Episode 8: Garrett McGrath of Magnite on Sandbox and the CMA

Welcome to the Monopoly Report.

The Monopoly Report is dedicated to chronicling and analyzing the impact of antitrust and other regulations on the global advertising economy.

If you were new to the Monopoly Report, you can subscribe to our weekly newsletter at Monopoly marketecture tv.

And you can check out all of the Monopoly Report podcasts and leave us a comment or review@monopolyreportpod.com I'm Alan Chappelle.

Eric Aparo is traveling this week.

And this week we've got Garrett McGrath, who is the SVP of product at Magnite and is also the board chair for Prebid, the open source header bidding solution.

So I'm really excited to have Garrett here.

I think he's going to provide a lot of background.

He's been pretty intricately involved in the privacy sandbox discussions going way back.

Hey Garrett, how you doing?

Welcome to the Monopoly Report.

Hey there.

Thanks for having me.

So I wanted to start with a bit of background, so.

And I'm oversimplifying a bit, but back in 2019, Google had announced that third party cookies would be deprecated in Chrome.

They had announced the creation of a W3C working group.

I'm curious, were you involved in the group at that time?

Basically from day one?

Yeah, I've been on a lot of those calls.

Any early impressions on the working group?

I think it's important whenever talking about any of these topics to say that there are a bunch of very intelligent, dedicated, resilient folks on the Chrome side working on this.

That said, the process of the W3C from day one was pretty clunky.

There were APIs or the notions of APIs that were being developed in real time.

You know, it's a lot like everyone's favorite metaphor of changing the tires while you're driving down the road.

Yeah, it was a challenging, certainly endeavor and an ambitious one.

My issue really early on was that there was a little bit of a misalignment within the group.

Like they were sort of holding it out to be, hey, we're all creating this industry standard.

When I think the reality was closer to we were asked to provide feedback to a ad platform that Chrome was creating.

Yeah, a common theme.

And I've said this to the Chrome folks on many occasions, depending on what you ask them and what function, what API, what issue.

It's either this is how it works or these are tools.

You figure it out and both of those answers are problematic.

So the collaboration was either capital C or lowercase C depending on how you look at it.

Yeah, well, that's Fair.

Okay, so we're going to fast forward a little bit.

And in 2022, the UK Competition and Markets Authority, and for those who don't know, that's the UK's FTC DOJ, they're their competition regulator and they sort of did this in partnership with the Information Commissioner's office, which was their data protection regulator.

But anyway, they had opened an investigation into the competitive impact of Google's planned deprecation of third party cookies.

And so the CMA wanted to understand the impact of using the privacy sandbox tools as compared to third party cookies and to see if there's a, you know, a negative impact on competition.

I think their going in idea was that there might be and so they wanted to investigate that.

I mean, what's your perspective like looking back now on the, on the CMA involvement?

Well, the fable is that the CMA involvement was in lieu of something larger in the courts.

I don't know how true that is or not, but you know, it was interesting that Google appeared to kind of volunteer to be regulated by the CMA back then.

It's important to keep in mind that their remit is competition concerns, not necessarily the health of the ad tech ecosystem or how things work, et cetera.

It's whether or not things are being competitive or anti competitive.

Also I think it's important to note that the attitude, the feelings toward cookies, privacy, et cetera, they differ around the world and the definition of privacy differs around the world and it's kind of in the eye of the beholder.

So, you know, there's there was no externality forcing Google to deprecate the third party cookie.

It was clearly some strategic reason.

And then signing up for governance by the cma, who knows if that was forced or voluntary.

But you know, as we all know, since then there have been quarterly reports from both sides.

Both of them generally seem to be authored by Google.

You know, early on it seemed like the CMA didn't completely understand the ecosystem and how could they?

I think they've come a long way in understanding how it works, but their involvement was, you know, kind of a question mark at first and we hoped a welcome question mark.

But working with them over the last four, three, four years, I think it's still a question mark, you know, whether or not what they're doing, they being Google is anti competitive or not.

