Sandbox Drama

This article is from the Marketecture weekly newsletter. If you like this kind of thing, subscribe.

In an earlier podcast I joked that the ad tech community’s feeling about the Privacy Sandbox was following the stages of grief, and had moved past denial (2022) and then from anger (2023), to bargaining (2024). But maybe there’s still a little residual anger left? Let’s ask the CRO of The Trade Desk, Jed Dederick what he thinks:

The IAB Tech Lab, on the other hand, appears to be firmly in bargaining mode. They published a 106 page report (pdf) detailing their concerns. We await Google’s response, which Alex Cone told us on the pod would be forthcoming this week. In the meantime we read the report, so you don’t have to.

The IAB took an expansive view at the Sandbox proposals, covering both purely technical issues and the way it fits more broadly into the marketplace. Here’s a good quote from the report:

The Privacy Sandbox initiative, while aimed at bolstering user privacy, introduces significant hurdles for the digital ad economy. It is more expansive than only a technical or ad operations change, as it necessitates widespread adjustments across technical, procedural, and strategic dimensions…

In the coverage from AdExchanger, the efficacy of the Sandbox was also put to task:

Of the 44 basic digital advertising use cases analyzed by the IAB Tech Lab’s Privacy Sandbox Task Force over the past few months, only a small handful remain feasible using the APIs in the Google Chrome Privacy Sandbox

Let’s break down the basic arguments from the IAB and from others and see what holds water. I’m using “Sandbox” as shorthand for Protected Audiences, and I’m paraphrasing both the arguments from the IAB and the responses from Google’s Alex Cone on this week’s pod (Spotify, Apple).

This doesn’t support all the our use cases. Yes, that’s kind of the point. The criticism of the current status quo is that the uncontrolled usage of 3P cookies has allowed proliferation of all kinds of bad stuff, and it should be expected that some of it won’t be feasible in the new world. One example that comes to mind for me is cross-device graphs.

There’s probably some minimal level of support without which the ecosystem wouldn’t be healthy, and would cause the entire Sandbox effort to fail. And there’s a maximal level of support which might be so complex that it would be impossible to support. The IAB report calls out multi-touch attribution, CPA models, and competitive exclusion as some examples of unsupported use cases. You could probably make arguments either way on whether these should be supported.

There’s also the counter argument that some of these use cases are actually supported by the Sandbox, but in non-obvious ways that still need to be documented. Video support is probably in this bucket. This brings up the next criticism…

The documentation is changing too often, is confusing, and is too technical. Amen, brother. On the other hand, its better than the existing GAM documentation, so there’s that.

The browser is not a counter-party. I’m paraphrasing, but the IAB report makes the point that there’s no one ultimately (financially) responsible when things go wrong. If the browser is the ad server and the exchange, where is the accountability?

This is a pretty interesting argument, but IMHO I wonder how this is different from what we’ve had to navigate through to reconcile discrepancies and cookie match rates, albeit on a much lower complexity scale. Ad tech has always been dependent on browser technology, why is this different?

Audits and accreditation. If you move measurement methodology into the browser how can you be sure it is accurate to the standards necessary for billing? Can the MRC audit a browser’s source code?

When I asked Alex about this issue he essentially said that since its all open source the audit shouldn’t be issue. Is this just a new way the media business needs to think about accreditation? I wonder if there’s been any backlash in the Apple ecosystem to SKAD-based CPA measurement used for billing.

Once again, we’ve had the magical threshold of 10% discrepancies as being OK for 20 years and that hasn’t bothered anyone. Why is this different?

Scalability / You’re running an auction in the browser. This has been the main argument against protected audiences since it was still called TURTLEDOVE. This API can potentially run thousands (!) of auctions in the browser on each page view, with each running arbitrary code.

The IAB brings up the additional question of the impact of resource constraints on ad outcomes, and how that’s auditable and discoverable. For non-techies let me give you a super stupid and unrealistic example — imagine if the auctions ran in alphabetical order so any bidder that started with a “Z” got timed out more often than bidders earlier in the alphabet.

Alex’s retort to this line of thinking is that this is no different really from the situation with pre-bid and RTB timeouts, where the parties can control the constraints they implement. I get this argument, but it also sort of lends itself to a dystopia where the lowest quality sites get even slower and more resource intensive.

There was also a subsequent discussion in X about who gets to set these timeouts, publishers or SSPs, and how there might be conflicts of interest here. I’ll leave this to the reader.

Governance. This is the big one and the space where we start getting the feels. If we, as an industry, widely adopt the Sandbox as the underlying structure of open web advertising we are implicitly giving the keys to the car to our ex who totaled our Kia in college and didn’t even pay for the damage. Or put another way, the future of advertising will be controlled by the world’s largest seller of advertising. A company that is currently being sued by the DOJ for abuses in governance. I’m sure he’ll change!

I asked Alex about two important subjects as it relates to governance.

First, is there a scenario where the Sandbox takes aim at HEMs like UID2? His answer was not entirely satisfying. He said that they work slowly, and that if something like HEMs were in their crosshairs, it would be a documented proposal well before anything would be implemented. OK great, so we’ll know well in advance that we’re totally screwed.

In reality, and as Alex pointed out, Google will be under the scrutiny of the UK’s CMA until at least 2028, so any change to HEMs would be heavily scrutinized.

Second, I pressed him on whether the involvement of the W3C was meaningful in any way considering the indifferent or hostility of the other browser companies. To this he gave me a surprising answer. He sees some movement among the browsers to reconcile or standardize reporting technology. That could mean a future where privacy-protecting marketing reporting works in the same or similar ways across, say, Apple, Android, and web environments. No promises, but a glimpse of hope.

…

Multi-party negotiations in the public spotlight are going to be very complicated. The IAB Tech Lab’s publication has made a great step forward by clearly articulating the concerns of a large constituency, and doing it with thoroughness. Google’s engagement and responsiveness is also really encouraging as we try to get to solutions.

The next two stages are depression (I’m there already), and then acceptance (2025?)

This article is from the Marketecture weekly newsletter. If you like this kind of thing, subscribe.