Android Privacy Sandbox
The Android Privacy Sandbox is Google’s initiative to build a mobile ecosystem that preserves user privacy while allowing advertisers and developers to provide personalized experiences.
What is Android Privacy Sandbox?
The Android Privacy Sandbox is Google’s proposal for managing privacy-centric advertising, measurement, and attribution on mobile devices.
This is a multi-year, open-source project aimed at pushing privacy standards forward while minimizing cross-app and cross-site tracking. The sandbox includes developer programs, design proposals, integration guides, API references, and more.
Previously, Google introduced the Chrome Privacy Sandbox, which aimed to eliminate third-party cookies and minimize the use of Google Advertising ID (GAID). Android Privacy Sandbox officially marks the end of GAID, and thus the end of user-level insights on Android as well. GAID was critical for marketers, helping with attribution, personalization, remarketing, and third-party data sharing.
What are the goals of the privacy sandbox?
In Google’s eyes, Apple’s “blunt approach” to privacy didn’t work: they believe forcing advertisers and developers to find an alternative on their own was not sustainable. Instead, Google’s strategy is to collaborate with them to provide an alternative path forward for everyone.
Of course, this isn’t entirely altruistically motivated, as Google is financially incentivized to innovate their ad business, which accounts for 78% of their revenue.
Keep information private
From major data breaches to increasing distrust of social media platforms, consumers have become increasingly concerned about online privacy over the past few years. The trend was accelerated by Apple’s bold move: introducing the App Tracking Transparency framework, while simultaneously shifting their marketing messaging to “Privacy. That’s iPhone.”
Google’s goal is similar – stay ahead of the curve and ensure they provide private solutions for their customers.
Fund online publishers and developers
As discussed above, the goal is to share user data with third parties without compromising security and privacy. This now includes the removal of advertising ID. Google will need to preserve and build on their $238 billion ad business by slowly deprecating cookies and GAID, while providing new tech solutions to replace them.
Collaborate to set privacy standards
Google aims to collaborate with publishers, developers, advertisers, and even legislators, putting the company in a strong position to lead discussions on navigating privacy concerns.
How does it work?
A good place to start with the sandbox is knowing that there are lots of parallels with Apple’s IDFA opt-in requirements. Google states that they’ll be phasing out the Google Advertising ID (GAID), while offering new tools to continue delivering personalized ads on free content. Here are the main components under the hood.
SDK runtime
Android uses app sandboxing, which helps the integration of third-party code via SDKs, while also setting guardrails for them. The SDKs are hosted within the sandbox, which also runs the potential risk of hosting (and, more importantly, sharing) undisclosed user data. SDK Runtime enables stronger guardrails, including a modified execution environment and limited permissions and data access rights for SDKs.
Attribution API
Most mobile ad campaigns use Advertising ID to identify audiences across multiple channels and devices. The Attribution API registers attribution sources through certain triggers on an app or website. It then matches the triggers to the sources, and aggregates the data.
The API has some limitations, including the limited number of bits available for event-level reports. There are also rate limits for available conversion triggers, and the number of ad techs per attribution source.
Topics APIs
The Topics API aims to allow advertisers to serve ads based on a user’s interests, inferred from their app usage. The topic is observed by a caller, which is an app or third-party SDK within an app. The number of topics is limited to 469, to reduce the size of fingerprinting, and purposely excludes sensitive categories like religion, race, or sexual orientation.
Protected Audience (previously FLEDGE)
The Protected Audience API allows advertisers to create custom audiences based on app behavior, to enable remarketing and customer audience targeting without using private information.
In simple terms:
How does Android Privacy Sandbox differ from Apple’s ATT?
While the goals of Apple’s ATT framework for iOS devices and Android Privacy Sandbox are the same, there are some major differences in execution.
The introduction of SKAdNetwork was disruptive. And to many, the Android Privacy Sandbox will be less so, because it provides a suite of tools to make the transition smoother for stakeholders.
Although Google is moving away from GAID, Google Referrer isn’t going anywhere (in the foreseeable future at least). This unique URL passes from the Play Store all the way to the conversion, giving advertisers insights into the user journey. iOS doesn’t have this capability at all.
What are the potential challenges?