There are certain parts, you know, even the technicalities of the APIs, there are certain parts of them that are very clearly self referencing for Google.

And that's one of the Things in the commitments which they call.

I think there's some verbiage for self referencing.

Oh, it's discrimination.

I think that, you know, they can't do that.

Well, the APIs do do that and there are, there are ways in which they kind of talk around that, but the CMA hasn't addressed a lot of those things.

So can you give some, some specific examples of how the APIs are preferred?

Yeah, the most clear example, the most commonly cited in GitHub and many other external issues is this notion of the top level seller.

In protected audience speak.

A seller is an SSP earning exchange.

There is a JavaScript function in this API called Run Ad Auction and that is step one of any protected audience auction.

So there's a hole in the page, needs an ad, this function gets called, it starts the whole process.

The caller of that function, Run Ad Auction is therefore the top level seller.

And then all other SSPs that the publisher presumably works with are called component sellers.

The top level seller, functionally, because of GAM DFP's dominance in the market, is going to be ADEX 95% of the time.

It doesn't have to be ADEX, but that's functionally true.

It's going to be because that's who calls the hole on the page.

So a top level seller has a bunch of information about the auction that the component sellers don't have and the ecosystem.

The industry has been pointing this out to Google, to the cma, to anyone who'll listen for quite a while now and nothing has changed.

So there's an inherent advantage to technically the caller of run at auction, but functionally that's almost always Google.

But they'll tell you as recently as last week in their report, anybody can call it.

That's true, anybody can call it, but 95% of the time it's going to be Google.

And if you aren't, if Google isn't the top level seller, there's no AdWords demand.

So there's a penalty for not allowing them to be the top level seller.

Yeah, Google likes to use the phrase anybody can access the APIs, which implies that anybody can be testing.

And boy, if you're not testing, then you must be doing something wrong or you're not pro privacy or, you know, but boy, if I was set up on a Microsoft Azure installation as opposed to an AWS or Google Cloud installation, you know, as of today, and we're what, four years into this, I'm still out of luck, right?

Kind of.

The original design and protected audience which is sort of the most meaty part of the APIs.

The design of it was an on device auction, meaning the auction takes place in the browser.

The ecosystem at large has long had lots of questions about the viability of that.

Stuffing thousands or tens of thousands of interest groups into a browser and expecting it to perform is a giant question mark.

And by the way, the Chrome people will tell you to your face like this has never been tested at scale.

They've had a 1% test, they don't know if it'll work.

And personally I think if it did work, it would only work on really fast connections on new computers in certain parts of the world, et cetera, et cetera.

So the original part of a protected audience was meant to be on device.

More recently, last two years or so, there's this thing called the bidding and auction service, which utilizes server side connections through what they call trusted execution environments or TEAs.

Currently the approved TEAs, according to Google are GCP and AWS.

So if you choose to use the server side component, which you probably are going to need to, but nobody really knows for sure, you have to be in GCP in aws, which is obviously not Azure and obviously not other self hosted solutions, et cetera.

So talk to the folks at Google, there's a lot of frustration about that.

Whether or not the scalability of that server side solution is 100% required is a question, but there does seem to be some king making there in terms of platforms.

Yeah, no, fair enough.

So as we were heading into 2024 there was a huge push from the CMA and from others, but they were really pushing the marketplace to begin testing the sandbox tools in earnest with a larger goal of providing an evaluation of these tools.

And I think the goal there was to do that in late July as part of the Q2 set of reports.

So were you involved in testing either via magnite and or pre bid?

Both.

I think it's interesting to point out that if prebid hadn't created connections between previd and these APIs, no one would be testing because that's the only integration that exists.

But yeah, from a magnite point of view, we did do a continuous eight week test.

We reported our results, the cma, et cetera, we were part of that.

The test itself is, as we all know, on 1% of traffic, so therefore budgets were tiny.

Is it a representative test?

Good question.

But yeah, but we were involved in that.

And then In July of 2024 Google had announced a pretty big change.

