W3C's Attribution API sparks bias concerns

Big Tech companies including Apple, Google, and Meta are working within the World Wide Web Consortium to establish a new method for tracking ad effectiveness without relying on third-party cookies. The proposed Attribution API aims to replace opaque tracking flows with a system that aggregates user data under strict limits. Industry observers note that these efforts echo the aborted Privacy Sandbox proposals from Google Chrome, which sought to phase out third-party cookies but faced significant resistance. The standards organization behind the project, the W3C, is currently conducting a wide review of the technology. This process involves outreach to various stakeholders, including academic institutions, advocacy groups like the National Center for Democracy & Technology, and industry bodies such as the IAB Tech Lab.

Aram Zucker-Scharff, the engineering manager for advertising engineering at The Washington Post and co-chair of the W3C groups developing the API, described the goal as building specific use cases that are transparent and under user control. The process utilizes multi-party computation and differential privacy to change how attribution flows work across the web. Those familiar with the technical details suggest the API connects to a multi-party compute process. Instead of tracking every third-party cookie individually, the browser connects to this process to analyze data from a wide variety of users. The API editors are currently accepting feedback via email as the horizontal review is expected to conclude by the end of the year.

Despite the technical safeguards, the push for the Attribution API has sparked debate regarding bias and the influence of major technology companies. Critics argue that the W3C working groups require significant man-hours for input, a commercial reality that inherently favors large organizations. One former participant in the community group, Don Marti of Aloodo LLC, suggested the current proposals could increase user privacy risks by obfuscating attribution fraud. He stated that the API creates incentives to collect more data on more people to target users who are about to make a purchase.

Angelina Eng, formerly the vice president of measurement at IAB U.S., echoed these concerns regarding the utility of the data. She argued that marketers prefer raw, event-level data over pre-aggregated outputs. Eng noted that the inability to slice and dice data across time periods and portfolios without browser-imposed constraints limits a brand’s ability to build and adjust its own attribution models. She pointed to the earlier failure of Google’s Privacy Sandbox, suggesting that the timeline was too aggressive and that the process did not involve the right parties, specifically data practitioners and marketers, rather than just engineers.

The proposed mechanism creates a closed loop for data analysis. Instead of tracking every third-party cookie individually, the browser connects to a multi-party compute process to analyze data from a wide variety of users. This approach allows websites to produce aggregate statistics on how advertising drives conversions while keeping individual identities hidden. To further protect individual users, the system adds noise to the aggregated data, a technique known as differential privacy. A trusted third-party service handles this aggregation to manage privacy risks. The API editors are currently accepting feedback via email as the horizontal review is expected to conclude by the end of the year.