Google’s Privacy Sandbox: An Attempt to Control Data-Dependent Markets?

By Abhinav Singh Chauhan

Synopsis

The article analyses the effect of Google’s Privacy sandbox on the online display advertising market. Through its Privacy Sandbox, Google plans to phase out support for third-party cookies on its web browser, eventually preventing access to critical data required for directing relevant ads to users to other advertisers in the market.

The article proposes to treat data as an essential facility under the doctrine of essential facility to prevent Google from restricting data access to other players in the market. The article further analyses if Google can resort to Intellectual Property laws by treating data collected as an intellectual property to prevent sharing data it collects through its web browsers. The article ends with proposing some changes to the terms of Privacy Sandbox to harmonise its goals and the potential antitrust concerns in the market.

Prefatory
A significant part of today’s economy is dominated by data-driven industries. Thus, data is often regarded as the new ‘oil’ due to its potential of fuelling the data economy. Not only does data help companies to decide, but some companies, such as those operating in the business of digital or online advertising, rely entirely on data for their regular business. Online advertising refers to advertising in which the content is delivered through online means. Online advertising is particularly attractive as it allows advertisers to discover users’ interests and direct their ads to people with particular interests. (at 60)
Search advertising and Display advertising are the two broad categories of online advertisement. Search advertising refers to the ads that appear next to the search result on the search engine, depending upon the user’s search query. Whereas in online display advertising, advertisers place targeted ads on websites or apps in various formats. The ad space can either be sold directly to advertisers through owned and operated channels like Facebook and Snapchat or through third-parties intermediaries, like Google AdSense, which is called open display channel.

One of the main features of an open display channel is that the advertisers and publishers can track the user activities through Third-party cookies (TPCs), which helps them direct their ads to users having particular interests. Therefore, access to user data becomes paramount for market players in the open display advertising market. Thus, if some players lose access to user data, then such players would eventually lose out to the competition in the market.

2. Google and its Privacy sandbox
Through its Privacy sandbox, Google proposes to phase out support for TPCs and other ways of cross-site tracking on its Chrome browser. Though Google’s Privacy Sandbox can be considered a sound move to ensure users’ privacy, the same is problematic on a couple of levels considering the competition in the market.

Google Chrome is one of the most used web browsers globally, with more than 68% of the desktop users and 63% of smartphone users using it to surf the internet. Furthermore, Google’s pre-installed WebView android application, which allows users to access web content on various android applications, also uses Chrome. Given the significant market share of Google Chrome, if Google goes ahead with its idea of Privacy Sandbox, it would mean that third party advertisers will not be able to track web activities of a significant portion of people. Eventually, they lose out on their ability to direct the ads to users with specific interests, which is the basic tenet of online display advertising.

In the Open-display channel for display advertisements, intermediaries are pivotal as they create the link between the publishers and advertisers, and Google single-handedly owns most of such intermediaries. (¶ 2.41) Moreover, as Google has its own ad inventory (YouTube) coupled with its ad intermediaries (Google Adx, Google AdMob, Google AdSense) and Publisher ad servers (Google Ad Manager), Google is present at almost all the levels of the ad supply chain with a significant market share. (at 271) Due to this, the concerns regarding the Privacy Sandbox aggravate further as the user data, though not available to third parties, will still be accessible to Google, which it can use to benefit its own ad ecosystem, eventually driving out competition from competition the market.

3. Remedying the harm
Since the data is a necessary input required to enter into the market of open display advertising, the question arises whether the access to data is so essential that Google can be obliged to provide access to data to other players to ensure the competition in the advertising market under the doctrine of essential facility.

Under the doctrine of essential facility, if an asset, controlled by a dominant entity, is essential to compete in the downstream market and it is unfeasible to find an alternative of such asset, then the dominant entity can be obliged to provide access to the asset to other players in the downstream market. Thus, ensuring that the dominant entity in one market having control over a scarce resource does not leverage its dominance to different levels of the vertical supply chain.

A facility or asset becomes essential if it does not have any actual or potential substitute either because of physical, economical or legal barriers, and it is indispensable for competing in the downstream market.(¶ 83) However, even if a facility is regarded as essential, the dominant entity may deny access to the same if giving access to such facility would reduce its value or hinder its development, or if the dominant entity is not willing to vertically integrate the facility into the downstream market.

Google’s decision to prevent access to data is a fit case to apply the doctrine of essential facility as Google, by denying access to data, is leveraging its dominant position in the web browser market to the downstream market of online advertising.

