Privacy Sandbox Overview

What is a Privacy Sandbox? Privacy Sandbox Overview
Estimated Reading Time: 5 minutes

Google’s announcement in January 2020 that they intend to deprecate support for third-party cookies in Google Chrome within the next two years sent a shockwave across the marketing and advertising industries. It’s not hard to see why.

Third-party cookies are involved with almost every aspect of digital marketing—from measuring campaign performance to targeting users with relevant ads. Luckily for marketers and advertisers alike, Google also introduced an initiative to create purpose-built functionalities within the browser to support these use cases in a privacy-safe way for users. With this, the Privacy Sandbox was born.

In the engineering world, a sandbox is a restricted environment for defined activities. You can do certain things and play around with tools and specific information in the sandbox without making a mess elsewhere. In the privacy context, it allows for the personal information of the user to be contained within this browser “safe space” and only used for certain activities without that information being exposed outside of the sandbox, thus protecting the privacy of the user. 

Where traditionally third-party cookies were used to identify users across sites and leveraged for a number of different use cases, the Privacy Sandbox aims to remove the ability for cross-site identification while providing purpose-built tools specific to accomplish the primary advertising use cases of the industry. Think of these purpose-built tools as toys to play within the sandbox— one for measuring conversions, one to measure campaign reach, one for re-marketing to users, etc.  

There are a number of different proposals and solutions being built in the Privacy Sandbox, all in varying stages of development. Below are summary descriptions of some of the primary proposals. Companion overviews which provide further context and impacts relevant for marketing and advertising professionals will be shared in the coming days.

FLoC – Federated Learning of Cohorts

The Privacy Sandbox proposal with the most publicity and commentary to date is no doubt the FLoC. This new method aims to help advertisers personalize their advertising based upon general interests of the user viewing those ads. Encrypted information about web pages that a user browses is collected and saved within the browser. This encrypted browsing information is then used to place the user in a cohort with other users consuming similar content across the web. Once the cohort reaches a size which can effectively protect the anonymity of the user, a cohort ID is made available in the browser which can be leveraged for ad targeting and campaign optimization. 

Read more about the FLoC here.

TURTLEDOVE / FLEDGE

The TURTLEDOVE proposal is more of a requirements outline, while FLEDGE is the technical, first iteration of a solution to meet the outlined requirements. The proposed browser functionality allows users to be assigned to interest groups based upon their interactions with an advertiser or their ad network. Ads could then be shown to that user based upon an interest group within which they are assigned. The bidding process and selection of ads to display all happens within the browser—a change from the traditional process of this happening in external ad servers. Information is then contained within the browser (and is not externally accessible) to preserve the privacy of the user while still displaying targeted advertising. This information includes data about interest groups the user is a member of plus the contextual information from the page where the ad is displayed.

Read more about TURTLEDOVE and FLEDGE here.

Conversion Measurement APIs

Beyond just ad targeting, third-party cookies are also relied upon to correlate user actions on external websites (i.e. ad clicks and impressions) with conversions on your website. This reporting enables campaign attribution reporting, campaign reach reporting, impression capping, and campaign optimization. To accomplish these use cases in a world without third-party cookies, Chrome will be introducing a series of purpose-built Application Programming Interfaces (APIs) for measurement. The two primary ones are the Event Conversion Measurement API and the Aggregate Measurement API. 

Event Conversion Measurement API

The Event Conversion Measurement API allows for ad impression information, otherwise known as ad clicks with a campaign ID, to be stored in the browser. When that same browser (user) then converts on your website, conversion information is also sent and stored within the browser. The browser then uses stored information to correlate the click with the conversion and sends conversion reports to a designated reporting location, allowing for campaign conversion reporting in a privacy-safe way.

Aggregate Measurement API

The Aggregate Measurement API will allow for information about ad impressions to be stored within the browser. The browser then aggregates encrypted impression information for that user and sends it to a secure location where it is further aggregated with impression information from other users. Once the amount of impression data for a given ad creative reaches a volume which insures the anonymity of users who have viewed each ad, aggregate impression reporting is then made available. This solution protects the privacy of each individual user while still enabling use cases like campaign impression reporting and impression capping.

Read more about Conversion Measurement APIs here.

