September 8, 2026 · Arjun
The privacy plan the industry spent five years on has been cancelled
In October 2025 Google retired the Privacy Sandbox, shutting down Attribution
Reporting, Topics and Protected Audience across Chrome and Android. Third-party cookies remain,
with no removal timeline. An enormous amount of industry planning has been rendered moot.
How we got here
The sequence is worth setting out, because it is easy to misremember.
- July 2024 — Google announces it will not deprecate third-party cookies after
all, proposing instead a user choice prompt. - April 2025 — the choice prompt is abandoned too. Chrome’s existing controls
stay as they are. - October 2025 — Privacy Sandbox is retired, and the replacement APIs are shut
down.
So the identifier the industry was told to replace is still here, and the replacement is not.
The awkward conclusion
A large part of the industry treated privacy as a compliance schedule — a deadline to hit, a
migration to complete. When the deadline was cancelled, the work stopped. That reveals what the
work was for.
The regulatory direction, meanwhile, did not cancel itself. India’s Digital Personal Data
Protection Rules were notified on 14 November 2025 with an eighteen-month phased compliance
period, bringing standalone consent notices, breach notification and ninety-day response times to
data-subject requests. Whatever Chrome does, that is arriving.
What “privacy-first” has to mean now
Most privacy-forward positioning in advertising amounts to collecting the same data more
carefully — better consent flows, shorter retention, cleaner rooms. That is an improvement, and
it is still a strategy whose foundation is collection.
The alternative is not collecting. Our platforms process no viewer personal data
— not minimised, not anonymised, not collected — because the creative is composited locally before
broadcast and there is no ad call from a viewer’s device at all. No tag, no pixel, no cookie, no
device identifier. Targeting is contextual: whose audience, never which individuals.
We are precise about the wording because the precise claim is the defensible one. We are a
data fiduciary for the creators and publishers we pay — you cannot pay somebody otherwise. What
we do not hold is anything about the person who saw the advertisement.
The advantage of building it that way is that it does not depend on anyone’s product roadmap.
There is nothing for a browser vendor to cancel.