Google’s ad-privacy changes fall short, UK regulator says in internal documents

The U.K. privacy regulator says Google’s proposed replacements for cookies need to do more to protect consumer privacy, according to internal documents reviewed by The Wall Street Journal.

Google’s proposed technology, dubbed Privacy Sandbox, leaves gaps that can be exploited to undermine privacy and identify users who should be kept anonymous, the Information Commissioner’s Office wrote in a draft report. Based on what the ICO called systemic industry noncompliance, it is likely companies will use the tech to continue tracking users across different sites, the ICO said.

The ICO is both trying to get Google to make changes and sharing its concerns with the Competition and Markets Authority, the U.K.’s competition regulator, which is overseeing Google’s global efforts to get rid of cookies in its dominant Chrome browser.

The draft isn’t final, and the ICO is expected to release its report around the end of April. The CMA has promised it will consider the privacy regulator’s recommendations as it evaluates Google’s plans.

The pushback is a significant last-minute obstacle as Google, a division of parent company Alphabet, tries to secure the U.K.’s blessing to go ahead with its plans within the next few months. Google said it will apply its agreement with the CMA globally.

Google is rolling out changes to how companies use cookies, technology that logs web users’ activity across websites so advertisers can target them with relevant ads in its Chrome browser, and plans to complete this by year’s end.

The CMA won’t let Google block cookies until it deems the replacement technologies to be acceptable. If the CMA requires Google to alter its technologies in light of the ICO’s concerns, it may delay Google’s timeline for deprecating cookies to allow time to overhaul the Privacy Sandbox technologies.

“Privacy Sandbox technologies are designed to deliver meaningful privacy improvements and provide the industry with privacy-preserving alternatives to cross-site tracking," a Google spokesman said. He added that the company is working closely with the ICO and other regulators.

A spokeswoman for the ICO declined to comment. A spokesman for the CMA declined to comment.

Others have criticized Google’s privacy plan for not being private enough. The Electronic Frontier Foundation, a nonprofit privacy organization, urged users to opt out of letting Google’s new proposed tech track them when they use Chrome.

“Even if it’s better than third-party cookies, the Privacy Sandbox is still tracking. It’s just done by the company that makes your browser instead of the company that runs the ads," said Thorin Klosowski, a security and privacy activist at the foundation.

In response to the EFF’s concerns, the Google spokesman pointed to the company’s statement saying Privacy Sandbox will deliver meaningful privacy improvements.

Google’s new solutions will rewrite the rules for an industry where it is the largest player. The company brought in $238 billion in ad revenue last year and has about 28.1% of the global online-ad market, according to research firm Emarketer.

Blocking third-party cookies could mean billions of web users see fewer ads that closely match their online-browsing habits. With cookies, an auto brand can target someone reading articles on a news outlet’s website after that person clicked a competitor’s ad on another site.

Google’s Privacy Sandbox includes a suite of replacement technologies to help advertisers continue to target and measure ads without cookies.

Ad-tech companies say the privacy overhauls go too far and starve them of data. Getting rid of cookies will break the way digital ads have been sold for well over a decade, and Google’s plan doesn’t replace all the ways the ad industry uses cookies, ad-tech trade group IAB Tech Lab said in a February report.

Google has said the IAB Tech Lab report paints an inaccurate picture. Google said the former cookie functions that weren’t supported will be degraded on purpose to protect privacy.

Ad-industry critics say Google’s search engine and YouTube video platform stand to benefit from the elimination of cookies because they don’t rely as heavily on them. And they say Google’s plan to hold ad auctions in the Chrome browser itself will make Google a gatekeeper.

Google has promised not to give preferential treatment to its own products as part of its agreement with the CMA.

Ad-industry stakeholders have been testing the Privacy Sandbox technologies since January, when Google began a limited test that restricted cookies for 1% of Chrome users. Google offered some ad-tech companies a grant of up to $5 million to cover their costs to test the Privacy Sandbox technologies.

PubMatic, which received grant money to test Google’s tools, and other ad-tech companies have raised issues with Google’s plans to the CMA through the industry body Prebid.

“There are significant gaps that remain in Privacy Sandbox," said Andrew Baron, senior vice president at PubMatic. “The Sandbox today should not go forward as-is."

While some loopholes remain, ad-tech executives said Google’s cookie alternatives largely improved user privacy from the status quo.

“There wouldn’t be such concern in the market if this were not the case," said Andrew Pascoe, vice president of data science engineering at ad-tech company NextRoll, which received a grant from Google. The company’s cookie alternatives make it more difficult to track users, though not impossible, he added.

Write to Patience Haggin at patience.haggin@wsj.com and Miles Kruppa at miles.kruppa@wsj.com