17 ms·

Privacy-Preserving Ad Click Attribution for the Web

199 points by sytse 7y ago

JohnFen 7y ago
Interesting. I'm not terribly enthralled by or trusting of the idea, but it does seem to be a little less terrible than what we have right now.
- JoshTriplett 7y ago
  What we have right now is ad blockers, and they work far better.
  - JohnFen 7y ago
    Well, yes, this new scheme would certainly not get me to stop using NoScript (I don't use an ad-blocker specifically as I don't object to ads. I do use NoScript, though, partly because I object to ads that run code on my machine). My comment was about the two approaches in the absence of client-side defenses.
    - olliej 7y ago
      No script doesn’t block trackers though, it only blocks some classes.
      - JohnFen 7y ago
        NoScript blocks Javascript, which blocks the majority of trackers. It doesn't address web bugs and the like, but I deal with those separately.
  - guipsp 7y ago
    Who does it work for far better? Because quite a lot of the Internet couldn't exist in its current state without ads.
    - 34r45sdg 7y ago
      Probably for the best. Id like an internet free of ads. Oh, I have that already thanks to ad-blocking technology. This is more user hostile crap, get it off my internet!
      - luckylion 7y ago
        Otoh: ads do serve a purpose. Lots of ads equals low quality content in my experience. The more aggressive the ads, the worse the content. It's like websites are self-reporting their spamminess.
        asdff 7y ago
        Some places get so strapped for cash that their content isn't even content, but thinly veiled low effort ad copy. I hardly trust online review articles anymore because they mostly focus on one new product by itself vs. in the context of a field of existing alternatives and are rarely critical these days.
        luckylion 7y ago
        Yeah, it's less and less "use ads to support the content creation", it's "write content to fill the void between the ads". And yes, review articles are a similar problem. And another indicator: if the site has "stars" in the serps, i.e. provides "aggregate rating" as microdata, it's probably shit.
    - JohnFen 7y ago
      > Because quite a lot of the Internet couldn't exist in its current state without ads. This isn't a terribly meaningful statement, though. Just because the ad industry managed to dominate the web doesn't mean it had to be that way or that there are no other ways. Also, in my opinion, advertising is doing more harm than good in the web overall.
    - pavel_lishin 7y ago
      There's a fallacy in your argument, but I don't know what it's called. Just because we got here via ads, doesn't mean we couldn't have gotten here without them. And that's even assuming that where we currently are is an optimum state we should shoot for.
  - om2 7y ago
    Ad blockers are a useful technology for users who opt in. For Safari, we aim to have on-by-default protections that provide privacy protection while still supporting ad-based business models. We see Firefox and Edge moving in this direction as well. We think that's the right balance for users, though, of course, our content blocker model also provides a sweet way of building ad blockers.
    - baybal2 7y ago
      Why are you hiring Ad tech people? Who initiated this initiative?
      - olliej 7y ago
        They aren’t?
    - echlebek 7y ago
      Why should users care about supporting ad based business models? Why should I, as a user, care about Safari?
      - scarejunba 7y ago
        Because in exchange they get content. We know there are users who want this because loads of people complain about paywalls.
        JoshTriplett 7y ago
        > We know there are users who want this because loads of people complain about paywalls. That's a false dichotomy. "Users don't like paywalls, so they must like ads"...no, users don't like paywalls and also don't like ads. (We can skip the whole "then how will content be paid for" argument that's been had thousands of times. There are plenty of solutions that aren't paywalls or ads.)
        eppsilon 7y ago
armagon 7y ago
I guess the answer must be yes, but, do people actually do this? Click on an ad and make a purchase right away?
- ianamartin 7y ago
  What happens to me the most often is that I buy something, and then a couple of days later I'll start seeing ads for it, and they chase me around for a few weeks or until I buy something else.
- sanxiyn 7y ago
  The answer is yes. Why are you asking?
- om2 7y ago
  This proposal allows attribution when the user clicks and then makes a purchase up to a week later, perhaps even from a separate visit. (But still trying to avoid personally identifying info).
- friday99 7y ago
