On 26 November 2021, the UK CMA published a Notice of Intention to Accept Modified Commitments Offered by Google (the “Notice”). The Notice included a consultation on the proposed commitments (the “Modified Commitments”). The deadline for responses to the consultation is Friday 17 December 2021.
MOW sets out below 12 key points for consideration in responding to the consultation, where MOW has concerns in relation to the Modified Commitments.
1. Short timeframe for responses.
1.1 MOW is concerned that the Notice was published over the US Thanksgiving holiday weekend, and that December is a busy time for many companies, end of year deadlines, festive celebrations, staff on annual leave, and many companies’ end of financial year falling at this time.
1.2 In the context, giving companies just 21 days to respond seems particularly short. If you would like to respond but are not confident you can do this within the timeframe, write to the CMA to set this out and request an extension.
2. The difference between introducing new products and removing access to interoperable data.
2.1 MOW’s concerns, in relation to the Privacy Sandbox, centre on the removal of access to interoperable data which is relied upon by countless businesses across the online ecosystem for countless purposes, including fraud detection and prevention, and performance optimisation.
2.2 If Google wishes to innovate and introduce new products, such as cohort-based marketing, MOW has no objection to this, provided existing access to interoperable data is not removed. In MOW’s view, removal of interoperability will never lead to innovation and competitive outcomes.
3. Interim measures/delay.
3.1 In simple terms the CMA has found four clear infringements. Google has offered undertakings, but nothing has been done by way of an interim remedy to stop the breaches of competition law from continuing. The CMA has been given no reason not to use its powers and every reason to do so.
3.2 MOW is conscious that the further delay caused from each round of negotiations between the CMA and Google, and further consultations, and indeed the scheme of the commitments and undertakings allows ongoing harm in the marketplace to continue unchecked. MOW applied for interim measures on 23 November 2020 and has supplied evidence of serious harm to a range of businesses – further evidence of serious harm has also been submitted in the interim. If there is further evidence of serious harm to your business, it should be submitted to the CMA with your response.
3.3 MOW considers that the CMA must use its interim measures powers now to prevent further harm to a fragile market dominated by Google. Google’s impact on the market is extreme and that competition which remains needs to be preserved. Google is not complying,[1] and it has offered no objective justification for its sandbox of browser changes that will interfere with interoperability over the web.
3.4 Competition and all of the markets affected need to be protected to survive and to ensure that the undertakings have an opportunity to provide a solution. The law requires the CMA to issue an interim order to preserve the status quo.
3.5 The CMA has asked for views on how the undertakings could best be put into effect – we would welcome your support in asking for interim measures now. The CMA should take comfort from the fact that Court of Justice of the European Union very recently found Google to be an “ultra-dominant” business with enhanced duties toward others to ensure that the market is not further distorted. Given that explicit duty is clearly not being complied with, the CMA has increased reason to use its interim measures powers and to do so now.
4. News Publishing.
4.1 The Modified Commitments in no way address the concerns MOW has raised to the CMA in relation to the impact on news publishing.
4.2 If you are a news publisher, get in touch with the CMA to raise your concerns. We understand that Google is putting pressure on news publishers to join its “Google News Showcase”. Its threats to block browser interoperability particularly affect news publishers. You may be sensitive to fear of retaliation. Note that the Notice indicates that the CMA will not publish such submissions or show them to Google.
5. First-Party/Third-Party Discrimination.
5.1 The Modified Commitments appear to be premised on Google’s arguments that first-party data is somehow less of a privacy risk, or less privacy-invasive than third-party data. MOW considers this to be incorrect.[2]
5.2 Privacy-by-design uses of interoperable, pseudonymous data is not more invasive or more risky to the individual than Google’s collection of personal data from first party domain cookies and from its many owned and operated services.
6. User Agent String/User Agent Client Hints.
6.1 The CMA appears to have concluded that the change to a website required to rely on User Agent Client Hints instead of User Agent String is small enough to not require any prevention or intervention under the Modified Commitments. MOW considers that the ultra-dominant position enjoyed by Google imposes on it an obligation not to abuse that position vis-à-vis others, and the relevant and proportionate assessment of the competitive harm is in relation to the size and scale of the relevant market. Smaller markets that are more sensitive to Google’s abuse require special care. Judgments of relative importance should not be made with reference to Google’s scale.
6.2 Do you run a website which utilises fraud detection, analytics, performance optimisation, secure login services, market research, or other uses of the User-Agent String; what will the impact of the change to User Agent Client Hints mean for you? Let the CMA know.