So you know Rather than deprecating third party cookies outright, they were just going to employ a choice prompt asking consumers if they wanted to continue using third party cookies.

And so what's your view on the use of the choice prompt and how that impacts kind of the larger, well, the larger set of challenges we're trying to address here?

Well, it's probably important to point out that if you're a Chrome user, you can turn off third party cookies today.

You've been able to do that forever.

It's buried in some menus and most people don't do it.

But if you feel strongly about it, you can do it right now.

The pivot on July 22 to this choice prompt.

This is purely a guess on my part.

I have no evidence for this, but I'm guessing that the CMA got a bunch of testing results from folks like Magnite and others and there have been plenty of folks in the press who've been public about their testing results.

They saw those results, said oh no and shifted to well, we'll let users do it.

It'll be a self deprecation paradigm.

I don't know if that's true or not, but the Q2 CMA report was just about to come out and then it didn't and then it became a Q2 Q3 report, which was Monday before last.

I think it was a pretty huge pivot because that was July a few weeks prior.

We were all in can and there was privacy sandbox events and people telling, you know, that that team telling the whole world to, you know, get to testing and this is the way forward and this is how it's going to work and cookies are going to be deprecated and then suddenly they weren't.

Yeah, it definitely had a, oh, we're going to do this in part so we don't have to face the music component.

I mean I don't know what's inside their brains but boy, that does seem to be seem to.

Where the mind goes, one can only guess.

But you know, they were full steam ahead on deprecation and you know, the market was telling them in lots of different venues, There's a million GitHub issues, there's problems.

You know, you, you haven't thought about video, you haven't thought about deals.

There are serious questions about latency.

How does this work, how does that work, you know, how does verification work, et cetera.

There were not and there are not satisfactory answers to most of those things today.

And you know, many of us had told the Chrome team and others on many occasions, like we will continue to work with you, we will get this fixed, we will figure out a system that works.

But you can't have a hard cutoff for cookies because you know, many of us Magnite and others of our scale, like, we'll be fine.

We can build to things that we need to.

There are opportunity costs, but that's okay.

But the mid and long tail of the open Internet was probably going to suffer.

But a lot of those are a direct result of actions by different divisions at Google Fair.

Yeah, absolutely.

You know, and we could talk about surge in AI some other time but you know, we were, we were really vocal with them.

Like, you know, we'll continue testing, we'll continue working with them.

We feel like we're going to be okay.

But you're likely harming the open Internet and that's not a great idea.

One of my takeaways, and this is the feedback that I provided to the Competition Markets Authority when we announced, when the choice prop was announced, is that it is absolutely irrelevant to the underlying competition issues.

The mechanism by which third party cookies goes away has nothing to do with the question about whether or not this had this negatively impacts competition.

And it does not seem super clear to me that the CMA either understands this or certainly agrees with that by virtue of the way that they're, that they seem to be approaching this.

And I'm just curious, what are your impressions now?

Having had a little bit of time to read and digest the Q2 Q3 report both from Google and from CMA.

The Q1 report had some teeth in it for one of the first times.

The reports prior to that were bland.

The Q1 report really started to be a little more specific about this is an issue, this is an issue, this is an issue.

Then the Q2 report didn't come out and then we got a combined Q2 Q3 report just a week plus ago.

And as a basic reader of those reports and not an attorney, it seems like they kind of gave up and everything's okay.

And there's going to be this new governance framework which is page three of that report, which is three or four paragraphs.

So it's very unclear what a governance framework is, but it reads a lot like Google governing Google going forward and telling the CMA what they're doing and how cross site tracking is going, et cetera.

And then the rest of the 115 page report is basically them saying these things are no longer an issue or they're an issue, but they'll be governed by the governance framework.

There was notice to Google that they needed to update the commitments with respect to the user choice thing by Q4, which is next month, which is in my eyes kind of code for we kind of care about this.

You know, you got, you got a couple of weeks, two, three weeks to you know, update the commitments with regard to choice.

And you know, we're good because you have this, this governance framework thing.

