The Competition and Markets Authority (CMA) released Google from its commitments and closed the four-year competition investigation, as a result of Google abandoning its plans to remove third-party cookies from its Chrome browser. 

Cookies can track users' internet browsing behaviour and are often used for the purposes of targeting and delivering advertising to users. In 2019, Google announced its "Privacy Sandbox" initiative and plan to remove "third-party" cookies (i.e. cookies set by a domain other than the one the user is visiting) from its Chrome browser, supposedly in the interests of its users' privacy.

In January 2021, the CMA opened an investigation into Google's proposals, suspecting that they infringed the UK competition law prohibition on abuse of a dominant position. The investigation led the CMA to form concerns that, if Google's proposals were implemented without sufficient regulatory scrutiny and oversight, Google's proposed changes could allow it to:

1. Distort competition in the markets for the supply of ad inventory and the supply of ad tech services by restricting the functionalities associated with user tracking for third parties, while retaining this functionality for Google;
2. Self-preference its own ad inventory and ad tech services by transferring key functionalities to Chrome; and
3. Deny Chrome users an effective choice in terms of whether and how their personal data is used for the purposes of targeting and delivering advertising to them.

Google addressed these concerns by agreeing to give the CMA binding commitments regarding its development of Privacy Sandbox. These included commitments to:

1. Limit the use of data in its own advertising business;
2. Refrain from discriminating against rivals of its own advertising business; and
3. Involve the CMA, the Information Commissioner and affected parties (including advertisers, publishers and ad tech providers) in the design, development and implementation of Privacy Sandbox.

What has changed now?

In July 2024, Google announced that, instead of removing third-party cookies from Chrome, it would introduce a new prompt giving Chrome users a choice of whether to maintain or restrict third- party cookies. The CMA considered these changes, including seeking views from the industry, but found that competition concerns remained.

In April 2025, Google went further and announced that it would not roll out a standalone user consent prompt for third-party cookies or deprecate third party cookies. Following this announcement, Google requested that its commitments be released.

In June 2025, the CMA announced its provisional view to release the commitments as its initial concerns no longer applied. The CMA held a public consultation on its provisional view, which closed on 4 July.

Last week, the CMA reached its final decision, concluding that it now had reasonable grounds for believing that its competition concerns no longer apply, and that releasing the commitments was therefore appropriate and proportionate.

Key learnings

Despite the CMA closing the case, there are some important lessons for future cases:

1. CMA's hands-on approach: The design of the commitments built in ongoing processes for the CMA and the Information Commissioner to review Google's proposals throughout their design. This demonstrates that the CMA considers it necessary to have continuing oversight when regulating tech companies to ensure that their conduct does not distort competition, reflecting the fast-moving and complex nature of tech markets. The CMA is likely to continue adopting this hands-on approach using its new powers under the new digital markets regulatory regime, which came into force earlier this year.
2. CMA takes proportionality seriously: Some stakeholders urged the CMA to retain the commitments as a safeguard in case Google’s position on third party cookies shift. The CMA considered this possibility but concluded that, since Google does not currently plan to reverse its decision or restrict access to cookies in other ways, it would be disproportionate to maintain the compliance and monitoring burden.
3. Don't assume commitments can never be released or changed: Although it is normally an uphill battle for companies to change or release commitments after they have agreed to them, the latest developments show that it is possible when the facts change materially. 
4. Consider sharing feedback with the CMA and other regulators: Throughout its investigation, the commitments and the latest proposal to release the commitments, the CMA has been keen to seek the views of industry participants. Regulators pay close attention to the feedback they receive, and companies should always consider ways to get their views across.