What is the Privacy Sandbox on Android?

It was Google's initiative to replace cross-app advertising identifiers on Android with on-device APIs — Topics for interest inference, Protected Audience for remarketing, the Attribution Reporting API for conversion measurement, and the SDK Runtime for isolating ad SDKs. Google announced the retirement of these technologies on 17 October 2025.

Is the Privacy Sandbox on Android deprecated?

Yes. Google's October 2025 announcement retired Topics, Protected Audience, the Attribution Reporting API, the SDK Runtime, Protected App Signals and On-Device Personalization across Chrome and Android, retaining only CHIPS, FedCM and Private State Tokens. No individual end-of-life dates were published, with Google stating it would follow standard Chrome and Android deprecation processes.

Why did Google cancel the Privacy Sandbox?

The stated reasons were low adoption of the new APIs and the fact that Google had already decided to keep third-party cookies in Chrome rather than remove them, which eliminated the deadline the programme existed to meet. Sustained regulatory and antitrust scrutiny, along with the complexity of the APIs themselves, contributed to the decision.

Does the GAID still work now the Privacy Sandbox is retired?

Yes. The advertising ID remains available by default on Android, subject to the user's ads personalisation opt-out — which zeroes it — and the AD_ID manifest permission for apps targeting API 33 or higher. The Privacy Sandbox was the intended replacement, so its cancellation leaves the existing identifier in place rather than accelerating its removal.

What should I use for Android attribution in 2026?

The Play Install Referrer API as the primary deterministic install signal, carrying a first-party click identifier you generate on your own links, with the Meta install referrer decrypted server-side for Facebook and Instagram campaigns. Treat the GAID as optional enrichment rather than a join key, since a growing share of devices return the zeroed value.

Glossary/Android platform

Privacy Sandbox on Android

Definition

The Privacy Sandbox on Android was Google's initiative to replace cross-app advertising identifiers with on-device APIs for interest inference, audience targeting and conversion measurement, and Google announced its retirement in October 2025.

For three years this was the presumed future of Android measurement, and a great deal of published guidance still treats it that way. On 17 October 2025 Google announced it was retiring the programme's core technologies on both Chrome and Android — Topics, Protected Audience, the Attribution Reporting API and the SDK Runtime among them. If you are planning Android measurement around the Privacy Sandbox, you are planning around something that is being switched off.

The current status

Retired — announced 17 October 2025

Google's Privacy Sandbox blog post, authored by VP Anthony Chavez, lists the technologies being retired across Chrome and Android. No per-API end-of-life dates were published; Google said it would follow the normal Chrome and Android deprecation processes. Chrome began removing the web-side APIs in early 2026.

What Google retired, and what it kept, per the October 2025 announcement.
Technology	Surface	Status
Topics	Chrome and Android	Retired
Protected Audience	Chrome and Android	Retired
Attribution Reporting API	Chrome and Android	Retired
SDK Runtime	Android	Retired
Protected App Signals	Android	Retired
On-Device Personalization	Android	Retired
Private Aggregation and Shared Storage	Chrome	Retired
IP Protection	Chrome	Retired
Related Website Sets, `selectURL`	Chrome	Retired
CHIPS	Chrome	Retained
FedCM	Chrome	Retained
Private State Tokens	Chrome	Retained

The stated reasons were low adoption and a changed premise: Google had already decided in 2025 to keep third-party cookies in Chrome rather than remove them, which removed the deadline the whole programme was built against. Regulatory pressure and the complexity of the APIs did the rest.

What it actually was

Worth understanding, because the design problems it was solving have not gone away and the vocabulary persists in vendor documentation and RFPs.

The four Android components and what each replaced.
Component	Replaced	Mechanism
Topics	Interest targeting from third-party data	On-device inference of coarse interest topics from app usage, a few returned per epoch
Protected Audience	Remarketing audience lists	Custom audiences stored on-device, with the ad auction run locally
Attribution Reporting API	GAID click-to-install matching	OS-mediated source and trigger registration, noised aggregate reports
SDK Runtime	Ad SDKs running in the host app's process	Third-party SDKs isolated in a separate process with reduced permissions

The architecture was coherent, and the SDK Runtime in particular addressed a genuine problem — every ad SDK inheriting the host app's permissions is a real security and privacy weakness. None of it reached meaningful production adoption before the retirement.

Android never had an ATT moment

The industry spent years expecting Google to do what Apple did. It did not: the GAID is still available by default, gated by an ads-personalisation opt-out and the AD_ID manifest permission rather than a system consent prompt. The Privacy Sandbox was the alternative to an ATT-style disruption, and its cancellation means the disruption was never delivered.

