Attribution cartel Q and A

Previously: Attribution cartel update

Related: Q&A: Marti & Bruner discuss the problematic W3C proposed measurement standard ‘Attribution Level 1’ — Central Control

(Updated 19 Apr 2026)

What’s attribution and why does it matter?

Attribution is the process of correlating events, such as exposure to advertising, to an outcome, such as a sale. Usually people say “impressions” for the event and “conversions” for the outcome. See Digital Attribution Primer (PDF) from IAB.

The current state of attribution can be split into two tracks, paywalled vs. free: Paywalled is more scientific, and the free kind is what advertisers get from Google and Meta. More on that: Big Tech is squeezing advertising jobs and companies

Attribution matters because it guides advertising decision makers in determining where ad budgets get spent. Ad money can support legit sites and other resources that help the people being advertised to, or end up supporting parties that work against the interests of the people being advertised to.

How is the attribution cartel defined? Who’s in and who’s out?

The cartel members are some well-known companies that agree to operate an ad tracking scheme that will not require consent or be subject to objections or opt-outs. To get a peek of how this would work, a recent version of Firefox shipped with both an attribution tracking preference (on by default) and Global Privacy Control. But turning on GPC did not turn off attribution tracking.

A non-member is any company where consent, objections, and/or opt-outs apply to all of their personal data practices.

What would be the impact of the attribution cartel on web publishers and advertisers?

Giving large platform companies control of attribution would tend to aid their current tendency to shift more advertising onto low-trust content and AI-generated slop. What Happens When The Attribution Cartel Meets Advertising’s Halo Effect?

Is “attribution cartel” a negative or pejorative term?

No. The term “attribution cartel” reflects a Neutral Point of View. The attribution cartel meets all the generally accepted criteria for a cartel, according to their own meeting notes.

• The members are, at the same time, partners as well as competitors.

• The members of a cartel are independent of each other…there have to be at least two participants and they determine their interests autonomously.

• The members of a cartel know each other; they have a direct relationship, in particular they communicate with each other.

A negative term would be something like “attribution racket” or “attribution conspiracy”. It is recommended to avoid using those, and also to avoid terms biased in the other direction such as “attribution community”.

What’s Apple doing in the cartel? Aren’t they all privacy and stuff?

A lot of individual developers at Apple have been trying to protect their users from privacy problems on the web and from sneaky practices by iOS apps for quite a while. But in the big picture, management can justify participation in the attribution cartel by how it will move ad spend into Apple’s own ad system. Just out: Apple Gets Serious About Its Advertising Business by Lara O’Reilly. They’re limiting non-cartel tracking while building up an Apple Business tool that integrates Apple’s own attribution tracking, which you can still turn off but it’s buried under “advanced” somewhere.

The idea is to drive more money into App Store ads instead of to legit sites. If Apple didn’t control attribution, their app store ads would show a negative halo effect, because the App Store is full of fraud, so in the long run they need to either clean up or take control of attribution measurement. See App Store Search Ads and the Slippery Slope from the Think Tap Work blog.

The Attribution proposal looks complicated. Who’s going to run all that nerd stuff?

The point is to integrate into a system that both places ads (on slop and extreme political bullshit, naturally) and reports back that the decision to place ads there was the optimal thing to do. See, for example, Meta Is Launching An Easy Button For CAPI. The “open web” attribution data will feed into a system that shows how low the ROI for open web is compared to Meta’s whatever latest lawful but awful thing is.

But, technically, do the cartel members really need consent?

Questions like this help explain why the idea of g—like the real-world equivalent of one number for “intelligence” in Dungeons and Dragons—is bogus. See IQ is largely a pseudoscientific swindle (Argument Closed) by Nassim Nicholas Taleb. Google is the best example. Every time Google gets caught doing some kind of crime, their immediate response is something like, well, actually, if you were as smart as us you would be able to see that we went right up to the line of what’s a crime, but technically we didn’t cross it. When was Google’s heel turn? Rachel Myrow at KQED asked, What Is the Point of California’s Privacy Laws if Big Tech Ignores Them? and the response from Google was,

This report is based on a fundamental misunderstanding of how our products work. We honor opt-outs provided by advertisers and publishers as required by law.

Google took this approach to the antitrust cases, too, and we’ll see how that works out for them. They set up an intricate box inside which they may or may not be doing crimes, but you need to be Google level smart to understand the contents of the box. When a counterparty has limited processing power, and understands that their capacity to understand Google is always going to be less than Google’s ability to increase the complexity of what’s inside the box, the counterparty has to fall back on the useful heuristic of just assuming that the box contains a crime. High g_G (“Google intelligence”) doesn’t necessarily mean a high score in the communications or market flavors of “intelligence”.

There’s sort of a version of falsus in uno, falsus in omnibus effect going on here. When a cartel member’s obvious choices have a high crime level (for example, sticking malware links into search results), then a counterparty can use that to assign a predicted crime level to the company’s more impenetrable actions. High g_G and high propensity to crime is like being good at dealing three-card monte: Google’s win percentage is going to be high, but most people in a position to choose whether or not to play will choose not to play.

