What you need to know: 

• Google claims it wants to improve user privacy by removing its mobile advertising ID and stopping cross app data sharing. It has created a "Privacy Sandbox on Android", a space for the industry to share and discuss proposals that let brands advertise but keep user data private. 
• The plan mirrors Apple's App Tracking Transparency, or ATT, which stipulates all individual apps must gain explicit permission to track users. A low percentage have chosen to do so. 
• Google said this "blunt approach" has led to "worse outcomes for user privacy and developer business", but it doesn't yet know what a good approach looks like. It's taking a "consultative" approach.
• The announcement comes days after the main UK competition regulator, the CMA, gave the green light to Google's commitments to reforming how ad tracking works, with the CMA now effectively the arbiter for when third party cookies can be culled.
• Google's APAC Head of Privacy, Regulatory, Crisis and Risk, Jessica Martin, told Mi3 the web and Android Privacy Sandboxes are separate but will rely on the same principles and norms. 
• There are concerns mobile changes could impact funding models for apps and mobile games, 90 per cent of which are free in Google's ecosystem. 
• Regulators are piling on to Google, which is facing mounting legal cases around the world. In Australia, the Australian Competition and Consumer Commission is weighing significant intervention to force a greater level of transparency and competition.
• But perhaps the platform can keep them all onside by tasking industry with aligning on solutions while committing to consulting with both businesses and regulator on any changes to the status quo – which has made it one of the world's richest and most powerful companies.

Apple deuce

Google has confirmed plans for its own version of Apple’s App Tracking Transparency (ATT) that could kill off cross-app data sharing about users on mobile devices and up-end the mobile ad industry as we know it.

Google's 'Privacy Sandbox for Android' operating systems sets a two-year timeline for alternatives to its mobile advertising ID. But crucially – raising question marks over any timetable and potentially creating a regulatory shield – puts the onus on industry to deliver. 

Launching the initiative via a blog post – though telling agencies and industry associations days earlier and making them sign NDAs – the tech giant took aim at Apple over ATT, a feature that forces app publishers to gain explicit, opted-in consent to being tracked across apps. Google described Apple's approach “blunt ... ineffective” and leading to “worse outcomes for user privacy and developer businesses”.

But industry experts say there’s more to Google’s announcement than meets the eye, both in its timing, content, and potential impacts. It could "decimate mobile advertising in games and apps", per one holdco exec, and prompt a push towards paid apps and in-app purchases, a cut of which goes to Google.

Meanwhile digital agencies say a two-year timeline and a transparency process mean the industry can properly come up with alternatives and adapt to changes. It's understood Google briefed key stakeholders on its plans earlier this week.

Socially acceptable? 

Google said more than 90 per cent of the apps on Google Play are free, claiming it wants to give publishers, advertisers and developers that rely on mobile advertising time to come up with a solution that doesn’t encourage fingerprinting or identity workarounds. It cited support from Snap Inc, creator of Snapchat, game developer Rovio, creator of Angry Birds, and language app Duolingo in its announcement. Snap’s inclusion is interesting as – like Facebook – its share price plummeted 25 per cent in October after it cited Apple’s privacy features as a reason for lower revenues.

“These solutions will limit sharing of user data with third parties and operate without cross-app identifiers, including advertising ID,” Google wrote in its blog post.

“While we design, build and test these new solutions, we plan to support existing ads platform features for at least two years, and we intend to provide substantial notice ahead of any future changes.”

How, when?

Google is taking the same 'industry collaboration' or 'sandbox' approach to removing the mobile ad ID that it has taken to its delayed cull of third-party cookies. Its Chrome sandbox has prompted dozens of proposals to match a user’s identity on the open web without using cookies – with varying success. Its own Federated Learning of Cohorts (FLoC) flopped, but its recent contextual play, Topics, may yet fly.

Google is under intense regulatory pressure around the world. Last Friday, the UK’s Competition and Markets Authority (CMA) said it would keep a “close eye” on any Privacy Sandbox proposals and block any attempts to remove third party cookies unless it was satisfied there wouldn’t be bad impacts on competition. The two may be related – and some argue Google now has a regulatory shield.

“The two-year horizon [for the Privacy Sandbox on Android], so soon after the UK CMA decisions, suggests Google may have been sitting on this for a while but was waiting to get the green light on plans for Chrome first,” said Joshua Lowcock, UM Worldwide’s Global Chief Media Officer.

Changes that make advertising less lucrative in mobile apps would, ironically, benefit Google, as it may force some developers to explore paid or in-app payment models, he suggested.

“On the open web, we have seen publishers pivot to user registration and first party data. On mobile, if Android app developers go down the same path and default to sign in with your Android (Google) ID this will directly benefit Google’s ad business while giving the illusion of an intent to protect privacy,” added Lowcock.