I don't know what happened.

And it's very likely the change to use your choice and the move away from deprecation, but the competition concerns still exist.

Yeah.

And I wrote about this for the monopoly report for this week's newsletter.

I mean if you just look at the X's and O's of the latest report, I mean they closed something like 90 of the outstanding issues.

And if you read through the rationale, it's usually some flavor of well yeah, but Google assured us that it's all okay.

Right, right.

And that kind of harkens back to the pre Q1 reports, which I would put in the category of them not totally understanding what was going on.

And then the Q1 report was like, oh wait, this is an issue, this is an issue.

What about this?

And now we're here and they're just sort of magically okay.

And you mentioned the governance framework and I want to talk a little bit about that.

Did you want to just walk through your understanding of what this new governance framework is going to be?

Sure.

And for clarity and posterity, since we're being recorded, I don't know, it's three or four paragraphs of that page that basically says there would be quarterly reports and an annual report on cross site tracking capabilities.

And it's really difficult to say what this governance framework is other than like I said, by just interpretation of the few words on the page, is Google is going to govern Google and tell the CMA what it's doing.

But isn't that where we are now?

Pretty much so.

So in my view the only difference between, you know, the last four years and then this governance framework is that I think the intention is to roll this out, to open the doors, to let it fly, and then to fix whatever the outstanding challenges are as we go.

And that's where the governance framework comes in.

Yeah.

Which to be fair is a far better situation than cutting off cookies, rolling it out and then fixing things.

Which is exactly what they've been telling us they're going to do for the last three, four years.

But who's to say they're not Going to kill cookies.

Well, if this user choice thing happens or when it happens, there's a ton of open questions as we've all thought about.

In terms of what, what does the dialogue look like?

Is there a dialogue?

Is it a button?

Does the dialogue say, you know, don't you love personalized ads or do you hate being surveilled?

I mean, who knows?

If deprecation is a slow self deprecation from consumers, it gives the whole world, you know, a bit more Runway.

Of course that presumes that that's what's going to happen.

And that's, that's, that's sort of one of the challenges here that I have.

You know, maybe this is my lawyer brain, but I bet you your product brain operates the same way, which is like if everything is so horribly vague that you just can't, you can't make actionable decisions.

And sometimes I think that's by design with the Google folks.

Well, many folks have wondered out loud in working groups whether or not this entire thing is accidental or deliberate.

Was it deliberately ignoring huge pieces of the ecosystem?

Video is an obvious one, but it's not the only one.

Or is this just such an incredibly difficult task that was given to incredibly smart folks that are not from the ads ecosystem?

They're engineers.

They had to kind of learn how ads worked.

You know, was that by design or was that incidental?

Who knows?

You know, I mean, there was a point five years ago where there was kind of a light bulb moment from the Chrome folks working on this where, you know, we help them understand that the highest price doesn't always win an auction.

And that was like, oh really?

Moment.

Yeah, I think an under discussed component of this is that there's, there's, I am sure a bunch of backroom political discussions going on within Google and probably some, some turf wars.

I mean, I remember going back to the days of, you know, when Microsoft IE was the big browser, or at least one of the big browsers, and they were talking about deprecating cookies and like there was, there was clearly a battle there, that's between, between the browser side and the ad side.

And I can't help but wonder if there isn't something similar to that taking place here.

There has to be.

You know, and I think it's probably important to say that if you, if you went back in time before all of this stuff started and the folks at Google would tell you the Chrome people can't talk to the ads people, et cetera, that probably made sense.

You know, it makes sense that the Chrome folks don't talk to the ads folks.

However, in designing a system in the last four or five years that is about ads in Chrome, there are clearly turf issues going on there.

And for folks like us in the non Google ecosystem, when we ask a question nine times out of 10 or five times out of 10, it's, well, I don't know, could you go ask the GAM folks that for us?

Because we can't talk to them.

There are turf wars going on for sure.