  No, that does not typically happen and advertisers know that. That is called direct response marketing (think coupons in your free weekly newspaper) and is basically the lowest form of advertising. Advertising is a broad field including much more common forms of advertising such as brand awareness where the goal is to make the consumer aware of the product so they will have it in mind when they make their next purchase. Also remarketing, which everyone hates on the internet, where the product follows you around trying to see if you'll buy it again. For traditional advertising this is all the catalogs you get in the mail for things that you have bought in the past. It's always odd that most internet ad discussions try to turn all marketing into direct response marketing.
  - CaveTech 7y ago
    It's hardly the lowest form of advertising. Direct response is massive. Think of any time you've searched for something you intended to purchase. Killer conversion rates. This is a way more tangible form of advertising than brand awareness, because the impact of those campaigns is immeasurable. It's also a way more practical way to buy ads, because you know exactly what you're paying for and can measure your P&L in near realtime.
baybal2 7y ago
But they still have IP correlatable with server logs with timestamps and everything, plus you get a new client side DB what will be perked into by every adware in existence. The stated goal of untrackability by timestamp matching is simply not achieved with just 12 to 24 temporal dithering for anything, but biggest websites on the planet. They say it is privacy preserving, then, 5m minute into the text it comes out that it is nothing like that at all. It is the next "do not track" header. But to me it feels to be Apple's first "carrot and stick" step to chip away at Google walled garden. See: few month ago they launched both a ad cookie killer, and a 3rd party cookie firewall by default. Clearly, there was a huge net loss of ad money nearly momentarily, they clearly wanted it to be a surprise, to push ad businesses into panic. Now they come with a stick: play our walled garden, and you get your ad cookie back. In other news, people were noticing that Apple was hiring senior Ad tech people for quite some time now.
- om2 7y ago
  I don't see how this proposal has anything to do with an Apple walled garden? Nothing here special cases or favors Apple. We welcome issues on possible limits of the privacy protections though.
  - baybal2 7y ago
    1. If nobody will support this scheme other than Apple, then it is destined to become another DNT. 2. Apple become a gatekeeper for an AD revenue from Apple devices, being able to "switch lights off" on anybody with a single browser autoupdate. To any business person, it looks like a very clear ultimatum
    - olliej 7y ago
      What is the “switching the lights off” threat? The comparison to DNT is not reasonable: DNT was a proposal the originated in the ad industry in response to a government inquiry into their gross abuse of consumers. It was positioned to head off actual regulation, despite all browser vendors knowing it would not actually work. The Ad industry killed DNT when they announced that they would no longer recognize it (and were in fact using it for tracking) despite them positioning it as the “solution” to their own abuses. Once that occurred it became clear that the only solution is for browsers to break all tracking directly. This is merely something that would allow the ad ecosystem to still function in the absence of tracking. This is the answer to (1) - it’s not a matter of advertisers adopting it, if a browser vendor blocks tracking then advertising based on tracking is broken. So all that happens is those users are not tracked, and also don’t produce revenue.
the_gipsy 7y ago
> The browser should act on behalf of the user and do its best to preserve privacy while reporting on ad click attribution. I certainly have never wanted my browser to report ad click attribution.
- whatshisface 7y ago
  It's a post on webkit.org, not mozilla.org.
- otakucode 7y ago
  Since the 1990s I have always felt that advertisers feeling entitled to not only receive ad click data, but to only pay people based upon it, as inherently fraudulent. Advertisers in every single other form of media have never had access to this data. And they've certainly never even dreamed of only paying the person hosting the advertising in cases where an iron-clad case can be made that the advertisement led to a particular sale. Of course they wouldn't. It betrays almost the entire foundation of marketing and advertising itself. Building brand recognition, forming brand opinion, encouraging new social and personal practices, etc are big parts of advertising. And now because the Internet is around, we're just supposed to give companies all of that brand building and everything else completely for free, only having them pay for specific sales funneled directly and provably through an advertisement? Can I get an ad played during the Super Bowl and only pay the TV networks when someone can provide proof the ad was the cause of their purchase? Can I get an ad in the newspaper like that? Radio? Roadside billboards? Where? Where else do I get to just rob the person hosting the advertisements of basically all advantages of advertisement and only rarely pay them for providing the venue?
  - swiley 7y ago