Attribution cartel members will be able to prove to themselves and to each other that “they don’t need consent” and are allowed to ignore objections and opt-outs, but they’re not trustworthy enough to prove it to non-members of the cartel.

How did the attribution cartel end up at W3C?

At the time that Google was choosing where to host their “Privacy Sandbox” proposals, W3C was still part of MIT, and had a really minimal antitrust policy. And Google managed to get a bunch of obvious anticompetitive tricks in pretty early on. It could have turned into a real mess, but fortunately the Competition and Markets Authority in the UK got involved. (see Google “Privacy Sandbox” timeline)

Meta has been expelled from IAB Sweden because of their persistent fraud problem—but W3C, even though it is now a separate legal entity and has upgraded the antitrust policy, still has a kind of old-school Internet “assume good faith” attitude, which doesn’t work when some members are the kind of companies that are members of the attribution cartel.

Why did the CMA release Google from their “Privacy Sandbox” commitments when Google was still active in the attribution cartel?

Good question. James Rosewell, in a LinkedIn post, writes,

The government appear to have interfered and guided the CMA to go slow on enforcement. That’s not what UK voters and tax payers expect from government, no matter the party in control.

If Rt Hon Rachel Reeves is serious about economic growth she needs to take advice from the people that know how to deliver it.

After all the CMA’s 2019 study into digital markets found the cost to every household in the UK due to the excessive costs of digital marketing from Google and Meta Facebook’s control over advertising was £500 per household per year.

That’s over £1000 today per household per year.

What’s the Eurostack angle again?

The attribution cartel issue becomes important when you look at possible interactions between news sites that cover politics and the Big Tech companies that have their own political points of view. Right now, the attribution cartel members aren’t as loud about their politics as, say, “X” (the former Twitter) but it’s not going to be realistic to rely on them to be impartial. Facebook Charged Biden a Higher Price Than Trump for Campaign Ads, and the Trump administration is doing substantial advocacy for the attribution cartel members, the bill for which will come due at some point.

Research shows that ads perform less well on “toxic” or brand-unsafe contexts, but in the current political environment the attribution cartel members will tend to avoid “brand safety” measures in the same way that ad agencies do: FTC Orders WPP, Publicis, and Dents to Stop Alleged Brand Safety Collusion. For the attribution cartel, this would mean assigning more favorable attribution numbers to pro-Trump or anti-EU content.

How should state privacy laws handle the attribution cartel?

The big asks are the same as for any other adtech/martech. We need an effective right to know (RtK), and we need the right amount of private right of action.

State legislators mainly need to be looking at the impact of the system, and the potential harms, and considering those independently of whether the system is labeled with “privacy” terms. Just claiming the “privacy” label, or mathematical properties of a system in isolation, should not let it avoid the same legislative attention as other systems. Or more.

It helps to look back at the Facebook housing discrimination saga, which started in 2016 and took a while before Meta actually started obeying Federal law. Real-world privacy harms are harder to track down when Big Tech obfuscates them. State legislatures need to make sure we have effective RtK including inferences, and a common sense level of private right of action.

When in doubt, keep the law simple and general and leave as much up to the jury as possible. (The Flo case was common sense one, bullshit documents zero.)

More: More attribution cartel Q and A

Bonus links

In the face of rampant AI, is ‘data poisoning’ a new form of civil disobedience? by Claire Tanner, Mor Vered, and Sam Cadman. Acts of sabotage have also long been central to collective action against injustice. In fights for labour rights, workers have employed diverse tactics to reduce efficiency and productivity. This has ranged from hotel workers putting salt in sugar bowls to farm workers breaking machinery. Data poisoning can be viewed as a modern version of these historic actions.

Illiberalism Is Not Inevitable by Anne Applebaum (If we are on the timeline where democracy and free markets win here, will the attribution cartel companies be able to pivot back to mainstream corporate politics and expect to be able to memory-hole this phase they’re going through?)

Why Privacy Compliance Won’t Save Us by Jay Mandel. At some point, the question stops being how to manage the system and becomes whether the system deserves to exist at all. Surveillance as a default is not inevitable. It is a design choice. And like all design choices, it can be replaced. The real question is no longer whether we can make the current system safer.

Why Geo RCTs Beat User-Level Tests for Ad Sales Measurement at Central Control. When a media company runs your incrementality test, they control the randomization, the exposure data, and the reporting. It’s the classic vendor-grading-its-own-homework problem. This is not an accusation of bad faith. It is a structural problem that no amount of good faith resolves. (Also applies to big platform companies—and they have more people who are good at math.)

What Regulators Talk About When They Talk About Ad Tech by By Allison Schiff. Companies also need to make sure their data practices line up with what they’ve told people in their privacy policies. Offering privacy controls doesn’t mean much if, behind the scenes, you’re collecting, sharing or retaining data in ways that contradict those promises. (To any high-g reader still with me, that doesn’t mean make the message so complicated there’s no obvious crime, it means make the message so simple there is obviously no crime. Or at least no more than usual.)