11 Jun 2026 Search

Is the “Attribution” proposal at W3C really part of a fundamentally wrong direction for the web, or is there a pony under here somewhere, and the proposal is just incomplete?

Instead of rushing to make a decision, W3C members should heed some wise advice: Don’t click. Count! Let’s count to 9 together.

  1. Paradoxical increase in user privacy risks. See Methodological concerns regarding Attribution Level 1 and causal measurement. Although the system has some privacy properties when considered in isolation, in the context of the real web it increases incentives for “more first-party identity harvesting” and other problematic practices. So it creates more, not less, privacy risk for end users. Making an ad that actually sells a product or service is much harder than using surveillance data to identify someone about to buy and getting an ad in front of them. ML systems “learning” to optimize the attribution reports will tend to do better with more surveillance data to pursue the second option. More: Explaining why the attribution cartel is a privacy menace (almost)

  2. Structural bias toward channels positioned closest to observable conversion activity, including search, retail media, retargeting and click-oriented social advertising. The W3C Is Making A Mistake About Measuring Advertising Effectiveness. This proposal would tend to drive ad money toward “lower funnel” Big Tech placements such as search, social, and app store ads—depriving users of some positive externalities of legit ad-supported content and exposing them to more negative externalities from social media.

  3. Incentives to suppress the “halo effect” of running ads on trusted sites. All of the attribution cartel companies are under pressure to shift ad spend from the “open web” to their own contexts. We might be able to trust the current developers working on the project to stay honest, but we have to consider who might be running this thing a couple rounds of layoffs from now. (The “pivot to video” saga shows what happens when marketing data meets pressure to produce the “right” results for some hot new strategy.)

  4. Problematic USA centralization. In a world where tech sovereignty is trending, and A Handful of Companies Control the Web, this proposal would hand control of a new information chokepoint to a few large companies here in the USA. A politician here could impose content-based punishments on sites worldwide, by requiring compliant Big Tech platforms to deny or filter the attribution reporting available to their advertisers, even advertisers outside the USA.

  5. Sustainability. This proposal lacks a sustainability section. Even an estimate would provide some help to advertisers and agencies that want to report on emissions or general environmental impact.

  6. Missing GPP support. Instead of handling the industry-standard Global Privacy Protocol, this proposal creates an extra, error-prone, compliance problem for every site that uses both GPP and attribution tracking. This violates W3C’s Web Platform Design Principles: User needs come before the needs of web page authors, which come before the needs of user agent implementors, which come before the needs of specification writers, which come before theoretical purity. The decision to pursue theoretical purity by ignoring GPP does not justify offloading GPP integration work onto possibly millions of web site authors, and extra risks onto users—when GPP support could have been handled by spec writers and user agent implementors. GPP is IAB Tech Lab and not W3C, but that does not justify a large-scale shift of development and testing. (Issue #450)

  7. A step backward on support for extensions. A similar system propsed as part of Google Chrome’s “Privacy Sandbox” implemented a chrome.privacy API, which helped users by letting extensions turn the ad features off. But this proposal omits the extension API, and makes extensions inject a script. (Issue #449)

  8. No simulated data. Some of the companies behind this proposal already have conventional tracking data that they could have used to show how the attribution reports would have come out if the system had been in effect. If they had evidence to contradict items 1-3 they could have shown it already.

  9. Public policy and lobbying considerations. Although the attribution reports are of limited use for professional marketers because of issues 1-3 above, the reports will be very useful for Big Tech companies making claims about how small businesses depend on them. Everyone who works on any privacy or competition issues is going to have to deal with papers based on this data popping up in any argument about restricting Big Tech in any way.

  10. (update 14 Jul 2026) Design decisions to reward large scale. The “privacy budget” rule, part of the project’s technical approach to make it harder to identify the same person on different sites, is designed to produce what Martin Thomson from Mozilla calls “structural advantages provided to large players.” The proposal would add noise in such a way that reports only become usable at large scale.

  11. (update 24 Sep 2026, split previous issue for clarity) No error recovery in some situations. Because of the power imbalance between large platforms and small advertisers, platforms have sufficent market power to deny reports in the event of an error. If a small advertiser does a big ad buy around an event, then makes a mistake with their first attempt at a query, then they could be permanently denied the ability to get a report on the ads they already paid for. (Yes, this is really a thing. It’s in the meeting notes from either the CG or WG, will add a link.)

  12. (update 17 Sep 2026) No evidence for substitution effects. Google offered an attribution-cartel like system as part of the “Privacy Sandbox” project, and it was the only one of the “Privacy Sandbox” sub-projects not to get an independent test from adtech or ad management firms. Apple offers a “privacy-preserving ad atrribution” feature, and most of the interest in it seems to be from users wondering what it is and whether to turn it off. Attribution cartel proponents claim that their system would substitute for other forms of tracking, but so far there is no evidence to indicate that this would happen.

Anyway, please think before you click. More: Arguments for the attribution cartel