Privacy Sandbox APIs and Their Effect on Agent Data Collection

Privacy Sandbox APIs moved sensitive data processing into the browser, changing what automated systems could collect, attribute, and act on. Their retirement exposes the limit of that approach. Rules enforced by the browser could limit individual data flows, but tracking continued and autonomous agents could still act across sessions beyond those rules. Post-Sandbox data collection needs rules enforced at the collection layer that cover consent, how data is used, and agent-scale aggregation.

What the Privacy Sandbox actually was and what it set out to replace

Google launched the Privacy Sandbox in August 2019 to cut cross-site and cross-app tracking while keeping online content and services free. Its design moved user profile creation, ad selection, and reporting from remote servers into the browser. The browser became the trusted enforcement point. Rather than giving external systems unrestricted access to identifiers and browsing activity, it would perform sensitive work locally and expose limited outputs.

That architecture served three explicit goals, namely replacing cross-site tracking functionality, removing third-party cookies, and mitigating device fingerprinting. Its scope extended beyond advertising into IP masking and federated identity. Advertising was not the only affected activity. Any data-collection system using these mechanisms in Chrome would face limits on what it could see or export, whatever it later used the data for.

The ten APIs that reached general availability and what each one did to data flows

Topics replaced detailed browsing records with broad interest categories, such as “Toasters,” stored for three weeks. Protected Audience, formerly FLEDGE/TURTLEDOVE, selected ads inside the browser, determining the winning bid and creative without exposing the interest group list to an external server. Attribution Reporting supplied conversion signals while withholding fine-grained user-level attribution.

Private Aggregation added differential-privacy noise to reports before they left the device, limiting who could see fine-grained counts. Privacy Budget capped the total identifiable information a site could ask for through properties such as screen size and language settings. Both mechanisms constrained disclosure, leaving downstream use outside their scope. Shared Storage controlled reads and writes of cross-site data through restricted output channels, while Fenced Frames limited what an embedding page could see of ad rendering.

CHIPS, or Cookies Having Independent Partitioned State, kept third-party cookies separate for each top-level site, so cookies remained but could no longer be shared across sites. FedCM, or Federated Credential Management, mediated federated identity flows without exposing the identity provider to the relying party or vice versa. Private State Tokens provided anti-fraud attestation without cross-site identity linkage. These were distinct controls over distinct data flows. Their restrictions were built into the interfaces rather than left to the policies of systems receiving the data.

What the IAB Tech Lab's testing revealed about which use cases the APIs actually supported

The IAB Tech Lab’s 65-company task force spent six months examining 44 basic digital advertising use cases, starting in 2023. Only a small handful remained feasible with the available APIs. Lookalike modeling, frequency capping, and interoperability with existing identity infrastructure were explicitly identified as unsupported. Attribution Reporting recovered most directional conversion trends but lost the user-level detail needed to establish who converted and when. The restrictions had direct operational consequences.

Criteo reported that publishers could lose a substantial share of their Google Chrome revenue if third-party cookies were deprecated and publishers had to rely on the Sandbox. Axel Springer’s Robert Blanck stated that “the Privacy Sandbox and its associated processes suffer from a lack of transparency for publishers”. Google’s Privacy Sandbox team disputed the task force’s report, arguing that it “appears to ignore the broader objective of Privacy Sandbox to enhance user privacy while supporting effective digital advertising”. The disagreement concerned the standard of success itself. Privacy-preserving outputs and compatibility with established advertising workflows were proving difficult to reconcile.

How adoption actually evolved across the web — and why it stagnated before the shutdown

Grib et al.’s longitudinal study used weekly crawls over six months, with a custom Chrome-based crawler and comprehensive API call interceptor. It found that most APIs were used by only a handful of actors, with activity declining throughout the study. Adoption had stagnated before the retirement announcement. Even the APIs Google intended to maintain showed no growth, apart from CHIPS.

Beugin, Barford, and McDaniel’s study combined HTTP Archive crawls with public Chrome telemetry across each API’s lifetime. It found that most supported APIs appeared on 5.2% or less of page loads, with adoption peaking and stagnating by Q3 2024. Most adopters had participated from the initiative’s early days. CHIPS achieved meaningful scale primarily through actors with extensive existing web coverage, without broadening the community of implementers.

Those patterns reflected an unresolved incentive problem. Browser-level APIs reduced measurement precision and shifted control toward browser vendors, while publishers and advertising vendors depended on stable, accurate measurement. The alternative remained readily available in Chrome. Beugin et al. noted that Chrome’s limits on tracking and third-party cookies were still largely opt-in, while Brave, Firefox, and Safari applied their limits by default. Implementers would have to pay to change their systems even though they could keep using their existing methods.

The regulatory and competitive pressure that tightened as adoption fell

The UK’s Competition and Markets Authority secured legally binding commitments from Google in February 2022, requiring quantitative testing, quarterly reports, and oversight of the Sandbox’s design, development, and implementation. Limits on traditional tracking could make advertisers depend on Google as an intermediary, even if those limits cut how much of some data was exposed.

US courts ruled in 2025 that Google had maintained monopoly power in parts of its advertising business, while UK and EU regulators continued scrutiny. Weak adoption left the Sandbox without broad ecosystem support as competition concerns narrowed its institutional room to proceed. On April 22, 2025, Google announced that it would not introduce a separate prompt to phase out third-party cookies, leaving controls in Chrome’s existing settings. The forced transition had effectively disappeared. Following the retirement announcement, the CMA released Google from its commitments and closed its four-year investigation because the commitments were tied to the abandoned cookie deprecation.

