Android Privacy Sandbox is a proposal, so prepare without rebuilding
Google has announced a multi-year Privacy Sandbox for Android with no firm launch date for ad tools. Here is what to do now, and what to leave alone until real APIs ship.
On February 16, Google announced that it will bring the Privacy Sandbox to Android. The pitch is a set of privacy-preserving APIs that support advertising without cross-app identifiers such as the Android advertising ID, and that limit what is shared with third parties. It is a multi-year effort, and what exists today is design proposals, not production tools.
What Google has actually committed to
From Google's announcement and the coverage of it, the components under discussion are:
- Topics, which would show ads based on a user's recent interests.
- FLEDGE, an on-device mechanism for choosing ads for remarketing-style use cases.
- Attribution reporting, a way to measure campaign results without a persistent identifier.
- SDK Runtime, which would isolate ad SDKs from the host app so they cannot covertly track users.
- Future work on limiting the signals that can be used to fingerprint a device.
The timeline matters more than the feature list. Google says developer previews will run during 2022, a beta with an SDK and system images is planned by the end of the year, and scaled testing follows in 2023. Google also says the existing advertising ID will be supported for at least two years, with substantial notice before any change.
Read the two-year commitment carefully
"At least two years" is a floor for the advertising ID, not a countdown to its removal. Google has not announced that it will remove it, and the announcement leaves room for the design to change based on feedback. Plan for the ID continuing to work through 2023 at minimum, and plan for the possibility that it becomes more restricted afterward. Don't plan for a specific date, because there isn't one.
This is also different from what Apple did. Apple's App Tracking Transparency arrived as a mandatory prompt with a fixed release. Google is describing a voluntary, phased approach with public design discussion first. That gives app marketers something iOS never offered: time.
What to do now
Spend the time on groundwork that pays off whichever way the APIs end up.
- Inventory your SDKs. List every ad, attribution and analytics SDK in your Android app, what each one collects, and whether it reads the advertising ID. SDK Runtime would change how third-party SDKs operate, so you need to know which ones you depend on before you can ask them questions.
- Ask your vendors for their plans. Your attribution provider and ad networks will have views on how they will adopt the proposals. Put the question in writing and keep the answers. Vendors that have no position yet are telling you something too.
- Define your events once. Attribution reporting may well limit how many conversion events and how much detail you can get back. A short, ranked list of the events that actually drive revenue is useful in every scenario, including the one where nothing changes.
- Build a first-party baseline. Make sure installs, signups and purchases are logged in your own backend with consistent timestamps and source fields. When platform reporting changes, this is what you compare against.
- Keep creative and audience strategy portable. Interest-based Topics, if they ship, will be coarse. Campaigns that depend on tight creative-to-audience fit will need the creative to carry more of the weight.
What to leave alone
Do not rebuild your measurement stack around an API that has no beta yet. The proposals are explicitly open to feedback and may change. Do not cut Android budgets in anticipation of lost signal either; the advertising ID still works and Google has said it will keep supporting it.
It is reasonable to watch the developer previews as they appear. If your app has a technical team, assign someone to test the first available builds, because early familiarity will be worth more than early opinions.
A note on credibility
Coverage of the announcement has been mixed. Some outlets compared it to Apple's tracking prompt; others noted that the approach is voluntary and questioned how much privacy protection it would deliver in practice. Both views are fair at this stage. You don't have to decide who is right to do the preparation above.
The takeaway: this is a two-year planning horizon, not a deadline. Get your SDK list, event definitions and first-party baseline in order now, and revisit when a beta is available to test.