Privacy Sandbox Is Coming—and It Might Just Be the Privacy Solution We’ve Needed All Along

These are not off-the-cuff suggestions, as the impact of ignoring or misinterpreting these recommendations is plainly visible. With privacy currently being the fastest moving field in our industry, we’re reaching the point where most—if not all—professional discussions have a privacy angle. While that’s great in terms of profile, it’s not really good in terms of quality.  

If you ask me, most cookie banners are subprime usability blockers that annoy users and turn them away. At worst, they’re dark patterns obscuring malice. When the most common denominator is so prevalent—that being lousy banners—we get what is called banner blindness, a phenomenon where web users (un)consciously ignore any banner-like information. When that symptom kicks in, it’s a downhill race to the bottom.

A likely sequence of events then plays out: marketers settle on a nice and easy bottom feeding tactic, the whack-a-mole game of privacy merry-go-round spins through another orbit as either tech, public opinion or regulators (or all of the above) make a new move to counter it. Recently, for example, it was Brave’s turn in the game of ignoring the privacy elephant in the room. The company announced it was going to block cookies by default and roll out a cookie pop-up blocking feature to Android and desktop users, which is arguably a step backwards. Rather than adding any clarity around what data is collected and why, the browser actually acts on behalf of consumers and removes choice from the user. It’s important to highlight that regulation is not anti-business, but it’s pro-consumer. Privacy-enhancing technology needs to respect this narrative. 

My former colleague (and still just as wise) Myles Younger powers his crystal ball with some nostalgia to suggest consent pop-ups are dead. “Someday soon we’ll look back on cookie consent pop-ups the same way we look back on “300 hours of free AOL” CD-ROMs littering our sidewalks. The farcical dying gasp of a dying way of transacting a digital thing,” Myles argues—and he is not wrong. It’s been seen before, as observed by the analytics supremo Simo Ahava, who argues that Do Not Track was a failure from the start. Diving into the implications of Safari’s Intelligent Tracking Prevention, better known as ITP 2.1, on web analytics, Ahava says that “Funnily enough, ITP 2.1 removes support for the Do Not Track signal in Safari, denoting the end to this miserable experiment in WebKit. Had more sites respected DNT when determining should visitors be tracked or not, perhaps we wouldn’t have seen ITP 2.1 in its current shape.” 

Consent management is anti-user.

Why are these well-meaning initiatives failing? Google surveyed over 7000 people across Europe in 2021 and found that users want to have control of their data. Recent follow-up research quantified the degree to which the feeling of control influenced customer confidence in brands. The conclusion? A positive privacy experience on a site has a measurable positive impact on a brand.  

So, how can you create such a positive privacy experience and avoid the pitfalls that we’ve seen with Do Not Track (DNT) and the current crop of Consent Management Platforms (CMP)? If it’s up to Google, brands should make the experience:

• Meaningful by showing people what they get in return for sharing their data
• Memorable by reminding people what data they shared and when
• Manageable by providing tools for people to manage their privacy

The demise of third-party cookies means the future of first-party cookies. 

For many, applying this mnemonic to first-party cookies is a work in progress. Cookie consent banners are still relatively new, even though third-party cookies have been under threat for many years. We know which browsers restrict their use and we expect these restrictions to extend to Chromium browsers in 2023.

If digital marketing can’t function without third-party cookies, this has the potential to hit big tech in the coffers, and we cannot allow this to happen. There’s a clear motivation to solve existing use cases by utilizing privacy-enhancing technology—this is where The Privacy Sandbox comes in. According to a Google statement, “Privacy Sandbox for the Web will phase out third-party cookies and limit covert tracking. By creating new web standards, it will provide publishers with safer alternatives to existing technology, so they can continue building digital businesses while your data stays private.”

We’ll see the next phase of testing kick off in 2023 when the Privacy Sandbox API is publicly available for testing on Android. Right now, this is API testing, which means that they’re testing for developers rather than users. The user testing phase is where it gets real for real people. This is the opportunity to succeed, think of Google’s mnemonic, instead of failing like DNT and CMPs.  

Cookie management sitrep.

Right now, you can open the settings in your browser on each device and scroll through the list of cookies for each site, and decide to delete them. You can then visit the site and repeat the exercise in the “manage cookies” section of the CMP.  However, this current process doesn’t fit in terms of being manageable. In fact, the term laborious doesn’t even begin to describe it.

When it comes to qualifying as meaningful, cookie management has a low score because it’s so opaque—how can you tell who else is getting access to the cookies and for what purposes? As for memorability, most users only remember the frustration and tedium, but little else regarding their choices.

So, considering the future of cookie management, how might the Privacy Sandbox address the choices users have to make with regards to “tracking” and their privacy? While this section is entirely speculation and therefore not an official roadmap, it’s aspirational with the aim to be realistic and pragmatic. My thoughts are as follows. 

• Users get to decide what topics they are interested in and willing to share with third parties.  
• Users allow the browser to build a list of topics, but the user reviews and controls the list periodically asking to be reminded on a set schedule.
• Users can choose to set their topics to apply across all sites they visit. Any advertising they see on any site they visit will use and respect these settings.
• Users can choose to review their topics preferences on a per site basis. Users get to curate (and review) their own whitelist/blacklist for sites or types of sites.
• Users ask to be reminded to check their preferences every so many days, weeks or months.
• Users can choose to reset all data in the browser automatically every so many days, weeks or months.

Now, let’s apply similar controls to first-party cookies:

• Users will be able to tell the browser what type of cookies they will accept, and whether they want to be measured—anonymously or otherwise.
• Users can specify this applies to all sites, some sites (whitelist) or types of sites.
• These settings are reviewed on a scheduled basis.

What are the right default values to apply on first use? The good news is, there are no default values. On first use, and on a frequent basis, the user must explicitly set their own first use values. In other words, no values are suggested or automatically preselected.

How is this different from a CMP banner? Set it once, and make a conscious set of decisions with no intrusive user experience on every site or app you use. This could actually be set at a “profile” level across all devices and all browsers. This requires less mark-up and coding to be done by site owners. In short, there’s less to maintain, less to go wrong, less to slow down and less to cause friction.

How is this different from DNT or Brave? A more granular approach and a genuine user-controlled choice are the fundamental differences that make this approach manageable and meaningful. The range of choice is meaningful and the act of making a choice is manageable as it is made as friction-free as possible. Moreover, having to make a choice is memorable, as well as the ability to set reminders to review these choices at your convenience.

Now is the time to apply these lessons for the future.

The challenge for The Privacy Sandbox is to reduce friction, increase transparency and enhance authority. The privacy improvements will cater for existing use cases as well as provide a manageable, meaningful and memorable privacy experience for users.

That said, what’s the takeaway for digital marketers? Google said that “The Privacy Sandbox on Android will be a multi-year effort,” so what to do right now? Circling back to the start of this article, it’s important to:

• Take control of your data
• Embrace the regulatory spirit
• Go beyond the bare minimum
• Make it meaningful, memorable and manageable

Though we accept the looming end of the third-party cookie, this doesn’t mean we have to stop digital marketing. New privacy-enhancing tech changes the methodology, as the same use cases are catered for with new tech to enable better ad serving. Having learned from the success of these technologies applied to the end of third-party cookies, we can confidently focus the lessons on our first-party data collection. What works across sites and apps must also have the same utility on individual sites and apps. Keeping that in mind, the end goals remain:

• Build a relationship with your customers
• Be transparent
• Be useful
• Be responsible with data

All in all, achieving these goals and aiming to provide a better experience has immense value for your customers and your business.