What the October 2025 retirement actually retired — and what stayed

Google announced the retirement of most Privacy Sandbox APIs on October 17, 2025, citing limited website interest, low and declining adoption, and regulatory pressure. Topics, Protected Audience, Attribution Reporting, Private Aggregation, and Shared Storage were designated for removal. The advertising and measurement stack was being dismantled. CHIPS, FedCM, and Private State Tokens were expected to remain supported as infrastructure and identity components.

Fenced Frames initially remained on the continuing-support list, but moved to “Deprecate and remove” in August 2026 and is being stubbed out in Chrome 156. Third-party cookies, by contrast, remain in Chrome without forced deprecation or a standalone opt-out prompt. Cookie-based targeting and measurement therefore continue to work. Using them still requires consent or a lawful basis under privacy law. No successor standard has been ratified to provide the privacy-preserving measurement functions the retired APIs were intended to supply.

What is actually tracking users now that the Sandbox's constraints are gone

Chrome made minimal progress on fingerprinting resistance during the Sandbox period. Despite efforts to reduce the user-agent string, it continued to expose fingerprinting surfaces through Canvas, WebGL, AudioContext, and navigator properties. Tracking did not wait for the experiment’s conclusion. The behavioral fingerprinting ecosystem in 2026 includes standardized APIs, shared identity graphs, and contractual data-sharing arrangements between publishers, SSPs, and DMPs.

The strongest objection is that the Sandbox at least attempted to constrain those practices. Yet its presence did not necessarily displace them. Scripts matched Topics outputs with fingerprint signatures, adding an interest signal to profiles built through other means. That combination produced richer profiles than either source alone permitted, making the intended substitute an additional collection layer.

Beugin et al. found active abuse of UA Client Hints for fingerprinting across more than 62% of page loads and called for controls to disable it. This was a Sandbox-adjacent component becoming a tracking vector.

Why agentic AI systems expose a data-collection problem the Sandbox was never designed to address

The Sandbox’s controls governed browser outputs, leaving autonomous activity across resources and sessions outside their scope. That distinction becomes decisive for agentic AI. A human might access a small number of records per minute, while an agent can process thousands in the same interval. Agents can also infer, memorize, and redistribute sensitive information without triggering traditional security controls, making their risk different from tools that merely answer individual prompts.

The Model Context Protocol, or MCP, lets agents connect directly to enterprise resources and collect data beyond the browser’s reach. Legitimate authentication does not resolve that problem. An API can operate as designed while permitting extensive collection of personal data.

Within the browser, the Sandbox had no mechanism to distinguish agent-driven calls from human-driven calls. An agent querying Topics or Attribution Reporting received the same constrained output as a human browser session. Individual responses remained restricted by the API. But agents could make queries at scale and combine the results across sessions. Even a successful Sandbox would therefore have left a gap between the privacy properties of an individual response and the consequences of autonomous collection.

The compounding legal exposure when agents collect data across a post-Sandbox, multi-jurisdiction web

The Sandbox changed tracking technology but left privacy-law requirements for consent and lawful processing unmet. Consent management platforms, clear notices, and a lawful basis were still needed throughout. Retirement removed a technical compliance signal while leaving automated systems responsible for how they collect and use personal data.

As of Q1 2026, 20 US states have enacted individual privacy laws, exposing a multi-state agent deployment to concurrent enforcement by multiple state attorneys general. Automated agentic decisions can also trigger GDPR and the EU AI Act simultaneously, creating additive penalties. CCPA obligations expanded as of January 1, 2026, with new requirements for cybersecurity audits, risk assessments, and automated decision-making technology. Legal exposure now spans more than collection alone.

Grib et al. distinguished pre-consent, post-consent, and explicit consent-denial execution in their crawler and found consent-inconsistent API behavior. Calls occurred in consent states that should have blocked them. The API and consent layers were not reliably synchronized. An agent operating across thousands of sessions compounds that inconsistency at a scale manual review cannot address. A collection system therefore needs to enforce permissions during operation without assuming that an available API is a lawful one to use.

What a data collection approach built for the post-Sandbox environment actually requires

The components that remain favor first-party relationships and authenticated sessions over cross-site profiles built from inferences. CHIPS, FedCM, and Private State Tokens support infrastructure and identity, functions distinct from those of a replacement audience-measurement stack. For practitioners, the implication is to build around those relationships, with contextual strategies reducing reliance on cross-site profiles. Measurement needs a deliberate replacement as well. Retired Attribution Reporting functions leave a role for conversion modeling and explicit rules governing what an automated system may do with each class of data.

Agent data governance and compliance systems should enforce those rules when data is collected, since policy on how data is used later is not enough on its own. Consent signals must inform that enforcement. The controls also need to account for agent speed, volume, and cross-session aggregation, because restrictions on individual outputs do not govern the combined dataset. First-party data and per-class use rules form the minimum operational foundation for an automated measurement pipeline in 2026.

Beugin et al. recommend that future privacy proposals state their use cases upfront and demonstrate value early enough to secure lasting adopter commitment. That lesson applies equally to agent frameworks. A governance approach must let adopters do the work they need to do and make clear what data they can collect. The Sandbox’s architectural insight remains useful, but its enforcement boundary was too narrow for autonomous systems operating across the web.