Outlook
CMA Privacy Sandbox oversight: what it requires of Google and what UK advertisers should document
CMA Privacy Sandbox commitments bind Google on consulting over API changes. This guide covers the open investigation, test records, Android limits and DMCC powers.
What to take away
- CMA Privacy Sandbox oversight binds Google, not advertisersGoogle must consult the CMA and keep its commitments before changing Chrome measurement APIs.
- The CMA investigation into Google's Privacy Sandbox browser changes is open, and the CMA can accept revised commitments or enforce.
- No rule compels UK advertisers to keep test records, but dated evidence defends measurement choices and answers information requests.
- Privacy Sandbox on Android is a separate regime from Chrome web APIs, so a web result does not transfer to app measurement.
- The DMCC Act 2024 adds statutory conduct requirements and fines alongside the voluntary commitments.
What the CMA commitments require of Google
The CMA accepted undertakings from Google in 2022 covering Chrome's plan to remove third-party cookies and replace them with Privacy Sandbox APIs, including Topics, Protected Audience and Attribution Reporting.
Three duties do the work. Consultation requires Google to notify the CMA before it withdraws or changes an API in ways that could harm competition or privacy.
Non-discrimination stops Google designing APIs to favour its own advertising products. Transparency requires published progress plus test results and industry feedback handed to the CMA.
| Duty | What Google must do | What it means for testing |
|---|---|---|
| Consultation | Notify the CMA before withdrawing or changing an API | API behaviour can shift after CMA review, not on Google's product calendar |
| Non-discrimination | Avoid designing APIs to favour Google's own ad products | Auction dynamics and returned data can move |
| Transparency | Publish progress and supply CMA evidence, including industry test results | Your own test data can enter the regulatory record |
Google's Three Privacy Sandbox Duties
Duty
- Consultation
- Tell CMA before API changes
- Non-discrimination
- No favouring own ad products
- Transparency
- Publish progress and test results
What Google Must Do
- Consultation
- Measurement moves slowly
- Non-discrimination
- Affects auction and data
- Transparency
- Evidence for market knowledge
Why Advertisers Care
- Consultation
- Non-discrimination
- Transparency
The commitments are not statute. They bind Google because the CMA accepted them to close an earlier investigation, and the CMA monitors compliance.
The live investigation and what a test must show
The CMA case page, Investigation into Google's Privacy Sandbox browser changes, records scope, commitments and updates. It is the primary source for UK advertisers.
An open investigation does not freeze the market. Google can still ship APIs, but the CMA can examine them, request changes and act on a breach.
For every test, record the API version, Chrome version, dates, geography and sample size. A test without a control group proves little, because Chrome traffic is not uniform.
Keep a named owner who checks the case page monthly. Revised commitments can withdraw a feature your test depended on. Rehearse those reversals through the silent platform change scenarios before you commit budget.
Example: documenting an Attribution Reporting test
A retailer plans a holdout test against Attribution Reporting for October 2026. These steps keep the result defensible.
Documenting an Attribution Reporting test
- Log the API name, Chrome version, start and end dates, geography and sample size.
- Write the hypothesis and define the control group before launch.
- Record the conversion delta against your existing model, including negative results.
- Save vendor correspondence, including any projection you relied on for budget.
- Note the lawful basis for personal data in the test.
- Keep one timeline of Chrome and CMA updates.
The ICO's Guide to the General Data Protection Regulation (GDPR) is the reference for step five.
Negative results are market evidence. If Attribution Reporting undercounted conversions against your model, write down the delta and keep it.
Advertiser API Test Documentation Register
- Test registerAPI, hypothesis, dates, Chrome version, geography, sample size
- Outcome logpositive and negative results with measured delta
- Vendor correspondenceprojections, emails and revised claims
- Legal basisUK GDPR lawful basis and consent capture
- Change logGoogle API updates and CMA publications
Mobile measurement: Android is a separate regime
The CMA mobile ecosystems market study examined Apple's iOS and Google's Android.
Privacy Sandbox on Android is a separate regime from Chrome's web APIs. The channel measurement blind spots comparison shows where app and web evidence cannot be merged, so label which platform each test covers.
On iOS, App Tracking Transparency requires permission before cross-app tracking. On Android, Google restricts the advertising ID. Both limit identifier-based attribution for installs and in-app events.
Separate consent flows and separate models per platform are now normal. Remedies in the market study could add conduct requirements for Apple and Google, changing how measurement software works on mobile.
The DMCC Act 2024 and CMA digital market powers
The Digital Markets, Competition and Consumers Act 2024 gives the CMA a statutory route to binding requirements for firms designated with strategic market status. Conduct requirements can be tailored to adtech or app distribution, and the CMA can fine for breach.
For measurement teams, the narrow point matters. A designation in adtech could change data access rules or add transparency duties that affect how you buy media.
The Act does not replace UK GDPR. The ICO still enforces data protection, so keep competition evidence and data protection evidence separate; the two regulators ask different questions.
The five demand signals show how to read regulator and platform records for early warning rather than relying on vendor decks.
Common questions
Do UK advertisers have a legal duty to document Privacy Sandbox tests?
No. The commitments bind Google. Documentation protects you if a measurement choice is questioned or you contribute evidence to a CMA or industry consultation.
Can the CMA stop Google shipping a measurement API?
Not directly on demand. The consultation duty lets the CMA scrutinise changes and seek revisions, and the open investigation allows enforcement if commitments are breached.
Why does Android need separate test records from Chrome?
Privacy Sandbox on Android is a different regime with different policies, consent flows and identifiers. Web results do not transfer, so mixing the evidence weakens both sets.
