07 Dec 2025 Search

One minor piece of news in an eventful year was the end(ish) of Google “Privacy Sandbox”, a problematic scheme to put advertising features in web browsers.

Unfortunately, in a way, it’s still going. Google is still participating in the “Attribution” project at W3C. This is not Google’s original Attribution Reporting API from the Privacy Sandbox project. It’s the new name for the “Privacy-Preserving Attribution” scheme from Mozilla and Meta. The Big Tech dream of putting advertising features into web browsers is still a thing.

The sad part is that, in the years since the “Privacy Sandbox” saga started, we have learned a lot and it should be clear by now that hard-coding advertising features into the browser is a bad idea. Yes, the math can sometimes be really cool, but the concept has some real problems when applied to the real world.

Forum shopping: Companies that work on online advertising tend to join the IAB Tech Lab or become a Member of Prebid.org or both. But instead of taking Attribution to one of those organizations, the Big Tech companies chose instead to host it at W3C, which is an extra membership fee, time commitment, and travel budget to filter out the smaller advertising and publishing firms. Companies have to participate in IAB Tech Lab and/or Prebid to handle the adtech stuff they need today, so will skip W3C if they can’t do all three. The choice to work in a forum where Big Tech is present, but the advertising experts and smaller competitors are not, should be a red flag.

Platform oligopoly is built in. Third-party cookies, for all their faults, can scale down. A single ad-supported site and a single advertiser could have used a third-party cookie to do reports on readers and customers in common. Big Tech’s Attribution scheme requires one, or a few, centralized aggregation services.

Attribution reporting criteria don’t match market norms. When people participate in markets, they want trusted counterparties to have more information, while protecting information from being disclosed to parties they don’t trust. For example, you probably want your local newspaper to have more information on you than some random site that your uncle sends you a link to. If you visit a historic rug market on vacation, you don’t hand every rug merchant your shopping list, budget, and departure date. The Attribution proposal doesn’t match this expectation, so facilitates commodification and creates incentives to build and drive traffic to more deceptive sites—part of Big Tech’s project to drive us into a lower-trust society.

User research: Google chose to start Privacy Sandbox before developing an understanding of whether users would accept it. Not surprisingly, user research didn’t support the company’s approach. Jereth et al. found similar perceived privacy violations for a browser-based system as for conventional third-party cookies. and Martin et al. found misalignment between privacy-enhancing techniques and the privacy that people expect. Interestingly enough, a cookie-like system could be more acceptable. [F]or improving services across contexts, consumers judged the use of raw data as more appropriate compared to using inferences based on that same raw data. Unfortunately the “Attribution” proposal is proceeding the same way that “Privacy Sandbox” did: cool math first, user research later (if ever).

Environmental impact: In order to provide the kind of privacy protection that people people pretty clearly don’t want (the “privacy” offered by PETs and the “privacy” that users want are different) the Big Tech companies propose to burn an unclear amount of computing resources, both in data centers and on the user’s device, processing random noise.

Hardcore mode: At a time when the Big Tech companies are spiraling into layoffs and enshittification—even cutting back on the Metaverse—the adtech in the browser dream persists. Why? What’s the plan here? If past experience with Big Tech is any guide, it’s some kind of attack on legitimate businesses. One possibility is that, although conventional metrics show an advantage for “high-value publishers”, the “Attribution” data will favor whatever Big Tech happens to want to push. Hey, it worked for “pivot to video.” By the time some errors and omissions in the obfuscated attribution numbers come out, some more web publishers, already barely profitable, will be gone.

Effective alternatives: It’s not a choice of just PETs or cookies. Other alternatives to third-party cookies have been invented, and provide more and better options than imposing a single system that’s too creepy for the privacy people and provides too little data for those who prefer personalization.

For a long time, I wondered why there are so many browser privacy extensions but it was hard to find an extension that provided more information to advertisers, especially considering that people clearly have different opinions about this stuff. Now there’s Rewarded Interest which sets an identifier called a CMAID—which is designed to work with the existing OpenRTB web ads, standardized by the IAB Tech Lab. Instead of trying to come up with a single system for ads in the browser that works for everyone, each web user (or organization for managed browsers) should be able to pick an extension to handle it. Rewarded Interest is signaling honesty by setting themselves up to be easily replaced. If an end user doesn’t like how CMAID works for them, they could switch extensions, and if a publisher wants to use alternate identifiers instead of or in addition to CMAID, they can, while preserving their investment in OpenRTB. Finally, a green flag from somewhere. More: Rewarded Interest fan post

Current status

(update 19 Jun 2026) The attribution cartel proposal is in “wide review” status at W3C. W3C members, Think before you click.