And obviously we all know Google has issues on a whole bunch of fronts at the moment and they're playing four dimensional chess in some boardroom trying to decide what to do with Chrome and what to do with cookies and when to do it and you know, is the health of the open Internet, you know, how important is that in relation to AI and search and you know, all of these things that are not about cookie deprecation.

You know, I kind of feel bad for him.

Not, not terribly bad, but it's a difficult situation to be in.

Oh for sure.

Well, talking about difficult situations, I mean, what are your thoughts of the test results that came out over in June, July?

I know Raptive, Criteo, RTB House, there's a couple of different sets of folks who had published their test results.

And what's, what's your sense now, having had some time to digest this?

Uh, none of those results were remotely surprising.

You know, the, if you back up in time to when header bidding became a thing and then you, you consider the fact that all of us in adtech are in the business of managing milliseconds and Anything that adds 3 milliseconds is, is to be, is suspect.

And then we add it on to the existing transaction header bidding, it's a whole other layer of transaction before the transaction because it was necessary because dynamic allocation, et cetera.

I think that we would all probably agree that we found the edge of the envelope and haven't gone beyond it in terms of time.

We can run a header bidding auction in 100, 120 milliseconds.

Everything works okay.

If he were to stop there and then start a whole new subsequent auction, not in parallel, that happens in the browser, which we're not even sure if that's possible at scale.

I should say you're by definition creating time and it's time you don't have.

You know, there are, there are a bunch of functional problems about the APIs and things that they don't cover.

I've already mentioned, but latency is a problem, you know, and we don't even really understand what the latency would be because we've only had a 1% test and blah, you know, limited budgets, et cetera.

But if you want to add a whole new auction onto the auction that we've already, you know, really highly, highly optimized and to, it's like it's, it's where it is and it's not going to get much better.

Those testing results, you know, do not surprise me.

It's kind of funny.

So I was involved in the W3C Tracking Protection Group, what, 12 years ago or so.

And a friend of mine who worked at Google at the time, guy named Sean Harvey, had had a back and forth with a bunch of privacy advocates who had said, hey, why don't you just do everything client side?

And Sean came up with a very kind and thoughtful explanation.

He said, listen, we've looked at this every way you possibly can and two things, this stuff does not scale when it's conducted entirely client side.

And secondly, we don't think it actually has a tangible privacy benefit.

And it's funny because, you know, that was a long time ago.

And you'd say, well, technology changes, people have new ways.

But, but the reality is, is that Google has not yet demonstrated that they've risen above those two core concerns.

Yeah, yeah.

Well, I mean, let's keep in mind that when this whole process started, they kind of unilaterally decided on the definition of privacy.

Like it's cross site tracking.

Okay, fine, but you know, you may have a different opinion about that than I do.

You know, a person versus B person.

But cross site tracking is now illegal.

You know, but if you sign into X app, I don't mean Twitter, I just mean ABC app, and then, you know, you click, okay, cross site tracking or tracking of what you're doing and then ads based on that, it's perfectly okay.

You've said okay to that.

So yeah, if the definition of privacy is cross site tracking and if the definition of what you just said about those two privacy vectors, essentially what they're saying in moving everything into the browser and closing off the auction from all the other participants, the subsequent auction that I described, they're saying that Google and Google technology is the only trusted entity in the ecosystem, which is kind of a problematic place to be.

Yeah, and one of the things that drives me crazy is when people compare, well, look at how nice Google's being as compared to Apple.

And look, I get, I'm the first to point out that Apple literally does stuff and then sticks its middle finger out to the rest of the marketplace and says like, this is it.

But the reality is that Apple has a very closed ecosystem.

And if you look at what Google is trying to do here is that they're taking an effectively open ecosystem and closing it.

Yeah, yeah, 100%.

100%.

I've said this on many occasions and people don't tend to bite on the idea, in my opinion.

If you wanted to solve this problem and you feel the way you feel, however you feel about third party cookies, but you want to keep a healthy ads ecosystem, et cetera, the browser should allow one cookie, one third party cookie.

