As the furor continues in the wake of Google’s decision to kill third-party cookies, the company is pitching its Privacy Sandbox as the alternative. The initiative has been promised as a way to curtail improper tracking while continuing to allow ad targeting within Google’s Chrome browser. But members of the advertising industry are concerned that the proposal could come with a catch.

As is the case with any big announcement from Google, the ad industry is voicing excitement and confusion about what exactly the Privacy Sandbox is and how it works. Here’s a primer:

WTF is Google’s Privacy Sandbox?

In the cookieless future, Google wants ad targeting, measurement and fraud prevention to happen according to the standards set by its Privacy Sandbox, whereby cookies are replaced by five application programming interfaces. Advertisers will use each API to receive aggregated data about issues like conversion (how well their ads performed) and attribution (which entity is credited, say, for a purchase). Privacy Sandbox represents an alternative pathway that Google is providing for the ad industry to take, relying on anonymized signals (that are not cookies) within a person’s Chrome browser to profit from that user’s browsing habits.

“The two areas [in which] we’d anticipate the most change is the increase in the value of first-party data for both advertisers and publishers as well as an increase in scarcity of third-party audience data sourced through data brokers and partners who do not have a direct relationship with users,” said Paul Cuckoo, PHD Media’s worldwide head of analytics.

What’s in it?

The Privacy Sandbox initiative is still in its infancy so while Google has proposed many features, no actual platform or code exists for marketers to properly assess. Here’s what we know about each API so far. The trust API is Google’s alternative to CAPTCHA; it will ask a Chrome user just once to fill out a CAPTCHA-like program and then rely on anonymous “trust tokens” to prove in the future that this person is a real-life human. The privacy budget API will limit the amount of data that websites can glean from Google’s APIs by giving each one a “budget.” Google’s conversion measurement API alternative to cookies will let an advertiser know if a user saw its ad and then eventually bought the product or landed on the promoted page. The Federated Learning of Cohorts will rely on machine learning to study the browsing habits of groups of similar users. The final component is PIGIN (referring to private interest groups, including noise), which lets each Chrome browser track a set of interest groups a user is thought to belong to.

“The most significant item in the Privacy Sandbox is Google’s proposal to move all user data into the browser where it will be stored and processed,” said Amit Kotecha, marketing director at data management platform provider Permutive. “This means that data stays on the user’s device and is privacy compliant. This is now table stakes and the gold standard for privacy.”

Which proposal should be checked out first?

Google’s conversion management API has generated the most discussion among media buyers so far. It’s also the first API that Chrome’s developers have decided to test. Being able to attribute ads to pageviews and purchase impacts in Chrome would affect all aspects of digital advertising, from how budgets are divided up between channels to which products ad tech vendors build. How the conversion management API is built will provide a clear indicator of Google’s plan for the rest of the Privacy Sandbox and digital advertising in general.

“If conversion measurement does get limited to just very simple click-based attribution, then potentially that means there would be a bigger focus on direct-response ad campaigns,” said Matt McIntyre, head of programmatic advertising for EMEA for Essence.

Written by Seb Joseph, originally published in Digiday