Contact InfoTrust

Learn more about InfoTrust's analytics and consumer data governance services by reaching out to our partnerships team.

Author

  • Lucas Long

    Lucas Long is co-author of the Amazon best-selling book, Crawl, Walk, Run: Becoming a Privacy-Centric Marketing Organization. He is also the Director of Privacy Strategy at InfoTrust, working with global organizations at the intersection of digital strategy, privacy regulations, and technical data collection architecture. Through these efforts, Lucas helps companies understand their limitations for data enablement due to privacy challenges and design optimal ways to accomplish core use cases in a compliant manner.

    When not discussing the intricacies of GDPR and cookie laws with clients, Lucas enjoys traveling and exploring new cultures, one bite at a time. Based in Barcelona, he is also a presenter, featured at industry events organized by Google, the Digital Analytics Association, the American Marketing Association, and the Journal of Applied Marketing Analytics.

Facebook
Twitter
LinkedIn
Email
Originally Published: April 12, 2021

Subscribe To Our Newsletter

April 29, 2021
Originally published on April 12, 2021

Other Articles You Will Enjoy

Safeguarding Privacy: South Africa’s Protection of Personal Information Act (PoPIA)

Safeguarding Privacy: South Africa’s Protection of Personal Information Act (PoPIA)

South Africa’s Protection of Personal Information Act (PoPIA) empowers its citizens with enforceable rights over their personal information. The law establishes eight minimum requirements…

9-minute read
A South Asian First: Sri Lanka’s Personal Data Protection Act

A South Asian First: Sri Lanka’s Personal Data Protection Act

I know I covered India’s DPDPA first, but, as it turns out, Sri Lanka beat them to the punch. Sri Lanka’s Personal Data Protection…

6-minute read
AdTech DNA Simplifies the Complex for Global Advertisers

AdTech DNA Simplifies the Complex for Global Advertisers

As a global advertiser, knowing what is happening across your organization is an endeavor wrought with complexity.  Are your advertising technologies implemented correctly?  Do…

3-minute read
The Privacy Risk of AI: Automated Decision Making and Compliance Considerations

The Privacy Risk of AI: Automated Decision Making and Compliance Considerations

As third-party cookie deprecation is quickly approaching, many platforms are introducing AI capabilities promising greater utility with less data. Organizations can rely on features…

7-minute read
Get to Know India’s Landmark Privacy Legislation: Digital Personal Data Protection Act (DPDPA)

Get to Know India’s Landmark Privacy Legislation: Digital Personal Data Protection Act (DPDPA)

The origins of India’s Digital Personal Data Protection Act (DPDPA) began in 2012 when a report from a committee headed by a former judge…

5-minute read
Safeguarding Tomorrow: The Importance of Evaluating Compliance Risk Today

Safeguarding Tomorrow: The Importance of Evaluating Compliance Risk Today

It happens every day: marketing purchases a new platform with the promise of helping the organization meet and exceed business targets. When it comes…

7-minute read
Shaping Tomorrow: Emerging Data Privacy Trends for 2024

Shaping Tomorrow: Emerging Data Privacy Trends for 2024

Each year Data Privacy Day provides a necessary reminder of the importance of embedding privacy into all business‌ activities. The fact that it is…

11-minute read
HIPAA Legislation: What Impact Does This Have on Your Analytics Platforms?

HIPAA Legislation: What Impact Does This Have on Your Analytics Platforms?

If you are a healthcare organization operating in the United States, you are likely aware of the significant increase in the focus on the…

9-minute read
Lessons and Learnings from the Cookieless Now Summit London

Lessons and Learnings from the Cookieless Now Summit London

Today’s marketing and advertising environment can often feel like chaos. Google Chrome deprecating support for third-party cookies, although no true date for when. A…

12-minute read

Get Your Assessment

Thank you! We will be in touch with your results soon.
{{ field.placeholder }}
{{ option.name }}

Talk To Us

Talk To Us

Receive Book Updates

Fill out this form to receive email announcements about Crawl, Walk, Run: Advancing Analytics Maturity with Google Marketing Platform. This includes pre-sale dates, official publishing dates, and more.

Search InfoTrust

Leave Us A Review

Leave a review and let us know how we’re doing. Only actual clients, please.