You know, that would be a bunch of work for everybody that uses cookies to change that namespace to some other namespace.

But you know, when Magnite or Trade Desk or anybody else sets a third party cookie, they're setting it to the domain they own.

That is kind of irrelevant to them.

It's just a tool to be able to compare cookies.

What if everybody used the same one?

What if there was one off switch?

So if you don't like tracking, you don't like ad, ad tech, just press this button, it all goes away.

Basically what I'm saying is UID one was a great idea.

Just the go to market was really flawed.

I wanted to cover before we close out here is, you know, what's your sense of the impact of the sandbox delays on both maybe the ad tech and the publisher market?

Because there's a part of me that sort of feels, and I'm not going to put words in your mouth, so I'm not saying you're saying this, but in my view, you know, the CMA has pushed the marketplace to spend an inordinate amount of time solving a problem that has dubious value.

That time and effort, in my view, could have been spent elsewhere building stuff.

But I'd love to get your sense because you're a guy that's actually building stuff.

You know, what was the impact of the last four or five years on your ability to do what you love?

Well, significant for sure in terms of engineering output, not as significant as human capital or mental output.

Many of us have spent a lot of time in a lot of meetings for many years debating things that we could have been doing other things with our time.

But you know, we also did feel like it was important for the health of the ecosystem if cookies were going to go away.

And then we had an opportunity to make it.

Not safari.

Let's all engage and make that happen.

In the beginning of the sandbox proposals, Magnite and many other companies were submitting alternate proposals.

You know, at the time they all had avian themes and you know, Microsoft had Parakeet.

And these are all things that are publicly documented.

Most of those were ignored.

You know, they were, they were talked about in the W3C meetings, but they were basically ignored.

So there.

And you know, we, we tried to stand up systems using proposals that we had made and tried to do a minimal amount of engineering work to make them, you know, POCs, et cetera, all of that was basically for naught.

And a lot of folks who spent a lot of time prebid included building things to support protected audience and topics and et cetera.

And to your point, we don't know if it's going to see the light of day and we don't know whether or not those investments could have been better spent somewhere else.

We're very concerned about the health of the open Internet.

We're very concerned about the health of publishers.

And I say this both from a Magnite and a pre bid point of view, but you're right, there are things we all could have collectively done with our time and money that weren't this.

And to spend four or five years walking in one direction whether or not we agreed or not and then just sort of about face in July is.

It's frustrating.

Yeah, no, absolutely.

So before I let you go, we typically ask our guests if they have a semi secret interest or passion just to bring out the human side of adtech.

What do you got for us?

Well, for folks that know me, this is not semi secret, but my big sports passion would be MotoGP, just kind of like the motorcycle version of Formula One.

Whereas people who are passionate about football, which I am, but I'm not, they know the offensive coach's wife's name.

I don't know anything about that, about football, but I can tell you the mechanics, girlfriend's name in this particular team, et cetera, et cetera.

I used to race motorcycles years ago, before I had kids.

So it's primarily a European thing.

But yeah, MotoGP is kind of like my big thing.

Oh, very cool.

That's a good one.

It's fun.

Yeah, I like football until about mid October, but I'm a Jets fan.

Well, I'm a Lions fan, so it's been a better couple of years after a rough couple decades, but things are going okay.

Yeah, you guys were the king of 1 in 15 for a number of years.

You made the jets look better by comparison.

So thank you.

Well, I'm old enough to remember when Barry Sanders was there, so it wasn't always horrible.

Well, thanks so much, Garrett.

I really appreciate your time.

This was a great conversation.

Yeah, thank you.

I appreciate you having me.

We've got a bunch of other fantastic guests coming up on the Monopoly Report podcast over the next few weeks.

In the upcoming weeks, we'll have David leduc from the nai, who is going to share his predictions around privacy and the regular regulatory landmines that the digital ads market will encounter as we head into 2025.

Please subscribe to the show@monopolyreportpod.com or on Spotify, Apple, YouTube, or wherever you listen to podcasts.

Garrett, thank you so much for being here.