Inside Google Chrome's Privacy Sandbox Proposals

Experiments are underway at Google to engineer a sustainable ad-funded internet after the platform withdraws support in 2022 for the third-party cookie, the web’s default means of monetization since the 1990s. This includes a large-scale identifiability study that aims to establish a threshold of information publishers can access to personalize their websites to users of the market-leading Google Chrome browser, while preserving individuals’ privacy. Additionally, Google is testing a means of allowing marketers to continue online ad attribution in Chrome beyond 2022. A Google spokesperson was unable to immediately respond to Adweek's request for clarification around the timelines of these projects, which are both part of Google's Privacy Sandbox initiative, a years-long series of experiments to continue support for an ad-funded online ecosystem in a manner that placates privacy advocates. Crackdown on fingerprinting No firm decisions have been made yet, but the identifiability study is part of Google’s efforts to curb covert tracking without third-party cookies, with “fingerprinting” identified as a particularly egregious means of doing so. Browser fingerprinting is a technique where developers identify “stable information” on a user’s web browser, such as extensions or fonts installed, with such techniques historically used to track users in environments where third-party cookies are unavailable. Details of the identifiability study were shared at last week’s Chrome Dev Summit, where Google representatives showcased ongoing efforts ahead of what is set to be a crunch year for teams at the world’s most popular web browser. Privacy budget Google is conducting the identifiability study to glean data that will equip publishers with the right balance of user information, derived through APIs—also known as identifiers, or fingerprinting surfaces—while preserving Chrome users’ privacy. The Chrome team has proposed an “identifiability threshold” of API information that developers can use to personalize a Chrome user’s website visit, including ad targeting. From here, each publisher is afforded a “privacy budget,” and once a website approaches or exceeds this allowance the web browser can impose limitations on the Chrome APIs the publisher can access in order to prevent the recognition of individual website visitors. Maud Nalpas, from the Google Chrome developer relations team, told Chrome Dev Summit attendees the purpose of the identifiability study is to help quantify the identifiability threshold, plus which APIs will count toward a publisher’s privacy budget. “We are hoping that most websites are below [the identifiability threshold] so that the privacy budget enforcement only affects a small number of sites,” she added. For a more thorough explanation, watch this video: https://youtu.be/NkIi7h8NnS4?t=8938 Nalpas said the study is examining 300-plus Chrome APIs that websites are accessing, plus how much identifiable data they expose, but that it is still too early for publishers to prepare their privacy budgets. Separately, Google is also proposing measures to mitigate covert web-wide tracking, including willful IP blindness that aims to prevent geolocation data, arguably the most stable of identifiers, from being accessed and used to track individuals’ browsing behavior. Conversion measurement without cookies Chrome Dev Summit also saw Google showcase a conversion measurement API to help advertisers assess which ads generated a conversion, such as a direct purchase or database registration, without the use of third-party cookies. Third-party cookies are ad tech’s historic attribution tool of choice, helping to synch ad requests with the most suitable media buyer, but they have been under attack by privacy advocates who maintain such monitoring leaks personally identifiable sensitive data. Apple’s Safari was the first major web browser to withdraw support for third-party cookies as part of its intelligent tracking prevention rollout beginning in 2017. Since the introduction of these data-stripping features, publishers have experienced difficulties in generating much ad yield from Safari web traffic. Google Chrome will similarly drop support for third-party cookies in 2022 in an attempt to placate critics (lawmakers among them) calling for better privacy assurances. However, unlike Apple, Google has a $135 billion-a-year advertising business to defend—plus, it must ward off allegations of anti-competitive business practices. A solution for attribution done wrong “We know this information is critical for a functioning open ads ecosystem that helps fund an open web, and without it advertisers and publishers are totally in the dark,” explained Charlie Harrison, a developer also presenting at Chrome Dev Summit. “It can even lead to perverse incentives where ads optimize for clicks without actually providing value for the people that click on them.” Harrison further explained how the tracking capabilities of cookies are so powerful that visitors' information (beyond conversion data such as email and shipping addresses) can be used to inappropriately profile users. Google has proposed a series of measures to disassociate an ad click from information that can identify an individual, primarily by storing attribution information on the device a browser is installed on rather than an external server using a cookie. If a user then purchases a product after being served an ad in Google Chrome, the browser can then establish a link between the conversion event and earlier clicks, according to Harrison: https://youtu.be/NkIi7h8NnS4?t=9279 Currently, the conversion measurement API can attribute conversion to clicks, not views, but this is an enhancement it intends to rollout soon. Additionally, Google is currently offering the ability to trial the new means of cookie-less attribution via open-source software. However, while Google’s experiments are still in progress, and despite its pledges to broker a new way forward that is both business- and user-friendly, its Privacy Sandbox plan has not been without its critics. Separate sources told Adweek of their concerns that Google was using its superior resources to “create a solution to a problem that everyone else is beholden to.”