The Rise and Fall of Google's Privacy Sandbox
Source: arXiv:2607.00693 · Published 2026-07-01 · By Rachid Youssef Grib, Alberto Verna, Nikhil Jha, Martino Trevisan, Marco Mellia
TL;DR
This work presents the first large-scale, longitudinal, and consent-aware measurement study of Google's Privacy Sandbox deployment on the Web during the final six months before Google announced retiring most of its Privacy Sandbox APIs in October 2025. The Privacy Sandbox was Google's ambitious attempt to replace privacy-invasive cross-site tracking techniques like third-party cookies with browser-mediated APIs designed to enable interest-based advertising while preserving user privacy. Using a custom Chrome-based crawler instrumented to detect runtime Privacy Sandbox API calls and model user consent states, the authors crawl the top 10,000 websites weekly for over six months, capturing API usage before consent, after consent, and after consent denial.
The study finds that adoption of most Privacy Sandbox APIs stagnated and declined well before Google's retirement announcement. Usage was highly concentrated in a small number of actors and sites. The only API seeing broad deployment was the CHIPS API (Cookies Having Independent Partitioned State), used by about 50% of sites by early 2026, yet classical unpartitioned third-party cookies remained prevalent on 75% of sites. Even APIs Google plans to retain show little growth. The study also uncovers questionable API invocations occurring without user consent, indicating weak enforcement by consent management platforms. Overall, the Google Privacy Sandbox initiative failed to gain Internet-scale deployment, leaving unresolved the challenge of privacy-preserving interest-based advertising and highlighting the difficulty of orchestrating complex privacy-centric browser redesigns within an entrenched advertising ecosystem.
This research thus provides a critical longitudinal snapshot of a major industry privacy initiative’s rise and fall, emphasizing practical deployment challenges, ecosystem fragmentation, and consent issues that are highly relevant for future privacy-preserving advertising solutions.
Key findings
- Only CHIPS (partitioned cookies) achieved widespread deployment, used by ~50% of sites by January 2026.
- 75% of websites still use classical persistent unpartitioned third-party cookies despite Privacy Sandbox efforts.
- Majority of Privacy Sandbox APIs were used by only a handful of actors, with steadily declining activity during the study period.
- Even APIs Google plans to retain (FedCM, Private State Tokens, Fenced Frames) show no signs of growth or ecosystem momentum.
- Consent-inconsistent API invocations were frequently observed, with APIs being called before consent or after explicit consent denial.
- During After-Accept visits, about 44% of site visits successfully triggered acceptance flows; After-Deny consent denial was achieved in about 28% of cases.
- The Privacy Sandbox ecosystem contraction preceded the official Google announcement to retire most APIs in October 2025.
- API adoption was highly concentrated on a small number of third-party actors; many enrolled developers never invoked APIs at scale.
Threat model
The relevant adversary in this work is the Web ecosystem actors—advertisers, trackers, and analytics providers—attempting to perform interest-based advertising and cross-site tracking despite user privacy intentions and consent restrictions. Attackers may include both legitimate third parties enrolled in Privacy Sandbox APIs and misbehaving scripts invoking APIs before consent or ignoring denials. The study assumes the browser enforces API restrictions and consent management platforms gate API execution, but observes potential lapses in this enforcement. The work models real users’ consent interactions but does not consider fully adversarial attackers subverting browser controls or infrastructure-level attacks.
Methodology — deep read
The authors designed a custom active measurement framework using Google Chrome 138 explicitly enabling all Privacy Sandbox features. They targeted the top-10,000 websites by Tranco ranking, refreshed weekly, crawling sites once per week over a six-month period from June 23, 2025 to January 5, 2026. Each site was visited up to four times per crawl iteration to simulate different user consent states:
- Before-Accept: fresh browser profile, no user interaction, measuring API calls occurring before user consent.
- After-Accept: the crawler attempts to find and click "Accept" buttons on consent banners using a curated multi-language keyword list; captures legitimate post-consent API usage.
- Before-Deny and After-Deny: similar interaction flow to explicitly deny consent; records API usage inconsistent with explicit denial.
Instrumentation combined Chrome DevTools Protocol (CDP) native event subscriptions for APIs emitting CDP events (Attribution Reporting, FedCM, Fenced Frames) and JavaScript API function wrappers injected at page and iframe load time for other APIs (Topics, Protected Audience, Shared Storage etc.). Wrappers logged calls with function name, parameters, return values, caller origin, and frame domain, forwarding data via CDP bindings to preserve page semantics.
The crawler discovered all iframes using the CDP auto-attach feature with waitForDebuggerOnStart to inject wrappers before script execution, avoiding race conditions. Cookies set during visits were logged with full metadata including domain and partitioning.
