind on immediate cookie degradation, the underlying competitive dynamics remain unchanged. The company still retains dominant positions in both mobile OS, browser and advertising markets, meaning changes to these systems can still create competitive digital market risks.
Ongoing Competition Concerns. The CMA’s original rationale for accepting Google’s Commitments emphasized protecting the digital advertising ecosystem against future conduct, particularly given “(a) the asymmetry of information between Google and third parties regarding [Google’s plans]; and (b) a lack of confidence on the part of third parties regarding Google’s intentions….”
Google’s voluntarily postponement of removing TPC support does not address the future conduct concerns or reassure digital markets that its dominant gateway technologies will continue to support effective and real-time use of interoperable B2B communication standards.
Broad industry consensus supports continued oversight. The CMA’s last quarterly report stated “industry stakeholders (particularly ad tech and publisher groups) were almost unanimously of the opinion that competition concerns remain, and that we should continue to oversee Google’s new approach” (https://assets.publishing.service.gov.uk/media/6731ffb00d90eee304badaff/CMA_s_Q2_to_Q3_2024_report.pdf).
Feedback requested. The CMA will soon consider whether any changes in circumstances genuinely address the original competition concerns that prompted these Commitments and whether Google’s future conduct poses any risk of an adverse effect on competition in the B2B markets for display advertising, to determine whether continued regulatory oversight remains necessary to prevent future market distortions.
The CMA is requesting stakeholders to comment on whether the competition concerns that originally triggered these Commitments still exist—and therefore whether the Commitments themselves are still necessary.
Whether intended or not, this timing for feedback captures the essential tension of this case. The deadline falls on Independence Day (July 4, 2025) (https://www.gov.uk/government/news/cma-consults-on-releasing-google-from-privacy-sandbox-commitments). h for their organizations.