    I far preferred project wonderful’s model where The advertisers bid for add space. That made so much more sense. Aparently it was shut down? I wonder what happened. Edit: it looks like they were focused on independent blogs and since those have far less traffic now they couldn’t afford to stay open. That really sucks, at least it’s a good example of how the web is a much worse place when it becomes centralized.
pspeter3 7y ago
This is a really interesting proposal but I wonder if there can be more than 64 buckets. I understand that the goal is to prevent user tracking but that number seems unnecessarily low.
- tgragnato 7y ago
  Marketers don't want parameters to be tuned on them, I expected this reaction. And as a user I dislike that this scheme relies on delaying reports, obfuscation is not privacy if you can be deanonymized.
huac 7y ago
> In plain English this report would say: 24 to 48 hours ago, some user who previously clicked shop.example’s ad campaign 55 on search.example, converted with data 20 on shop.example. this, i suppose, assumes that the browser is active at the time, but at any rate, it will screw with attribution windows pretty hard. advertisers will definitely be very happy to now see conversion numbers which could have happened at any time and are unverified
- cfarm 7y ago
  Yes - this is one of the biggest issues in the proposal. Apple's browser will be in charge of all the attribution logic. This could create very perverse incentives for any browser company. For example, if Google wants to make their ads look effective, they can use Chrome to mess with the attribution and no one would know.
akersten 7y ago
Can I get a "hell no"? Why oh why would you want to normalize anything about online advertising by standardizing it as an HTML property? Why does anyone think it is the browser's responsibility to support this? If ad companies are having trouble "attributing their campaigns" or whatever - that's tough? It's their responsibility to figure it out, not browser vendors, who should be on the user's side here (c.f. user agent). This is a terrible idea, breaks the abstraction between markup and application, and should definitely not be added to HTML standard.
- nicolaslem 7y ago
  Because the main browser vendors are literally ad companies?
  - threeseed 7y ago
    Only Google primarily is. Apple, Microsoft and Mozilla do have advertising elements but are a very minor part of their business.
- CaveTech 7y ago
  You're being naive. Ad companies are not having trouble attributing campaigns. The problem is that small, uncoordinated "privacy" features cause Ad Tech companies to become far more aggressive in how they track users. It's not the companies that lose here, it's you. A standardized, privacy-centric method for companies to accomplish attribution will help end the arms race and move back to a more consumer-friendly model. Small edges are worth a fortune in Ads. This is like the war on drugs. Clamping down and assuming ad companies will walk away is way too optimistic. Instead, they will move deeper into the shadows at whatever the cost.
  - akersten 7y ago
    If we do standardize this, why would an ad company stop using their existing tracking? This proposal allows them to collect more data about users, not less. It's just more entropy available to them, like the DNT header. And I still don't think it's the browser's responsibility to help the ad company. This kind of stuff just doesn't belong in a markup standard. If ad company cannot exist with the way they currently track users due to GDPR or other regulations, and "need" some standard way for "privacy preserving tracking" - they can write their own browser that does it and give people incentives to use it.
friday99 7y ago
This is such a weird proposal that I think indicates an unawareness of the advertising industry. The reason the internet tracking industry exists is entirely because the first party advertisers don't want to deal with attribution or anything like that. They are only interested with selling their product. They contract out to third party companies specifically to not have to deal with those attribution issues. The reason those third parties have to resort to tracking is because advertising fraud is rampant on the internet and the first party advertisers want some assurance that they aren't just throwing money away. In the traditional advertising world, they can see the ad on TV or printed somewhere and know they aren't getting ripped off. There is absolutely no assurance on the internet that anyone is seeing your ad. So this proposal is saying that the advertiser should be in the business of assuring that their ads are being seen and delivering value, but it still doesn't solve the problem that the advertiser wants to be sure how many of their ads are being seen. Advertisers are paying for the number of times and ad is shown not the number of times it is clicked (this isn't the year 2000), so this proposal gives the advertisers more work to do without actually solving their real problem. I don't foresee any significant adoption of this proposal from advertisers. Now, if someone could come up with a privacy-preserving solution to advertisers quality assurance problem of buying advertisements on the internet, that would be big business.
