22 Sep 2024 Search

(Previously: PET projects or real privacy?) The current trend for privacy-enhancing technologies for advertising features in web browsers is going to be remembered as a technical dead end, an artifact of an unsustainable advertising oligopoly. Here’s a top ten list of reasons, will update and add links.

10. PETs don’t fix revenue issues for ad-supported sites. The fundamental good ad/bad site problems and bad ad/good site problems are still there. PETs make it safer and easier for an advertiser to run ads on sites they don’t trust, so they help crappy infringing or AI-generated sites compete with legit ones in the same ways that third-party cookies do.

9. PETs give up the high ground and make the web just another incomprehensible, creepy surveillance medium. When people complain about privacy issues on native social media apps, with PETs on the web the app people can just say, your browser is creepy now too, we’re just better at business than web sites are.

8. Appeasement doesn’t work. In all the time that PET proponents have been saying that surveillance marketers will mend their ways if they have PETs as a compromise, how many data points have the surveillance marketers chosen not to collect because they have PETs instead? (The way to deal with boundary-testing is not to appease it, it’s to communicate the boundary, communicate the consequences for crossing it, and make the consequences happen. I had a good source for this, need to find it again.)

(update 4 Mar 2025) In 2019, Google announced a Privacy Sandbox PET project, and wrote,

First, large scale blocking of cookies undermine people’s privacy by encouraging opaque techniques such as fingerprinting. With fingerprinting, developers have found ways to use tiny bits of information that vary between users, such as what device they have or what fonts they have installed to generate a unique identifier which can then be used to match a user across websites. Unlike cookies, users cannot clear their fingerprint, and therefore cannot control how their information is collected. We think this subverts user choice and is wrong.

Later, in 2025, Google lifted its 2019 ban on fingerprinting for advertisers. It turns out that Privacy Sandbox was not Google’s desired end state, but just boundary-testing. Web users can learn from this story. Today, Meta and Mozilla are doing a PET-based system for attribution tracking in Firefox that exposes users to fraud and discrimination risks. Proponents are saying that it’s not a big deal because it’s just attribution tracking, not personalization. And the people working on it might be just focused on the nifty attribution math and not the big picture. But for users, the time to react to boundary-testing is when you first see it happening. Waiting for things to get unsustainably bad—in this case, for deeper Meta integration in Firefox—would mean it’s harder to roll back.

7. Only a few platform oligopolies and monopolies benefit from PETs. PETs introduce noise and obfuscation, to make data interpretation only practical above a certain data set size—for a few large companies (or one?) On this point, they’re worse than third-party cookies.

6. People are different. About 30% of people really want cross-context personalized advertising, 30% really don’t want it, and for 40% it depends how you ask. PETs are too lossy for people who want cross-context personalized ads and too creepy for people who don’t.

5. If it’s a good idea for shoppers to share their info, obfuscated, with advertisers, why not make the browser share the info from corporate web apps with customers, with individual employee identifying details removed? What? Companies wouldn’t turn that feature on? Then why would users?

4. The code complexity and client-side resource usage—along with the inevitable security risks that come with running more code—end up being paid by users, while the benefits go to surveillance companies. And the additional server-side processing required to do all that privacy-enhancing math on all those zillions of cleverly scrambled data points means that Big Tech companies will build even more big data centers, consume more energy and fresh water, and delay those carbon-neutral goals yet again.

3. With PETs, information becomes available equally to both trusted and untrusted parties. In a sustainable advertising medium, a trusted publisher or channel has more audience information than an untrustworthy one. PETs commoditize ad inventory, create more incentives for surveillance of users using non-PET methods, and promote a race to the bottom the same way that cookies do.

2. For most people, individual tracking isn’t the problem. Users are concerned about group-level discrimination risks like surveillance pricing and algorithmic discrimination, and PETs would only obfuscate the risks, not reduce them, and make discrimination harder for regulators and NGOs to detect. In No Cookies for You! Evaluating the Promises of Big Tech’s ‘Privacy-Enhancing’ Techniques, Martin et al. found, Respondents did not judge the privacy solution proposed—to have a browser collect data, keep the data on the local device, create inferences for use in advertising—to be a privacy solution over third-party tracking and the use of data brokers in advertising. Jereth et al., in Consumers’ Perceived Privacy Violations in Online Advertising, found that perceived privacy violations” for a browser-based system that does not target people individually are similar to the perceived violations for conventional third-party cookies. The mathematical privacy that PETs offer is not the same as the decision-making privacy that people want or need. See browser topics tracking and the prejudiced landlord problem.

Compared to conventional tracking, PETs make it harder for states to enforce privacy laws. See The Hidden Dangers Of Privacy-Preserving Attribution – And A Smarter Solution on AdExchanger (by me).

1. Never mind, you didn’t have to read this list. Browser companies already know that PETs are creepy and bad, and you can tell they know because they hide PETs from users, either with a bullshit Got it dialog, or buried under Advanced or something. If PETs were good for users, the browsers would brag on them like they do other features.

More: why privacy-enhancing advertising technologies failed