“There is global regulatory scrutiny on app stores and App Store payments, this announcement will be a red flag for regulators.”  

Google stated that the principles of its web-based sandbox apply to its work with Android.

But ultimately, the mobile ad ID deprecation is likely to be a positive change for users, said Joey Nguyen, co-founder of now Deloitte Digital-owned Venntifact. “The old ways of individual level tracking without consent disappear forever, and there will never be a viable replacement for that technology,” per Nguyen, who has long urged Australian businesses to invest in first-party infrastructure.

“All signs point to more privacy and regulatory tightening – there needs to be a directed internal business effort towards this," said Nguyen. "That won't come in the form of a single vendor solution."

Two years...

Locally, digital media agencies have seen relatively low spend away from Apple devices post-ATT, though some longer burn categories have suffered as attribution over longer timescales is harder. A two-year window will likely make most digital advertisers and agencies, who deal with things reactively, pretty comfortable, which is perhaps Google's intention.

“We are seeing limited impact on how investment is planned due to ATT or any other privacy-related changes within the industry,” said Philip Pollock, Chief Operating Officer at Omnicom’s Resolution Digital.

“As the timeline on the changes being announced by Google is stretched out, it's likely that other factors within the industry or regulation will have a greater impact by the time this has been implemented.  

“We are also interested to see how this could impact choice for advertisers within ad tech, sources of inventory and targeting options.”

ATT “made measurement harder” and advertisers initially crimped spend, said Publicis Groupe’s Chief Product Officer Jason Tonelli, but they soon figured out new metrics and started to spend again.

“Two years is a long time to get this up and running, and provides ample time for app developers to get ready,” he added. “But I would suggest that we need to move quickly so that Google in turn can move this timeline forward as well…

"When we look at audiences we want to acquire, contextual targeting will become one of the ways forward for unknown audiences, and for known audiences, then first party data and integrations of these with the platforms will most likely be the strategy that drives this." Tonelli said blockchain and crypto may play a role, but it is likely to be a while off yet.

Shift, bust

Damien Healy, APAC Operations Officer at digital agency MiQ and a former senior exec at Havas, Xaxis and Dentsu, said the two-year timetable helps both the industry and regulators. Europe’s strict data laws, he suggested, prompted some businesses to adapt and others to exit voluntarily or otherwise.

“The timeframe is better than expectations," said Healy. "The fundamental shift is away from personal identifiers with the exception of direct consumer relationships. That does mean contextual, geo-contextual, and app categories as obvious future methods, as well as consent-driven PII [personally identifiable information] activation pathways.”

Google is the IAB's biggest member. Jonas Jaanimagi, IAB Australia's Tech Lead, suggested the Privacy Sandbox on Android shows that "Google's commitment to privacy is total". 

However, he added that brands and the digital ad supply chain should recognise what it may soon lose – essentially, all the tools digital marketers have taken for granted.

"The impact on both publishers and marketers should not be underestimated in terms of targeting, measurement and attribution across all devices." 

Feeling lucky?

Google’s APAC Head of Privacy, Regulatory, Crisis and Risk, Jessica Martin, told Mi3 the company’s ad ID plans are separate to the deprecation of the third-party cookie and that its primary concern is about preventing “covert tracking” while maintaining the mobile ad 'ecosystem'.

“We all agree there are reasons why good, personalised advertising works for the ecosystem [but] we know that something needs to change,” said Martin.

She said a long lead time and consultative approach with industry would protect all the other components in the advertising machine.

But she could not clearly answer how Google will approach privacy, though appeared to suggest it would be incumbent on users to opt-out.

In late 2021, Google introduced ‘zero out’, allowing users to opt-out of interest-based targeting while sharing a string of zeros with advertisers instead of a unique ad identifier.

“It’s a core premise of what we do with our products. If you go into Android, you can see your app controls and you can control them on an app-by-app basis or within the app,” Martin said.

“The intention is that this Privacy Sandbox on Android initiative will protect user privacy while still facilitating advertising functionality that supports the ad-funded apps.”

The two privacy sandboxes – for cookies and Android – are functionally separate spaces, said Martin, and the timelines for change are also different. I.e. two years notice after coming up with an acceptable Android privacy attempt does not mean the cookie cull has also been extended, despite the UK regulator now having final say.

“There’s been some learnings around the principle and hence doing public participation process and getting the ecosystem to engage, but the speed of proposals developed will be somewhat linked to the level of participation,” said Martin. 

“The CMA commitments are with Chrome, and that is a different conversation.”

While Martin said it's too early to say whether Google's mobile ad ID alternative would be an opt-in feature, like Apple's ATT, the principle of user choice remains key and, she suggested, it may vary by market. European and US privacy legislation require different things – hence the drawn-out timetable.

“Two years is quite a sensible transition period,” said Martin. “If it were done in a condensed period ... it could have unintended consequences for others.”