Competition aspects of Privacy Sandbox's Protected Audience API

This is an accompanying post about the contents of my LL.M. dissertation devoted to Protected Audience API. The initial post, considering privacy and data protection, is here. This post is devoted to aspects of competition, an important element of the debate around the phasing out of third-party cookies, and privacy-improving changes in online ad display.

It was simpler to talk about it in 2010, but now the picture is much more complex. It turns out that technology, standardisation, and privacy, in certain domains, may spark competition concerns. That’s the elephant in the room of Privacy Sandbox changes in web browsers. The territory is regulated. The trick here is that once a web browser has enough users and businesses are dependent on the web economy, any significant changes go under the radar of regulators. That is a fact of life.

Development of technology can advance the state of the art, improving the welfare of people. It can also decrease welfare, destroy competing businesses, and ultimately even erode user privacy in the long run. This is especially the case for transformative technologies on which rest entire industries. This is also, partly the case for web and web browsers, web/mobile publishers, as well as AdTech and ad providers. As I write in my dissertation:

“Limiting tracking and phasing out third-party cookies rejuvenates debates around the competition consequences of technological changes, including the effects of privacy-motivated evolution”.

This is obviously in the scope of EU Competition authorities and under the microscope of the UK’s Competitions and Markets Authority.

This also raises another issue: the balance between privacy and competition. Turning to the legal side, technological progress is directly embedded in competition aspects of the Treaty on the Functioning of the European Union:

Article 101

1. The following shall be prohibited as incompatible with the internal market: all agreements between undertakings, decisions by associations of undertakings and concerted practices which may affect trade between Member States and which have as their object or effect the prevention, restriction or distortion of competition within the internal market, and in particular those which:

(a) directly or indirectly fix purchase or selling prices or any other trading conditions;

(b) limit or control production, markets, technical development, or investment;

(c) share markets or sources of supply;

(d) apply dissimilar conditions to equivalent transactions with other trading parties, thereby placing them at a competitive disadvantage;

(e) make the conclusion of contracts subject to acceptance by the other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts.

2. Any agreements or decisions prohibited pursuant to this Article shall be automatically void.

3. The provisions of paragraph 1 may, however, be declared inapplicable in the case of:

- any agreement or category of agreements between undertakings,

- any decision or category of decisions by associations of undertakings,

- any concerted practice or category of concerted practices,

which contributes to improving the production or distribution of goods or to promoting technical or economic progress, while allowing consumers a fair share of the resulting benefit, and which does not:

(a) impose on the undertakings concerned restrictions which are not indispensable to the attainment of these objectives;

(b) afford such undertakings the possibility of eliminating competition in respect of a substantial part of the products in question.

Privacy improvements can count as technological progress. This parameter may be (and is) used in competition investigations. Furthermore, Data Protection Authorities are aware of the links between privacy and competition. For example, the European Data Protection Supervisor has studied these aspects since 2014 and has a lot to say on the topic.

To be in line with competition, a standard should preferably be open. This is the case with Protected Audience API. Its development happens (or so it was) in the open, as measured by the progress in the W3C/GitHub fora. It was/is scrutinised by a respected competition authority, the UK Competition and Markets Authority, which effectively became the world regulator of Privacy Sandbox, at least competition-wise. There was (to be) also an involvement of the UK DPA, Information Commissioner’s Office, though this body was much less vocal (actually, silent) in the debate. If its silence is made for a good reason, I hope that my work will help any data protection regulators out there. But it is also an important consideration for those regulators dealing with competition. Since privacy is a parameter to be considered. Admittedly, in my analysis, I could not expand on discussing competition (due to the length limit), but this topic cannot be lost from sight, and it will remain valid in the next few years.

This story isn’t over, though I offer my work as the lantern. And it is an important one. When novel technologies are introduced, it often happens that they are not appreciated or weighed properly. For example, people formed by previous setups try to reason about new proposals in ways shaped by old solutions or approaches. For example, since a lot of discussion over the previous 15 years revolved around heavy personal data processing and tracking, some analysts may be tempted to reason through the known lens about completely new concepts. But as I explain in my dissertation, Protected Audience API may be used in ways not resorting to tracking, and this warrants novel thinking. In the same way, direct comparison to third-party cookies or other tracking methods (be that based on personal data, or other identifiers) may result in misguided assessments.

In other words, the next few years will warrant novel ways of thinking, and paradigm shifts. This is not to say that all the previous challenges are magically solved or closed. The landscape is simply different. Incidentally, we find ourselves in times when other potential changes are occurring, for example, the vision of dynamic, generative/AI content. This means that, immediately, two novel concepts must be understood separately, and also together. Fascinating times ahead.

Find the full content of my LL.M. dissertation here.

Lukasz Olejnik (me@lukaszolejnik.com)