Almost one year ago, the W3C created a small subgroup called the Private Advertising Technology Community Group (PATCG). This lean group planned for its smaller size and narrow focus to make it easier to actually get something done when it comes to advertising and analytics standards for the web.
Standard W3C working groups were bogged down by internecine disputes: sometimes philosophical differences on privacy issues (“Third-party cookies aren’t PII!”) and sometimes just good old-fashioned rivalry (Why would Apple Safari agree to privacy standards when its particular privacy rules are a competitive differentiator from Google Chrome?).
But, against the odds, the PATCG has made theoretical progress on a number of key ad tech and privacy logjams in the past year. After the most recent meeting in September, the community group is in a position to make tangible progress in its second year by formalizing potentially agreed-upon standards docs that can be run up the chain of W3C working groups.
Where we are so far
When the PATCG crew first met in October 2021, a score of attendees were present, almost half of them W3C reps there to see the group set up.
The discussion group now counts more than 300 participants, and its regular meetings include 50 to 100 people.
“For today, we are too many to introduce, so will simply note that it is nice to see folks in person,” said Aram Zucker-Scharff, the co-chair of the community group, at the W3C conference last month. He also serves as The Washington Post’s engineering lead for privacy and security compliance.
The PATCG has helped launch one particular measurement proposal called Interoperable Private Attribution (IPA), the brainchild of Meta and Mozilla engineers. The idea with IPA is to create encrypted match keys operated by the browsers, so a logged-in Facebook user, say, might be matched if they use Safari on their phone and Chrome on a laptop.
But the problem is that all the browsers have their own particular standards and tactics. Microsoft has a cookieless attribution proposal called PARAKEET. Apple has its private click measurement and on-device privacy software called Intelligent Tracking Prevention. IPA borrows some of its ideas from Google’s Aggregated Reporting API.
The PATCG recently took its most exciting step toward reconciliation and standardization, Zucker-Scharff said.
“We had participants from Google, Facebook, Mozilla, Criteo and others, who all agreed to become editors on the first draft of the document that will become the specification,” Zucker-Scharff told AdExchanger. “This puts us in the position to rapidly iterate, reconciling all the different proposals and having the people who work on them come together and find a single standard that they can agree on.”
Easier said than done, however.
What’s next for the PATCG
Getting all the major browser operators to agree to develop and edit a single privacy standards proposal wouldn’t fix anything, but it would be a huge first step.
Having the heads of the five families of the mafia sit down at a table and shake hands doesn’t end gang violence, but it does start a dialogue. In much the same sense, last month the PATCG secured product leads from Mozilla, Microsoft Edge, Google Chrome and Apple WebKit (aka Safari) to volunteer to contribute to a single proposal, which is the only way forward if you want actual ad privacy standards for the web.
Now, the rubber must meet the road. Which is to say, the browser operators must actually commit to one set of rules that might work across browsers. And that’s the tough part.
“If we can produce tentative decisions, of redlines but also yellow lines where we can agree to disagree,” that would be a necessary starting point, said Charlie Harrison, a Chrome engineer, during the latest PATCG meeting. For instance, he said Chrome wants to draw a line on computation costs. He cited private click measurement and “on-device privacy” as things that may not make the cut because they have such high data-processing costs.
Apple likes on-device privacy, though, and private click management (PCM) is its attribution proposal.
To date, PATCG has been able to maintain consensus because none of the browsers (namely Apple) have made concrete commitments about will or won’t fly for ad tech.
Though, to be fair, it isn’t just Apple.
“We want solutions that meet a high privacy bar but are also usable and get the right utility,” said Erik Anderson, Microsoft Edge principal software engineering manager. That’s a “wishy-washy” line to draw, he acknowledged. It’s the kind of position every browser could support, without actually agreeing on anything.
But he said Microsoft Edge doesn’t want to spend engineering time and resources developing a tracking or measurement solution that, in the end, is going to be nixed by the group or another browser.
Before committing to product development, the browser operators want to guarantee the product won’t be a privacy dead end. But the only way to find out if some ideas are dead ends is to work on the product.
“No clear articulations on what the privacy redlines are has made this hard,” said Martin Thomson, a Mozilla engineering lead and co-author of the IPA proposal. “[We] want a concrete sense from the people in this room on preferences and what options are most appealing to them.”
Trust and learn or test and learn?
The PATCG doesn’t just wrangle the Big Tech browser-makers. Another challenge is to bridge any divisions between those browsers, ad tech and publishers.
“Hands-on testing is going to be limited to those with the resources to support it, which is obviously not everyone,” Zucker-Scharff said. Criteo, for instance, is a major testing body for the W3C ad privacy proposals because it has scale and can invest in testing, which is not cheap. Cloudflare also committed last month to standards testing for the PATCG proposals.
But large, important categories for web advertising aren’t represented (at the PATCG or the W3C more broadly).
“We’d love to see more publishers involved,” for instance, Zucker-Scharff said.
The New York Times, News Corp. and Zucker-Scharff’s WaPo are in the PATCG and have active reps to the W3C. And there are publisher-tech companies like CafeMedia and Yahoo, which keep a foot in the publishing world but are also major ad tech players. But there’s a gaping hole in W3C participation where digital media companies like BuzzFeed, Vice and Vox Media might sit.
During the recent PATCG meeting, Zucker-Scharff described the current web advertising situation as a “Napster problem.” Since the main industry stakeholders can’t agree on a way forward, users and ad tech are coalescing around ideas that don’t work well for web monetization or user privacy.
“I’m sure browser vendors trust themselves, and probably users,” Zucker-Scharff said. “Ad tech, publishers [and] trade groups don’t trust the browsers.”
Mozilla’s Thomson clarified that the issue isn’t mistrust between different PATCG stakeholders. The browsers trust no one.
“I’m not sure we trust ourselves,” he said.