7. WebID.
7.1 The Modified Commitments include no specific undertakings in relation to the introduction of WebID, a proposal which will put Google in the middle of websites and their users. MOW does not consider this to be acceptable or appropriate as they are part of the Google Privacy Sandbox proposals and would interfere directly in current contractual relations between websites and their customers, effectively allowing Google to move functionality currently in websites into its browser and capture end users in its walled garden.
7.2 Will WebID have a negative effect on your business? If you have moved to use of first-party data and/or a combined website in an effort to avoid the impact of Google’s blocking of third-party cookies, this is aimed at capturing your customers and creating increased dependence on Google. Let the CMA know your views.
8. W3C.
8.1 The Modified Commitments propose that the Privacy Sandbox proposals will continue to be progressed in W3C Business, Community, and Working Groups.
8.2 MOW has formally made submissions to the CMA/EU Commission and US Department of Justice that W3C is operating its processes and procedures in ways that do not support competitively neutral standards but is biased in favour of the Major Tech players. This position was stated and recorded in the recent US House Committee report that recorded that Google has 106 representatives, while most others have 1, and dominates proceedings alongside reports of bullying and unfair distortion of the process. Do you have similar concerns? Let the CMA know.
9. “Covert Tracking”, “Fingerprinting”, and “Privacy”.
9.1 The Modified Commitments refer to the above terms without including any set definition. Moreover, the way they are referred to, in MOW’s view, implies an acceptance of Google’s view of the world which MOW, and many others, disagree with.
9.2 MOW considers that technical language should be used as far as possible rather than colloquialisms and such language should be removed from the commitments. Do you agree? Let the CMA know.
10. The Development and Implementation Criteria.
10.1 MOW remains extremely concerned about the wording described for the development and implementation criteria. For example, one of the criteria is the “impact on competition in digital advertising and in particular the risk of distortion to competition between Google and other market participants.”
10.2 As MOW has informed the CMA, the risk to competition requires assessment of competitive constraints on Google. In the absence of such constraints Google’s proposed changes serve only to benefit Google. For example, Google is looking to block third-party cookies. This is a denial of interoperability for many competing publishers. The alternatives Google has put forward, such as FloC and Fledge, don’t work as well for those publishers. If any other alternative were to be put forward it would have to be proved to work. That means operate as effectively in practice as in theory and be demonstrated after testing and trialling to operate as effectively as at present, otherwise Google’s threatened denial of interoperability should be rejected.
10.3 Moreover, with “digital advertising” being undefined, it’s not clear what the current undertakings would actually cover or how objective assessments could easily be made.
11. Quantitative measurement that relates to how well Google addresses the CMA’s concerns.
11.1 In the Modified Commitments, Google commits to testing only its roll out of the Privacy Sandbox, not whether any of its changes to standard browser functionality or its replacements for this functionality provide effective and viable solutions.
11.2 MOW does not think that this is adequate quantitative testing. Let the CMA know if you agree.
12. Public Announcements and “Nailing the lie”.
12.1 Finally, and fundamentally, the industry should be provided with certainty and the remedy that Google is putting forward needs to be accompanied with a communication to the public at an equivalent scale and addressing an equivalent audience as the announcements that it has made promoting its plan to block third-party cookies and other browser changes. Google now seeks to make amends by improving the transparency undertakings and publishing information on a blog or microsite
12.2 Google has put out a series of announcements that were designed to undermine confidence and trust in the minds of customers advertising in online Newspapers and other publications that use third party cookies. That denigration of competitors’ offerings has largely succeeded with the untrue and pejorative misrepresentation that third-party cookies are likely to be more intrusive to personal privacy than first-party cookies.
12.3 Moreover, the argument that third party cookies necessarily invade privacy and need to be blocked is untenable in the light of the Supreme Court’s recent judgement. Google’s own case before the Supreme Court in Lloyd v Google recently ended when it demonstrated that third-party cookies do not in themselves necessarily involve an invasion of personal privacy (as the ICO has also indicated – see above)..
12.4 In the circumstances, continued public campaigns that discriminate against third parties need to stop. The CMA needs to order them to stop. The fact that Google’s widely published announcements have denigrated competitors and their use of third-party cookies and suggested that they were more of a vehicle for privacy invasion than first-party cookies is a matter that Google should be required to publicly rectify. As many publishers and newspapers know, the law requires that a publication which is found to be untrue needs to be retracted. That retraction needs to be made in a publication with similar audience reach and readership at an equivalent scale and with similar prominence if the “Lie is to be nailed”.
[1] Google have commenced deprecating the User-Agent string with the launch of Windows 11 and has made no effort to commence the standards setting process for any of the Privacy Sandbox proposals.
[2] The ICO has also stated that it rejects the view that first-party data is inherently lower risk than third-party – see section 4.1 of ICO Opinion “Data protection and privacy expectations for online advertising proposals”.