Since Google Chrome has the highest share of desktop and mobile users among the web browsers coupled with its integrated Android WebView application and browsers based on Google’s Chromium web browser platform, Google becomes a dominant entity in the web browser market as observed by UK’s CMA in its recent case against Google’s Privacy Sandbox.
Given the dynamics of the open display advertising market, data is vital for advertisers to analyse users’ interests by monitoring their internet usage, due to which no entity can compete in the market if they do not have access to data, making data an indispensable essential facility. Moreover, because of Google’s high market share among web browsers, there are only a few options for publishers, ad tech providers and web users to completely circumvent Google in the Web browser’s market.

Though Google may argue that user data is freely available from other sources, the same would fall flat as the quantum of data generated on Chrome far exceeds data freely available because of Chrome’s market share. In arguendo, even if we assume that alternatives to data generated on Chrome exist, the question arises whether the quality of data is good enough to foster competition in the market.

Since the value of data depends upon how it is used, (at 9) irrespective of its volume, the mandatory sharing of data can be problematic if the entity getting access to data uses it in some other market either directly or after analysing the data. Thus, mandatory data sharing creates impact beyond the market considered while providing access. However, the same can be prevented by providing access only to the limited data that is absolutely necessary for competing in the downstream market or by providing access to data on pre-determined conditions for its usage.

4. Competition law v/s intellectual property
Since the doctrine of essential facility obliges the dominant entity to provide access to the essential market facility, the dominant entity may attempt to prevent its resource from being shared by protecting it through Intellectual Property Rights (IPR). Thus, it becomes imperative to analyse if such data can be protected through IPR, and denial of access to essential facilities be justified by IPR

In Magill case, the broadcasters refused to provide access to their programme schedules to other publishers who wanted to publish a comprehensive guide for all channels, as the broadcasters had copyright over such listings. The programme schedules were necessary for publishers, as without them, they cannot produce programme schedule guides, eventually preventing them from entering the market itself. Though the situation on Magill and the present situation arising out of Google’s Privacy sandbox is similar, the difference is that Google, as of now, does not have any such protection over the data collected.

Since IPR are usually granted to people “over the creations of their mind”, getting such protection over the collected third party data would be challenging for Google. Moreover, data collected by Google is merely information about users’ activities on the web; it does not fall into any category for which protection could have been granted.

The only way Google can attempt to refuse access to data is by creating a database out of the data collected and seeking a sui generis protection over the same. Sui generis right is granted to a database if it can be shown that the data is the result of substantial investment. For sui generis rights to be granted to a database, the database should be a “collection of independent works, data or other material arranged systematically or methodically.”

The next question is whether an entity can be allowed to affect the competition if it has protection over the critical industry resource. Applying the doctrine of essential facility against the data protected under IP laws can be attributed as a conflict between the two areas of law as the former mandates sharing, and the latter protects the property from being shared. However, consumer welfare being the goal for both the laws, they complement each other for the greater good.

ECJ held in Magill that IPRs cannot be used to create entry barriers in the secondary market. Thus, if the essential facility is protected under IPR, and the dominant entity denies its access to others in the downstream market, it would still be an abuse of dominance. Therefore, an entity can be obliged to allow access to essential facilities to others, irrespective of whether the same is protected by IPR.

5. The aftermath
Though Google claims that Privacy Sandbox enhances the privacy of Chrome users, it fails to determine how it provides privacy when the users are still being tracked over the web, and the data is analysed and then used for advertising. The only difference Privacy Sandbox creates is that all the data will only be accessible to Google only, allowing it to dictate the terms for its use in the advertising market, for which it is receiving attention from competition regulators across major jurisdictions, including the EU and the UK.

Though the challenge posed by Google’s privacy sandbox can be solved by modifying the terms of Privacy Sandbox, which was also proposed by the UK’s CMA, or by obliging google to share data under the doctrine of essential facility, even if it manages to get IPR. However, the bigger challenge is to control the big-techs, which have reached a significant position in the market, to prevent them from dictating the terms of the market to their benefit. The ex-ante control mechanism proposed in the EU’s Digital Markets Act can be considered a progressive step towards regulating the big-techs to ensure competition in the market.

[This article by Abhinav Singh Chauhan, a student at the National Law University, Odisha, was the second prize winning entry at the JDCIL-Esya Centre Article Writing Competition held in 2021]