- deleted 7y ago
  [deleted]
- gruez 7y ago
  > Advertisers are paying for the number of times and ad is shown not the number of times it is clicked (this isn't the year 2000), aren't facebook and google ads cost per click rather than cost per impression?
  - jsonne 7y ago
    FB is CPM (Generally) Google is both depending on the ad product.
    - jklinger410 7y ago
lostmymind66 7y ago
I never understood the anger for Ad companies tracking you. Web content costs money to create and host. The alternatives are: -Most content being paid -Ads we really don't want to see. Without some sort of user tracking, ads would just be random -Wealthy people will be subsidizing lots of content for political gain (a method of getting funding) -Many smaller companies get pushed out in favor of large corps and much more difficult for a startup to survive. Pretty much all of these have happened to some degree in the last 5 years and with the opposition to ads/many people installing ad blocking software, it's only going to get worse.
- olliej 7y ago
  The ads aren’t usefully targeted? In the early days of AdWords the ads weren’t based on tracking but on page content (much more useful IMO). Nowadays there is this bizarre belief that somehow knowing everyone’s intimate details means your random context-free ad will result in someone buying something. The problem with the gratuitous tracking is that people cannot opt out of it. I don’t have a FB account, I don’t go to Facebook.com, yet I know Facebook has a profile built up because of those abusive like buttons. Similarly if I go to an online store, and buy something, there is an additional invisible tax I am being charged: the ads on the store pages feed multiple ad networks my personal info. Despite me literally paying them money.
  - wstuartcl 7y ago
    Some things to note, attribution and identity also allow for things like ad suppression or blanketing. If you have already bought the product or made indications you are not interested and will not be converted it is very common practice to suppress you from seeing those specific ads. Its also common to blanket you with relevant ads given shown interest in a product or service. Maybe it is fine to consider it a tax, another way to look at it is you are being paid on content and access on various sites (including sites where you make a purchase at a price that is fair for the product AND this information) for your information. Either way, if you want to jump ship from that arrangement -- it should be just as protected that accessing that content is now a violation of TOS or a liability to you that can be resolved with (at the site owners prerogative) hard costs to you for that content or service.
bjt2n3904 7y ago
On the flip side, this makes identifying and blocking ads super easy.
- contravariant 7y ago
  Which I reckon is, more than anything else on this page, why this is never going to take off.
nerdjon 7y ago
This is an interesting proposal... While I am not super enthused about the idea of my browser being the one that reports this data (Actively), due to the current state of ads on the web this feels better than the alternatives. We have already seen the effects of websites trying to get away with no ads and switching to a paid model. How often do we see complaints from users of sites like the Washington Post or the NYT that they can't read their news article. For the most part, attempts to get money from uses (who are at this point used to a "Free" web) has not seen great success. I would also argue that every site turning into asking for money is very problematic for anyone but the biggest players. Just saying that using ad blockers really is not a solution, if everyone used ad blockers we probably start to see issues with the available content on the internet. I don't really know how I feel about this yet. It will be interesting to see if Microsoft and Mozilla (I doubt Google will jump on this one, at least not quickly) will get involved in this. If so, it might actually see some good adoption.
- IX-103 7y ago
  Advertisers (and most publishers!) are unlikely to agree to this proposal as written. In particular the restriction that only the first party site can set up campaign identifiers makes it difficult for anyone other than a major publisher which already handles their own advertising (Facebook, Google, etc). The fact is that most sites don't have a direct relationship with the advertiser, so it just won't work for 90% of publishers.
  - zackbloom 7y ago
    If this is the only way they can get attribution on iOS devices, they won't have much of a choice.
    - IX-103 7y ago
