When Meta, Google and Apple agree on a “privacy” feature, watch out.
The three companies (along with Mozilla, which is on one of their “ad features in the browser” kicks again) are drawing up a built-in advertising measurement system, called Attribution Level 1, as a standard feature of web browsers. The system is intended to measure the effectiveness of advertising by enabling advertisers to correlate “impressions,” the occasions on which someone saw an ad, with “conversions,” when people bought something.
Don’t look for a section on permissions or consent in that document, by the way. There isn’t one. And nothing about nerd lawyer stuff like “opt out of sale” or “objections to processing” in there, either. The Big Tech companies want a two-track system, where other companies’ ad features are required to do all the privacy regulation hassles, but the browser’s own built-in tracking feature is something that people have to find the right setting for and turn off.
Unfortunately, this is not just a chapter in Big Tech’s ongoing antitrust saga. The attribution cartel is on track to perpetrate real harms to users, including:
Built-in advantage for search, social, and app store advertising: More money for Big Tech, less for legit sites and other ad-supported resources.
Added incentives for riskier tracking: Obfuscating the source of a sale makes it easier to get a payoff from tracking practices that would be seen as problematic on their own.
Those consequences are unavoidable because of the proposal’s narrow, mathematical privacy goals, which are a mismatch for the kinds of privacy harms that people experience in the real world. In the “Privacy Considerations” section, the proposal says,
The main privacy goal of this API is to ensure that providing sites with the ability to perform attribution does not improve their ability to perform cross-site recognition.
The system is supposed to produce aggregated measurements while making it prohibitively difficult for an advertiser to discover whether any one person who bought something is the same person who saw an ad. Technically, the way it works is that a script running on a site with ads asks the browser to record an ad impression. Then the browser keeps a record of ads seen from all the sites you visit. Later, when you buy something, the retail site can ask the browser to generate a “conversion report” that can be passed to a centralized aggregation service. The aggregation service can then give the site some aggregated results, in a way that does not reveal whether any individual who bought something ever saw a particular ad or visited a particular site.
So why are the same companies that are notorious for tracking people so fired up about it? The problem is that the attribution tracking won’t be functioning in isolation. It has to interact with other technologies and business models. Even if the browser developers can pull off their ambitious goal of preventing “cross-site recognition,” the proposal would make life worse on the real Internet.
Problem one: Over-rating search, social, and app store ads
Marketing data expert Rick Bruner explained this best.
Lower-funnel media naturally appear more effective because they intercept demand after it has already been created elsewhere. Search is the classic example. Brand advertising may create the demand, but the search click gets the attribution credit because it occurs closest to the sale.
And the shift isn’t just a matter of a Big Tech squeeze on smaller companies, or an oligopoly tax on everything you buy. The attribution cartel threatens us as citizens, too. Many advertising-supported media have positive externalities—they benefit even people who don’t use them. Corruption thrives where newspapers shut down. Meanwhile, the negative externalities of Big Tech are too numerous or too content-warning-worthy to list here. The average person in the USA has about $1200/year spent on advertising intended to reach them. Where do you want “your” $1200 spent?
So can’t I just turn it off?
Privacy is a collective problem, not an individual one. Attribution cartel reports will end up filtered through friendly academics and presented at every privacy law hearing at every state legislature in the land—look how small businesses depend on Big Tech to make sales, you shouldn’t regulate us. Even though professional marketers already know the attribution cartel is offering “little better than voodoo” and “just a surface for the media sellers to commit fraud”, professional marketers won’t always be in the loop. Lobbying dirty tricks are a thing, and every browser running this system will act as a little lobbyist for Big Tech.
This post is already getting too long, so I won’t cover all the extra problems besides the big two.
There’s no estimate of the environmental impact of all the extra processing. For people trying to use the web responsibly, and for marketing departments tracking their carbon footprint, that’s a big omission.
Centralizing on a few big companies in the USA is going the opposite direction from the toward digital sovereignty. (It is the World Wide Web.)
What to do about it?
It’s time to stop. Give the authors some recognition for their mathematical achievement—some of the ideas might be useful elsewhere, maybe forecasting energy demand without revealing who’s home—and then archive this thing. None of this stuff is inevitable. Even Google was able to shut down the similar “Privacy Sandbox” project when it got too much regulator attention. By now W3C should have learned the lesson that all those boring “competition policy” slides and meeting announcements at groups like the Linux Foundation, Interactive Advertising Bureau, and Institute of Electrical and Electronics Engineers are there for a reason. If you try to YOLO the antitrust bureaucracy, big companies doing forum shopping will take advantage. Say what you want about the lysine price-fixing conspiracy, at least they booked their own meeting rooms and didn’t use an existing organization.
Back when commercial open source was first booming, and corporate sponsorship of community events was a big thing, there were quite a few open bars at all-ages events. Events managers quietly started coming into compliance with the alcohol laws before any consequences made the news, and W3C still has the opportunity to do the same. Cutting off surveillance oligarchs from colluding might be a little harder than cutting off some overserved teen hackers from the adult beverages, but the principle is the same.
Worst case, if the attribution cartel does get its way, at least add the functionality to allow attribution tracking to be managed by extensions the way that all the other ad stuff is. A majority of people in the USA use an ad blocker now, and the number one reason is now privacy, not annoyance. Users who have been told that they can protect themselves by installing Privacy Badger, or uBlock Origin with the right filter lists, should not have that advice rendered invalid on a technicality.
Most of the articles about this kind of stuff are structured as a Feedback sandwich: an introduction about how great it is that some big company is doing something for privacy, the actual content of the article, and then a positive conclusion about how we can all work together on future privacy projects. But I’m not getting paid for this, this is my personal blog, and scam culture is everywhere, so that’s all for now.