Making sense of Google’s plan to limit tracking on Android

Showing its softer side isn’t necessarily new for Google. The company likes to present itself as a thoughtful partner whenever it’s about to drop a bombshell on ad execs. Nevertheless, cynics take the rhetoric with a heavy dose of salt. This is a business, after all, that monopolized the idea of controlling all sides of the trade. But the sheer amount of regulatory pressure the business is under makes that approach harder to do. Put another way: Google has to be perceived as behaving differently.

After all, Google is proposing measures that echo Apple’s privacy crackdown which restricts third parties’ access to iOS device users’ data. It’s an insider’s competition of virtue signaling underpinned by governments’ interest in cracking down on consumer privacy. For consumers who may or may not care.

That’s not to say, the latest announcement hasn’t set alarm bells ringing across the industry. App developers, in particular, remain concerned since Google intends to replace the mobile identifier — the mechanism they rely on to pull in a lot of media dollars — with elements from the Android Privacy Sandbox.

That’s just one in a long list of unanswered questions and lingering concerns. Not all of them can be resolved. Not when everything about the Privacy Sandbox is subject to change as Google takes on feedback from the industry. For now, though, we’ve pieced together what can be explained — and what to watch out for — as the initiative gathers momentum.

Is this a big deal?

Yes and no. Yes, because the changes Google wants to usher in via the Android version of its Privacy Sandbox mean apps of all shapes and sizes are going to be limited even more in what data they can track about a person. On the other hand, however, this doesn’t seem like it’s going to cause anything like the trauma caused by Apple’s crackdown on tracking on its devices which caused Meta to record a $10 billion drop in advertising sales this year. Execs across the industry forecast the next two years — the estimated timeframe Google has given the industry when it comes to the Privacy Sandbox rollout on Android — will be less fraught.

Alex Austin, CEO of Branch, a mobile app measurement firm that raised $300 million in funding last week, told Digiday his company was “not worried” and wasn’t planning an immediate deviation from its existing product development plans.

This is because he, along with many others, expects Google to develop APIs with similar functionality to SKADNetwork — an attribution tool Apple developed in tandem with its data rollbacks on iOS — for the Android ecosystem. Not to mention the fact that its dialog with other tiers of the industry will be more robust when compared to Apple’s conduct.

The immediate impact

There won’t be one. If anything, Privacy Sandbox is a pass for the ad industry given Google has essentially said it will wait at least two years to remove its mobile identifier and even then will only do so if a viable alternative has been found. That said, there’s likely to be a surge in the use of the identifier and subsequently advertising with it as advertisers and publishers try to squeeze as much from it as they can before it goes.

“We do believe there will be a large immediate impact surrounding strategies to best support marketers that are wanting to leverage advertising to drive growth — and publishers that want to ensure continued revenue in their ads businesses,” said Charles Manning, CEO of Kochava, a company that helps brands and advertisers quantify the impact of their mobile marketing efforts.

In other words, marketers needn’t panic over the latest announcement.

Nevertheless, Wayne Blodwell, CEO of TPA Digital, a consultancy that helps advertisers integrate digital more seamlessly into their wider marketing strategies, advised marketers to better familiarize themselves with Privacy Sandbox proposals as well as keep abreast of how Google’s testing progresses.

“By being dialed in this will help them to understand what will change from the current state of measuring/targeting on Android to the future state,” he added. “This will then allow them to assess the impact and changes they might need to make.”

A meeting of minds

Just as it did for the browser version of the Privacy Sandbox, it’s important that Google finds the appropriate forum to discuss the development of the one for Android devices. Remember, the World Wide Web Consortium (W3C) focuses on the web aspects only.

“Perhaps an answer to that would be a new forum focusing on specific proposals across environments,” said Łukasz Włodarczyk, vp of programmatic ecosystem growth and innovation at RTB House. “It would allow all interested parties to participate in the development of this concept and improve it before it is sent to testing and implementation. Indeed, the value of such an exchange of views has been proven many times during the development of the Privacy Sandbox for the web.”

Privacy assured?

Developing privacy-protecting solutions won’t be enough. Google will have to proactively police the ecosystem if it is to live up to its promise of closing less scrupulous actors in the Android ecosystem that may seek to track device users without their witting consent.

Several sources, all of whom requested anonymity due to widespread anxieties over public discussion of individual user-tracking, told Digiday there is a historic precedent for “shady actors” adopting measures whenever “obfuscated methods” of user tracking are introduced into any online ecosystem.

For instance, “fingerprinting” — a process whereby analytics companies use various data signals, a.k.a. probabilistically modeling, to track users online without their consent — spiked in the immediate aftermath of Apple announcing privacy restrictions on iOS as well as its Safari web browser. Despite this, Apple did not aggressively crackdown on these instances — a decision that did not necessarily line up with the public, privacy-conscious message it promoted.

Google would be minded to avoid doing the same, according to the aforementioned sources. Doing so, however, is easier said than done.

Branch’s Austin told Digiday that “it will be incredibly difficult” for Google to provide a 100% guarantee that its collegiate approach to developing user privacy standards — a method that Google claims is more effective than Apple’s unilateral policy.

New sandbox, same problems

Bringing the Privacy Sandbox to its Android platform is Google essentially saying that it will restrict the use of persistent identifiers by the ecosystem at large. What it hasn’t said is whether it’s going to be subject to the same restrictions.

“Google is inhibiting the use of persistent identifiers by the world at large but isn’t clarifying what its own intentions are,” said Gartner analyst Eric Schmitt. “There’s nothing in this announcement about Google restricting itself.”

There are reasons to wonder.

“One hurdle the Privacy Sandbox has continuously had to overcome is the perception that its proposals could provide an unfair advantage to Google’s advertising business, which resulted in tight regulatory oversight, delays in its timeline, and skepticism from much of the industry,” said Julie Rubash, chief privacy counsel at Sourcepoint.

Granted, Google has committed, at least to the U.K.’s Competition and Markets Authority, to implement internal limits on data it can use. The company also made a point in its Attribution documentation to clarify that Google’s ad tech platform would be subject to the same enrollment process and limitations as other ad tech platforms, said Rubash.