      I'm saying they can't get attribution from this unless they are a major publisher. There's no choice there. This essentially means that bigger companies (that do direct advertising) can make more than double the revenue from ads as small companies. Of course the small publishers could let the ads networks host their content (in an iframe?) to recapture that revenue, but then we end up in a worse privacy position -- as there only end up being a few hundred first party hosts on the web that host all of the content and can track you with first party cookies!
olliej 7y ago
Everyone keeps claiming that exact tracking is necessary, or that this is ineffectual (as DNT). It is clear that browsers are doing everything they can to prevent user abuse. So let’s imagine they succeed. Imagine what happens to the current advertising model if browsers completely break cross origin tracking. That means you can’t link purchases to the original ads, and so the compensation model no longer works at all. This provides a mechanism to do the required attribution without also tracking or compromising a user’s privacy. Without that, there isn’t a way for the current ad model to work.
- boomlinde 7y ago
  > It is clear that browsers are doing everything they can to prevent user abuse. If that was true in general, my browser would block all cookies and all content from third party domains by default. It would systematically misreport Referer and User-Agent. It would disable APIs typically used for fingerprinting. It would disable all redirect-through-advertiser links. All managed by a simple and unintrusive whitelist (per first party, per third party or temporarily for a whole browser session or for a site session) so that you can opt in to these things where there is a legitimate use. It isn't because it has a much greater interest in browsing being a seamless experience and the web being a powerful application platform, and actual privacy measures are buried in some configuration menu or in third party plugins so that whiny power users can enjoy privacy while the unwashed masses go about their browsing as though the web standards aren't completely messed up from a privacy perspective. > This provides a mechanism to do the required attribution without also tracking or compromising a user’s privacy. Without that, there isn’t a way for the current ad model to work. Is that a good or bad thing?
  - olliej 7y ago
    Safari already segments cookies, storage, etc such that the ability to use those to track people is limited. I see no reason to believe it’s not going to continue making tracking harder. The user agent string does not provide as much information as people seem to believe. Whitelists aren’t usable, and don’t work at scale. The whole point of breaking tracking in general is so that the “unwashed masses” get privacy. Every study and survey has found that users value their privacy, but have been told (by advertisers and I assume you) that privacy is dead, or that they cannot have the internet without it. It is absolutely not something that just “power users” care about. It’s just power users are the only ones who currently get any. Finally, the attribution isn’t attributing to a specific user - the entropy is heavily limited, the reporting is time delayed by a random amount, and is made with a stateless session so there isn’t any way to directly tie it to a single specific user, leaving just the IP address, which is now typically shared, and frequently changes.
tareqak 7y ago
I'm glad that this blog post starts off with the principles behind the design of this technology because even if the specific design or implementation turns out to be flawed there is something to go back to and refine. The principles here seem similar to what a billboard ad or a paper ad effectively requires i.e. engagement and conversion is the responsibility of the ad buyer.
driverdan 7y ago
Here's a better solution: native ad blocking turned on by default. Far less complex, far more effective.
hamilyon2 7y ago
I think this scheme is too fraud-friendly to be true
founderling 7y ago
This seems totally absurd. Clicks are not tracked via cookies but via urls. The search engine in this example would send the user to someshop.com/someproduct?clickid=7e82jv927x748342 They say nothing about how they want to prevent this and other tracking mechanisms. Yet, they propose an overly complex system to send even more data to advertisers. Also they do not say anthing about the ip that their additional ping will send out. I definitely do not want my browser to communicate with an advertiser days later and without my consent. Also, click tracking is not even a big problem in the first place. Tracking you wherever you go is. Even if you do not click on any ads.
DevKoala 7y ago
We track for targeting, not for attribution. I don't see any benefit for the targeted individual or the advertiser coming out of this proposal. This proposal only brings benefits for the parties on the publisher chain who now have one more angle for committing fraud.
- Despegar 7y ago
  Apple is banning targeting (ITP) and creating a privacy-preserving technology to address the only legitimate interest of the ad-tech complex.
  - DevKoala 7y ago
