Google retires most of Privacy Sandbox, and what that means for your measurement plan
On October 17 Google said it will retire Topics, Protected Audience, Attribution Reporting and more. Here is what to stop planning for and what to keep building.
On October 17, Google announced it is retiring most of its Privacy Sandbox technologies, citing ecosystem feedback and low adoption. The post gave no shutdown dates. It said retirements will follow Chrome and Android deprecation processes, with timelines on Google's developer status page. If you spent 2023 and 2024 preparing for a cookieless Chrome, this is the moment to check which of that work still pays off.
What is retired and what stays
Google's list of technologies being retired is:
- Attribution Reporting API (Chrome and Android)
- Topics (Chrome and Android)
- Protected Audience (Chrome and Android)
- Protected App Signals and SDK Runtime (Android)
- IP Protection, On-Device Personalization, Private Aggregation (including Shared Storage), Related Website Sets and SelectURL
Three items continue: CHIPS (partitioned cookies) and FedCM, which Google says have seen broad adoption including support from other browsers, and Private State Tokens, which Google says it will keep while exploring more approaches to fraud and abuse. On attribution, Google said marketers and publishers emphasized scaled measurement, and that it will keep working on a proposed interoperable Attribution standard through the W3C's Private Advertising Technology Working Group. That is a proposal in a standards process, not a product you can use.
This follows the April decision to keep Chrome's current approach to third-party cookie choice rather than add a new standalone prompt. In practice, third-party cookies in Chrome remain governed by user settings, and the Sandbox APIs that were meant to replace them are going away.
What to stop planning for
If any roadmap item depends on one of the retired APIs, remove or rescope it. That includes interest-based targeting through Topics, on-device remarketing through Protected Audience, and browser-level aggregate attribution through the Attribution Reporting API. Check vendor contracts and tools too. Some ad tech vendors built products on these APIs, and you should ask how they will serve you once the APIs are removed. Android teams should look at the same list from the app side, since Protected App Signals and SDK Runtime are on it.
Do not rush to rip anything out, though. With no dates given, current integrations will keep functioning until the deprecation processes run. Use that time to migrate calmly.
What to keep building
The work that was always sensible is now the plan, not a hedge:
- First-party data. Collect consented identifiers such as logged-in IDs and hashed emails where you have them, and be clear about what users agreed to.
- Server-side event delivery. Send conversion events to Meta, Google and your MMP from your server, so measurement does not rest on a browser setting.
- Consent signals. In regions that require consent, make sure your consent state is passed to every tool. Cutting corners here leaves you with less usable data and more legal exposure.
- Incrementality tests and aggregate modeling. If no browser-level standard is coming soon, the ways to judge channels are experiments and models you run yourself.
- Contextual and creative targeting. Relevance carried by the ad and the placement does not depend on a user identifier.
Questions for your vendors this month
Send each ad tech and measurement vendor the same three questions. Does any part of your product depend on a retired API? If so, what replaces it and when? And what changes in the data you receive, or the price you pay, when the replacement ships? Vague answers are an answer. Put the replies in one document so that a renewal decision in the spring is based on what they said, not on what you remember.
What the testing showed, and how to read it
PPC Land's coverage points to third-party testing in which remarketing was hit hardest: advertiser spend fell by 42 percent, 60 percent and 67 percent across three testers, against a 14 percent drop Google reported on its own DV360 platform. Those are results of the Sandbox testing as reported, from parties with different interests, so use them as a reminder that the tools never matched the cookie for remarketing, not as a benchmark for your account.
For app marketers the immediate effect is limited. Most of your measurement runs through SDKs, platform APIs and Apple and Google attribution frameworks rather than Chrome. The web-to-app part of your funnel is where this matters, since that is where browser behavior shapes what you can see.
The practical takeaway: audit your plans for any dependency on the retired list, rescope what you find, and put the freed effort into server-side events and an incrementality test.