To model realistic user consent, the crawler identified consent banners on sites and interacted with them via keyword matching, supporting multi-step consent denial flows and paywalled denial options, though some complexity constrained denial success (~28%).
The dataset includes 7,400–8,400 successful visits per week per consent state, with ~44% acceptance success and ~28% denial success rates. The authors track for each website: all third-party requests, Privacy Sandbox API calls, cookies, and contextual consent state.
Analysis aggregated API usage percentages across all successful visits per week and consent category, studied longitudinal adoption trends across 10 APIs, and identified the major third-party actors driving adoption concentration. Detailed manual inspection and keyword lists for rejecting cookies enhanced consent state accuracy. The authors released instrumented crawler code and collected datasets.
Overall, this approach provides high-fidelity, consent-aware, large-scale active measurements capturing both intended and questionable Privacy Sandbox API usage and contextualizes adoption dynamics over extended time prior to the planned retirement in July 2026.
Technical innovations
- Consent-aware active crawling methodology modeling Before-Accept, After-Accept, and After-Deny states explicitly to discern legitimate versus consent-inconsistent Privacy Sandbox API usage.
- Custom dual instrumentation combining Chrome DevTools Protocol event subscriptions with JavaScript function wrappers injected at page and iframe initiation to comprehensively monitor all Privacy Sandbox API invocations without disrupting page behavior.
- Use of CDP auto-attach with waitForDebuggerOnStart to inject API call wrappers into iframes prior to script execution, ensuring no invocations are missed due to race conditions.
- Fine-grained tracking of calling script origin, execution frame, input parameters, and return values at runtime for Privacy Sandbox APIs, enabling detailed ecosystem actor-level adoption analysis.
Datasets
- Top-10,000 Tranco-ranked websites — ~6 months weekly crawl — custom instrumented Chrome crawler (non-public)
- Consent interaction scripts and keyword lists — English, French, German, Italian, Spanish — internal manual curation
Baselines vs proposed
- Topics API adoption peaked around 30-40% of websites during testing phases (prior studies) vs stagnant or declining usage here pre-retirement
- Protected Audience API usage peaked at ~25% (prior work) vs steady decline and concentration on Google-controlled domains reported in this study
- Prior measurements reported limited CHIPS adoption early (McQuistin et al.) vs this study’s report of 50% site adoption by January 2026
- Third-party cookies usage remains high at 75% of sites vs Privacy Sandbox pivot away, showing slow displacement
Limitations
- Automated consent denial coverage limited (~28%) due to complex or paywalled denial flows, potentially underestimating consent-inconsistent invocations.
- Active crawling may trigger bot-detection mitigation, CAPTCHAs, or cloaking that alter script execution and third-party loads, introducing noise or bias.
- Static crawl of landing pages only; excludes deeper site navigation which may have different API invocations or consent states.
- Browser version fixed to Chrome 138 to avoid update confounds but may lag behind latest ecosystem changes.
- Non-public dataset limits external reproducibility despite code release.
- Analysis focuses on top 10,000 ranked sites; may not generalize to long-tail or specialized domains.
Open questions / follow-ons
- How to design and deploy privacy-preserving advertising standards that achieve large-scale adoption beyond isolated early adopters?
- What mechanisms can enforce consent compliance reliably, preventing pre-consent or post-denial API invocations observed here?
- Can alternative models beyond browser-mediated APIs overcome the entrenched advertising ecosystem dependencies on third-party cookies?
- How do ecosystem actors’ incentives and business models impact the practical viability of privacy-centric advertising architectures?
Why it matters for bot defense
This study reveals the deep challenges faced by large-scale browser-enforced privacy initiatives like Privacy Sandbox, highlighting patchy ecosystem adoption and weak enforcement of consent states. For bot-defense and CAPTCHA practitioners, it underscores how privacy-preserving token mechanisms (e.g., Private State Tokens, a replacement CAPTCHA approach) struggled to gain traction alongside traditional techniques relying on cookies and fingerprinting. The findings suggest caution in assuming privacy sandbox or token-based anti-fraud methods will rapidly achieve widespread deployment or robust compliance. Measurement approaches that integrate consent-awareness, like those here, can help detect questionable tracking or token issuance even in ostensibly privacy-forward environments. These insights help contextualize the practical security guarantees and adoption realities of emerging browser-mediated privacy and anti-bot APIs.
Cite
@article{arxiv2607_00693,
title={ The Rise and Fall of Google's Privacy Sandbox },
author={ Rachid Youssef Grib and Alberto Verna and Nikhil Jha and Martino Trevisan and Marco Mellia },
journal={arXiv preprint arXiv:2607.00693},
year={ 2026 },
url={https://arxiv.org/abs/2607.00693}
}