    I am aware of ITP. There is no ad-tech without targeting. There are >50 million ad opportunities out there at any second, you need to target to delivery the message to a proper recipient. Attribution is a bottom of the chain problem, often problematic due to fraud.
    - Despegar 7y ago
      Apple should reduce the fidelity of targeting so that an online ad is the equivalent of a billboard ad.
    - megous 7y ago
      Sure there is still targeting, just target based on the site/page topic, not based on the supposed user's profile.
      - DevKoala 7y ago
        Of course we do that. But then how do you validate that wasn’t a bot generating a request trying to increase the publishers traffic? Do you trust the publisher blindly? You need some sort of insight into the web request other than a single integer counter claiming an impression occurred in order to validate the individual. Part of targeting is ignoring the fraud.
bitwize 7y ago
Bahahahaha. Advertisers make more money the less privacy you have. Talk about a technical solution to a social problem.
dillondoyle 7y ago
This will never work. Just a few things off the top of my head: - tracked link must not be in an iframe, which is how basically all ads are served - only 64 campaign_ids. what about tracking individual ads? i need to optimize which ads perform the best, what targeting is converting, and more - delayed conversion POST, 7 day window. What if a user makes purchase and then doesn't open safari again during the 7 day window? since POST is delayed wont arrive. also what about 30d windows? - what about view conversions? and other non-last click attribution? - when combined with ITP, how do they propose updating audience/targeting? I often see complains of people seeing retarget ads for products they already purchased.
- floatingatoll 7y ago
  Remember that ITP's goal is to break all tracking to begin with, so assuming Apple successfully implements ITP to the degree they clearly intend to, this proposal is built on the ground principles of: - no tracked link, iframe or not - no campaign ids - no conversion POST at all - no view converstions, no non-last-click attributions In that scenario, is this proposal an improvement? It sounds like an improvement. It's certainly more than the nothing that anyone will get from Apple's users without it. They didn't have to throw anyone a bone here, and they're going to take massive flak from a few users for doing so at all. I imagine Apple would be thrilled if advertisers chose the destruction of the tracking-based advertising industry over using this offering. Perhaps advertisers will learn from the music industry's experiences trying to bury their head in the sand re: iTunes and pay attention and participate in designing this system. Perhaps they will not.
  - dillondoyle 7y ago
    There are still ways to do conversion tracking with ITP, mostly moving to first party cookies and I wouldn't be surprised if we see a return of server side tracking like old Urchin so google & FB can store http only secure cookies that are indistinguishable from login/session cookies If the goal is to stop all tracking why create this (bad) plan in the first place?
    - 7y ago
verisimilitudes 7y ago
This page wouldn't display for me, even after disabling the CSS. I don't care for this attempt at redefining what privacy is. I could go step-by-step with this article, but I don't care to. These cretins want to track people more and more and we're all asked to voluntarily make concessions for their benefit; I disagree. I'll continue blocking JavaScript and performing almost all of my WWW browsing through Tor; I won't weep for these advertisers; they're owed nothing.
z3t4 7y ago
Just append ?campain=55 to the href
skizm 7y ago
Is there any reason bigger new sites don't just run ads like their paper counterparts? Sell sections of the site directly B2B. The business provides a static image, and the website shows that image for some amount of time for some predetermined amount of money. The image would be hosted with the parent site. They can target certain zip codes for more local ads, exactly like newspapers. I'm assuming it is significantly less profitable?
- mattklewis 7y ago
  This would have a similar effectiveness to advertising on linear TV today -- your ad reaches everyone who is tuned in (or visits the site), whether they are in your target demographic or not. This also wouldn't work on things like Google Adwords.
cfarm 7y ago
This very much looks like browsers will be handling all the attribution for ads. In this case it creates perverse incentives for companies who main own ads businesses and also own browsers...
vincent-toups 7y ago
I care about privacy but I also just fucking hate ads and never want to look at them. I don't even want them to exist and I don't want ad supported business models to exist on the internet.
mleonhard 7y ago
This is excellent timing. Google & Facebook's lobbyists are trying to get a weak US national law to overrule California's strong new privacy law. Apple's proposal will help the few pro-privacy people in Congress to push for a stronger national law.