Changing times come with their own challenges. Here are a few you may encounter when working with the privacy sandbox.
Technical issues in adopting existing measurement strategies
The first and biggest challenge is the technical implementation of the privacy sandbox itself. To get started, you need to complete the enrollment process, set up your development environment, configure permissions, and set up devices to use the Privacy Sandbox on Android. Since the program is still in beta, Google is slowly rolling out beta APIs which will have technical hiccups along the way (and won’t be available to everyone immediately).
Limited data
Yes, the golden age (for advertisers) of unlimited user data is long gone. Anything in comparison to the wild wild west of mobile advertising will feel like a downgrade in terms of data access. As mentioned in a previous section, increased privacy measures mean limited datasets, forcing advertisers to think more creatively about how they want to target new audiences within Google’s guardrails.
Data accuracy
The cost of privacy is weaker data signals. While we’ll be able to achieve granular and rich data, you’ll have to trade immediacy for accuracy. If you want quick reporting, there’s a higher chance the data will not be as conclusive, to protect the privacy of those few users. But reports with a longer callback will prove to be more accurate.
What are the future trends for Android and privacy?
Google highlights that this is a multi-year effort for a reason. Introducing massive changes to a multi-billion dollar industry requires time, and more importantly, lots of testing. Here are a few trends that we believe will take shape in the near future.
First-party data + AI
Collecting first-party data around in-app behavior is crucial for advertisers to offer tailored messaging and creatives. Today, AI tools supercharge first-party data by reaching new audiences similar to yours, predicting audience segments based on user-level behavior, and segment audiences based on behavioral patterns that may be missed by the human eye. This level of granularity will become increasingly difficult to achieve as we move to a privacy-first ecosystem.
Deep linking and referrals
Deep linking will become more crucial for advertisers and developers to track in-app behavior while providing a seamless user experience. Deep links are links that direct the user to a specific page on a mobile site or app, without leaving the app altogether. This ensures users remain within your app’s ecosystem, and provides rich data that yields granular insights for your campaigns.
How to prepare for Android Privacy Sandbox
While these changes may sound daunting, there’s a lot you can do to make the transition as smooth as possible. GAID isn’t going to disappear overnight, but taking proactive measures to maximize your campaigns in a privacy-centric world will save you a ton of headache down the road. Here are a few ways to get started.
Review your techstack
This change will impact your entire data ecosystem. Your MMP, CRM, and ad agencies will enter a trial by fire. There will undoubtedly be a learning curve to identify the most effective ways to advertise. Start by taking stock of your current techstack, and getting familiar with the new APIs within the sandbox.
Enroll and register for the beta program, and set up your devices
Enroll in the Privacy Sandbox program to get started. The developer enrollment program verifies each app that calls APIs, adding a protective layer in a controlled environment to minimize the misuse of data. Be sure to read the guidelines and understand that your enrollment will be made public.
Identify use cases and design them within the framework of Sandbox to test if they work
Since the privacy sandbox is still in its early stages without any clear timelines, a good place to start is by identifying your unique use cases. Then visit Google’s resource to see how other apps have solved them.
Speak to your MMP about measurement solutions
To prepare for the inevitable deprecation of GAID, your MMP should already be building solutions and testing the APIs to help solve for any data gaps — it’s definitely a top priority for us here at AppsFlyer. Working with your MMP ahead of time will help you make the transition gradual, avoiding a last-minute bombshell.
Key takeaways
- The Android Privacy Sandbox is Google’s initiative to build a mobile ecosystem that preserves user privacy while allowing advertisers and developers to provide personalized experiences.
- The three main goals are to keep information private, fund online publishers and developers, and collaborate to set privacy standards.
- The simplified changes are as follows: targeting is becoming Topics, measurement is becoming Attribution API, and remarketing is becoming Protected Audiences API.
- Potential challenges in implementing the sandbox include technical implementation, limited data, and data accuracy.
- Android Privacy Sandbox is a multi-year project that will be shaped by trends like first-party data and AI, and increasing use of deep linking.
- There will be a transition period, but it’s a good idea to get ahead now by reviewing your techstack, enrolling for the beta program, and getting your devices set up. You should also identify your own use cases and discuss the changes with your MMP.