What to build on instead

The practical outcome is that Android measurement in 2026 rests on the signals that were already there, none of which depended on the Sandbox.

Android attribution signals and their standing.
Signal	Standing	Deterministic
Play Install Referrer	Stable, first-party, no consent needed	Yes
Meta install referrer	Stable, encrypted, advertiser-decrypted	Yes
Your own click ID in the link	Fully under your control	Yes
GAID	Available, opt-out zeroed, permission-gated	When present
App Set ID	Stable, but policy-barred from ads use	N/A
Privacy Sandbox APIs	Retired	N/A

Checking whether the APIs are present on a device

# The Ad Services module hosted the Sandbox APIs. Its presence or
# absence is the quickest way to sanity-check a device or emulator.
adb shell pm list packages | grep -i adservices

# Feature flags the module read, where the module exists at all:
adb shell device_config list adservices | head

# Deprecated code paths are worth removing rather than leaving to fail
# silently — a retired API returning empty results looks identical to
# a user with no interests, and one of those is a bug.

Audit your codebase and your vendors' SDKs for Privacy Sandbox integrations, and remove rather than disable them — a retired API that returns empty results is indistinguishable from a legitimate empty result.
Confirm your attribution does not have a Sandbox dependency on the roadmap. Several MMPs published Sandbox readiness plans that are now moot.
Make the install referrer the primary install signal if it is not already, since it is the only deterministic one that survived the whole period unchanged.
Keep the GAID as enrichment, not as a join key, and keep the AD_ID permission only if you genuinely read it.
Treat any documentation dated before October 2025 that presents the Sandbox as Android's future as stale, including much of what still ranks for this query.

Google's own announcement remains the authoritative source on the retirement and on which technologies were retained; check it before acting on any secondary summary, including this one.

Android SDK documentation

Our Android SDK never had a Privacy Sandbox dependency: it attributes from the Play install referrer and first-party click IDs, so nothing in the October 2025 retirement changes what it measures or how.

Open the android sdk documentation →

Frequently asked questions

What is the Privacy Sandbox on Android?: It was Google's initiative to replace cross-app advertising identifiers on Android with on-device APIs — Topics for interest inference, Protected Audience for remarketing, the Attribution Reporting API for conversion measurement, and the SDK Runtime for isolating ad SDKs. Google announced the retirement of these technologies on 17 October 2025.
Is the Privacy Sandbox on Android deprecated?: Yes. Google's October 2025 announcement retired Topics, Protected Audience, the Attribution Reporting API, the SDK Runtime, Protected App Signals and On-Device Personalization across Chrome and Android, retaining only CHIPS, FedCM and Private State Tokens. No individual end-of-life dates were published, with Google stating it would follow standard Chrome and Android deprecation processes.
Why did Google cancel the Privacy Sandbox?: The stated reasons were low adoption of the new APIs and the fact that Google had already decided to keep third-party cookies in Chrome rather than remove them, which eliminated the deadline the programme existed to meet. Sustained regulatory and antitrust scrutiny, along with the complexity of the APIs themselves, contributed to the decision.
Does the GAID still work now the Privacy Sandbox is retired?: Yes. The advertising ID remains available by default on Android, subject to the user's ads personalisation opt-out — which zeroes it — and the AD_ID manifest permission for apps targeting API 33 or higher. The Privacy Sandbox was the intended replacement, so its cancellation leaves the existing identifier in place rather than accelerating its removal.
What should I use for Android attribution in 2026?: The Play Install Referrer API as the primary deterministic install signal, carrying a first-party click identifier you generate on your own links, with the Meta install referrer decrypted server-side for Facebook and Instagram campaigns. Treat the GAID as optional enrichment rather than a join key, since a growing share of devices return the zeroed value.

Related terms

Attribution Reporting API — The Attribution Reporting API was a Google API for Chrome and Android that measured ad conversions by registering ad clicks as sources and conversions as triggers, then returning noised event-level and aggregate reports, and it was retired in October 2025.
GAID — The GAID, or Google Advertising ID, is a resettable per-device identifier that Android provides for advertising and analytics, and which is replaced by a string of zeros for users who opt out of ads personalisation.
Play Install Referrer — The Play Install Referrer is a Google Play API that lets a newly installed Android app read the referrer string and click timestamps recorded when the user arrived at its Play Store listing.
App Set ID — The App Set ID is an Android identifier consistent across all apps published by the same developer on one device, provided for analytics and fraud prevention and barred by Google Play policy from any advertising use.