CMA launches consultation on releasing Google from Privacy Sandbox commitments

On 13 June 2025, the UK Competition and Markets Authority (CMA) published a notice of intention to release Google from commitments initially put in place to ensure that its Privacy Sandbox was developed in a way that benefits consumers.

The CMA opened its investigation into Google’s Privacy Sandbox on 8 January 2021, in response to complaints of alleged anti-competitive behaviour and user data privacy concerns. In its Privacy Sandbox initiative, Google proposed to remove third-party cookies (TPCs) and alternative functionalities from Google’s Chrome browser engine and to replace them with a new set of tools for targeted advertisement. TPCs play an important role in online and digital advertising but raise data protection concerns given that they enable other websites to track the user (so-called cross-site tracking).

Google offered commitments to address the CMA’s concern that the proposed changes could further entrench Google’s alleged dominance in the UK digital advertising market. Following consultations on proposed commitments in June and November 2021, on 11 February 2022 the CMA published its decision to accept binding modified commitments. In particular, the final commitments - which were put in place for six years – included: the implementation of a transparent process, including consultation with third parties regarding the development of the Privacy Sandbox; CMA and Information Commissioner’s Office involvement in the design, development and implementation of the Privacy Sandbox proposals; non-discrimination against rivals of Google’s own advertising businesses in the design, development and implementation of the Privacy Sandbox; limiting Google’s use of data in its advertising businesses; and reporting and compliance regarding the commitments.

In July 2024, Google announced a new approach to the Sandbox in that it would introduce a new prompt giving Chrome users a choice of whether to maintain or restrict TPCs. In addition, some further changes were made to cross-site tracking where identifiers other than TPCs are used. On 22 April 2025 Google announced its intention to abandon the standalone prompt giving users a choice whether to restrict or maintain TPCs altogether, and restated its intention not to take any other action which would materially reduce the availability of TPCs. Following these events, Google put a request to the CMA for the commitments to be released. In response, the CMA has taken the provisional view that the commitments are no longer necessary and it would be appropriate to release them. However, before taking a final decision, the CMA has given interested third parties until 4 July 2025 to make any comments.