199 points by sytse 7y ago

Interesting. I'm not terribly enthralled by or trusting of the idea, but it does seem to be a little less terrible than what we have right now.

JoshTriplett 7y ago
What we have right now is ad blockers, and they work far better.
- JohnFen 7y ago
  Well, yes, this new scheme would certainly not get me to stop using NoScript (I don't use an ad-blocker specifically as I don't object to ads. I do use NoScript, though, partly because I object to ads that run code on my machine). My comment was about the two approaches in the absence of client-side defenses.
  - olliej 7y ago
    No script doesn’t block trackers though, it only blocks some classes.
    - JohnFen 7y ago
      NoScript blocks Javascript, which blocks the majority of trackers. It doesn't address web bugs and the like, but I deal with those separately.
- guipsp 7y ago
  Who does it work for far better? Because quite a lot of the Internet couldn't exist in its current state without ads.
  - 34r45sdg 7y ago
    Probably for the best. Id like an internet free of ads. Oh, I have that already thanks to ad-blocking technology. This is more user hostile crap, get it off my internet!
    - luckylion 7y ago
      Otoh: ads do serve a purpose. Lots of ads equals low quality content in my experience. The more aggressive the ads, the worse the content. It's like websites are self-reporting their spamminess.
      - asdff 7y ago
        Some places get so strapped for cash that their content isn't even content, but thinly veiled low effort ad copy. I hardly trust online review articles anymore because they mostly focus on one new product by itself vs. in the context of a field of existing alternatives and are rarely critical these days.
        luckylion 7y ago
        Yeah, it's less and less "use ads to support the content creation", it's "write content to fill the void between the ads". And yes, review articles are a similar problem. And another indicator: if the site has "stars" in the serps, i.e. provides "aggregate rating" as microdata, it's probably shit.
  - JohnFen 7y ago
    > Because quite a lot of the Internet couldn't exist in its current state without ads. This isn't a terribly meaningful statement, though. Just because the ad industry managed to dominate the web doesn't mean it had to be that way or that there are no other ways. Also, in my opinion, advertising is doing more harm than good in the web overall.
  - pavel_lishin 7y ago
    There's a fallacy in your argument, but I don't know what it's called. Just because we got here via ads, doesn't mean we couldn't have gotten here without them. And that's even assuming that where we currently are is an optimum state we should shoot for.
- om2 7y ago
  Ad blockers are a useful technology for users who opt in. For Safari, we aim to have on-by-default protections that provide privacy protection while still supporting ad-based business models. We see Firefox and Edge moving in this direction as well. We think that's the right balance for users, though, of course, our content blocker model also provides a sweet way of building ad blockers.
  - baybal2 7y ago
    Why are you hiring Ad tech people? Who initiated this initiative?
    - olliej 7y ago
      They aren’t?
  - echlebek 7y ago
    Why should users care about supporting ad based business models? Why should I, as a user, care about Safari?
    - scarejunba 7y ago
      Because in exchange they get content. We know there are users who want this because loads of people complain about paywalls.
      - JoshTriplett 7y ago
        > We know there are users who want this because loads of people complain about paywalls. That's a false dichotomy. "Users don't like paywalls, so they must like ads"...no, users don't like paywalls and also don't like ads. (We can skip the whole "then how will content be paid for" argument that's been had thousands of times. There are plenty of solutions that aren't paywalls or ads.)
        eppsilon 7y ago

armagon 7y ago

I guess the answer must be yes, but, do people actually do this? Click on an ad and make a purchase right away?

