GoKawiilWhen Meta, Google and Apple agree on a “privacy” feature, watch out.
The three companies (along with Mozilla, which is on one of their “ad features in the browser” kicks again) are drawing up a built-in advertising measurement system, called Attribution Level 1, as a standard feature of web browsers. The system is intended to measure the effectiveness of advertising by enabling advertisers to correlate “impressions,” the occasions on which someone saw an ad, with “conversions,” when people bought something.
Don’t look for a section on permissions or consent in that document, by the way. There isn’t one. And nothing about nerd lawyer stuff like “opt out of sale” or “objections to processing” in there, either. The Big Tech companies want a two-track system, where other companies’ ad features are required to do all the privacy regulation hassles, but the browser’s own built-in tracking feature is something that people have to find the right setting for and turn off.
Unfortunately, this is not just a chapter in Big Tech’s ongoing antitrust saga. The attribution cartel is on track to perpetrate real harms to users, including:
Built-in advantage for search, social, and app store advertising: More money for Big Tech, less for legit sites and other ad-supported resources.
Added incentives for riskier tracking: Obfuscating the source of a sale makes it easier to get a payoff from tracking practices that would be seen as problematic on their own.
Those consequences are unavoidable because of the proposal’s narrow, mathematical privacy goals, which are a mismatch for the kinds of privacy harms that people experience in the real world. In the “Privacy Considerations” section, the proposal says,
The main privacy goal of this API is to ensure that providing sites with the ability to perform attribution does not improve their ability to perform cross-site recognition.
The system is supposed to produce aggregated measurements while making it prohibitively difficult for an advertiser to discover whether any one person who bought something is the same person who saw an ad. Technically, the way it works is that a script running on a site with ads asks the browser to record an ad impression. Then the browser keeps a record of ads seen from all the sites you visit. Later, when you buy something, the retail site can ask the browser to generate a “conversion report” that can be passed to a centralized aggregation service. The aggregation service can then give the site some aggregated results, in a way that does not reveal whether any individual who bought something ever saw a particular ad or visited a particular site.
So why are the same companies that are notorious for tracking people so fired up about it? The problem is that the attribution tracking won’t be functioning in isolation. It has to interact with other technologies and business models. Even if the browser developers can pull off their ambitious goal of preventing “cross-site recognition,” the proposal would make life worse on the real Internet.
... continue reading