The Adoption Trap: Why Everyone Waited, and Why Google Was the One Who Couldn’t Push

Why six years of browser-engineered identity collapsed, and why the industry’s most capable player was also the least allowed to build it

Google’s Privacy Sandbox had every ingredient a standards project needs. A well-funded sponsor. Six years of runway. A published architecture, an open test programme, and a genuine technical problem to solve. What it did not have was a reason for anyone to move first — and that, not any engineering defect, is what killed it.

The temptation is to read October 2025’s retirement of ten Sandbox APIs as a verdict on the technology. It wasn’t. The official explanation — low adoption — describes the symptom. The cause sits one layer down, in a coordination problem that no amount of engineering could dissolve.

Everyone was waiting for everyone else

Strip the project down and there were four parties who each had to commit before the replacement could function. Every one of them faced a cost of moving first that was larger, and sooner, than their share of the benefit.

Advertisers would have needed to rebuild targeting and measurement stacks around APIs that nobody had proven performed in their category. Publishers faced Chrome revenue declines that Criteo warned could exceed its own earlier estimates. Vendors risked writing off engineering work against a roadmap Google had already changed twice — twice, by the way, before the retirement announcement, which made the third reversal entirely predictable and therefore entirely unpreventable.

And Google? Google carried the most interesting cost of all: antitrust exposure. Defining the advertising standard that your own competitors would then be required to implement, in a market where you also sell the ads, invites the scrutiny it received from the UK’s Competition and Markets Authority, the European Commission and the US Department of Justice.

Read the four cards together and the trap becomes obvious. Advertisers needed publishers and ad tech to ship the same APIs. Publishers needed demand-side adoption to land simultaneously. Vendors needed both sides to implement before their investment was safe. Google needed a neutral standard-setting process it could not credibly run while selling the inventory that standard would govern.

That’s not a market failure in the ordinary sense. It’s a specific, structural condition: the party with the strongest ability to force adoption was structurally barred from exercising it, and the parties with the strongest incentive to adopt could only move together.

The signal Google sent, and what it actually meant

There’s a second-order insight here that’s more useful than the post-mortem.

Once Google abandoned cookie removal in July 2024, the Sandbox could not survive. Not because the technology was weaker, but because the reason to implement it had just evaporated. Advertisers who had been told the cookie was dying now had a working cookie and an optional replacement. Rational behaviour was to keep the cookie and ignore the replacement.

Google then spent fifteen months maintaining a project whose central precondition had been removed, before retiring it. That interval — July 2024 to October 2025 — is where much of the industry’s wasted engineering budget lives. It ended with a blog post crediting the developers who had built against a foundation that had already been pulled out from under them.

What this predicts about the next identity standard

The lesson generalises, and it’s the reason this matters beyond one Google project.

Any identity standard that requires simultaneous adoption by buyers, sellers and intermediaries will fail unless one of three conditions holds: someone can impose it, the default changes on its own, or the cost of not adopting is immediate and painful.

The Privacy Sandbox had none of the three. No imposer — the antitrust problem. No default change — Chrome left cookies on. No immediate pain — the cookie kept working, so nothing hurt enough to force movement. Compare that with the two things that have changed behaviour measurably over the same period: browser defaults in Safari and Firefox, which have blocked cross-site cookies since 2020 and 2022 without asking anyone, and state privacy statutes, which started removing cure periods in 2025 and turned voluntary ambiguity into enforceable deadlines.

Defaults and statutes worked because neither required a coalition. Standards require one. That’s the asymmetry nobody budgets for.

The uncomfortable conclusion

So the question worth carrying into the next identity pitch isn’t whether the technology works. Most of it did. It’s who has to move first, what that move costs them, and whether anyone is in a position to make them.

If the answer is “everyone, simultaneously, voluntarily,” you already know how this ends. You’re just waiting for the blog post.