Gnatcatcher issues

[Tim-Cowen]

Movement for an Open Web (“MOW”) is an action group founded to advocate for a competitive, open internet. Many members were involved in the Competition and Markets Authority (CMA) Online Platforms and Digital Advertising inquiry in 2020. MOW is the chief complainant in Google’s Privacy Sandbox case, and we initially applied to the CMA for interim measures to prevent Google’s proposed changes to the browser. Whistle-blower protections are recognised in law the world over and play a vital role in helping the authorities gather necessary evidence from key witnesses, whose identity must be protected to reduce the likelihood of retaliation. We note that the CMA’s Privacy Sandbox case team have agreed to protect the identity of our members.

We are submitting the following issue in the W3C forum at the request of the CMA and Google’s recommended procedure for filing issues with their Privacy Sandbox, according to section 12 of Google’s Commitments.

Google’s Gnatcatcher Proposal is designed to restrict from others the IP addresses Google’s Ad Systems will continue to benefit from.

Most recently, Google has extended this proposal to the Pixel 7 Android phone. [1]

There is also a substantive issue for rivals on how they can continue to access IP addresses for the business-facing functions of fraud prevention and content filtering. IP addresses can also be used to tailor advertisements to business customers, where multiple employees of the same organisation share the same business IP address. The IP Protection proposal on GitHub acknowledges IP address’s critical functional role in the web and states that they ‘will continue to be instrumental in routing traffic, preventing fraud and abuse, and performing other important functions for network operators and domains’. Our question is how will this work in practice?

In our view, Google's proposal without modification would self-preference its own business solutions, and hence it would be helpful to explore other options that allow for the innocuous and helpful data handling processes. One such method would be requesting ISPs to change IP consumer household addresses more often than business IP addresses by using a DHCP lease time configuration. Another would be the use Network Address Translation to combine more connections from an ISP under the same IP address thus reducing the IP addresses utility.

If Google does proceed with its Gnatcatcher proposal, we recommend a robust choice mechanism for consumers to be properly informed of the impact of their decision and ideally alternative choices available to them, rather than have such an option bundled into the browser/operating system by default. It would be helpful for Google to also address how the design they envisage will continue to enable a competitive market of business-facing solution providers to address the specific threats to businesses listed by the W3C Antifraud Community Group (https://github.com/antifraudcg/use-cases/blob/main/USE-CASES.md).

We also welcome responses from @spanicker, @JensenPaul, @bslassey, @miketaylr, or any other Google representatives in this forum.