ianamartin 7y ago
What happens to me the most often is that I buy something, and then a couple of days later I'll start seeing ads for it, and they chase me around for a few weeks or until I buy something else.
sanxiyn 7y ago
The answer is yes. Why are you asking?
om2 7y ago
This proposal allows attribution when the user clicks and then makes a purchase up to a week later, perhaps even from a separate visit. (But still trying to avoid personally identifying info).
friday99 7y ago
No, that does not typically happen and advertisers know that. That is called direct response marketing (think coupons in your free weekly newspaper) and is basically the lowest form of advertising. Advertising is a broad field including much more common forms of advertising such as brand awareness where the goal is to make the consumer aware of the product so they will have it in mind when they make their next purchase. Also remarketing, which everyone hates on the internet, where the product follows you around trying to see if you'll buy it again. For traditional advertising this is all the catalogs you get in the mail for things that you have bought in the past. It's always odd that most internet ad discussions try to turn all marketing into direct response marketing.
- CaveTech 7y ago
  It's hardly the lowest form of advertising. Direct response is massive. Think of any time you've searched for something you intended to purchase. Killer conversion rates. This is a way more tangible form of advertising than brand awareness, because the impact of those campaigns is immeasurable. It's also a way more practical way to buy ads, because you know exactly what you're paying for and can measure your P&L in near realtime.

baybal2 7y ago

But they still have IP correlatable with server logs with timestamps and everything, plus you get a new client side DB what will be perked into by every adware in existence. The stated goal of untrackability by timestamp matching is simply not achieved with just 12 to 24 temporal dithering for anything, but biggest websites on the planet. They say it is privacy preserving, then, 5m minute into the text it comes out that it is nothing like that at all. It is the next "do not track" header. But to me it feels to be Apple's first "carrot and stick" step to chip away at Google walled garden. See: few month ago they launched both a ad cookie killer, and a 3rd party cookie firewall by default. Clearly, there was a huge net loss of ad money nearly momentarily, they clearly wanted it to be a surprise, to push ad businesses into panic. Now they come with a stick: play our walled garden, and you get your ad cookie back. In other news, people were noticing that Apple was hiring senior Ad tech people for quite some time now.

om2 7y ago
I don't see how this proposal has anything to do with an Apple walled garden? Nothing here special cases or favors Apple. We welcome issues on possible limits of the privacy protections though.
- baybal2 7y ago
  1. If nobody will support this scheme other than Apple, then it is destined to become another DNT. 2. Apple become a gatekeeper for an AD revenue from Apple devices, being able to "switch lights off" on anybody with a single browser autoupdate. To any business person, it looks like a very clear ultimatum
  - olliej 7y ago
    What is the “switching the lights off” threat? The comparison to DNT is not reasonable: DNT was a proposal the originated in the ad industry in response to a government inquiry into their gross abuse of consumers. It was positioned to head off actual regulation, despite all browser vendors knowing it would not actually work. The Ad industry killed DNT when they announced that they would no longer recognize it (and were in fact using it for tracking) despite them positioning it as the “solution” to their own abuses. Once that occurred it became clear that the only solution is for browsers to break all tracking directly. This is merely something that would allow the ad ecosystem to still function in the absence of tracking. This is the answer to (1) - it’s not a matter of advertisers adopting it, if a browser vendor blocks tracking then advertising based on tracking is broken. So all that happens is those users are not tracked, and also don’t produce revenue.

the_gipsy 7y ago

> The browser should act on behalf of the user and do its best to preserve privacy while reporting on ad click attribution. I certainly have never wanted my browser to report ad click attribution.

whatshisface 7y ago
It's a post on webkit.org, not mozilla.org.
otakucode 7y ago
Since the 1990s I have always felt that advertisers feeling entitled to not only receive ad click data, but to only pay people based upon it, as inherently fraudulent. Advertisers in every single other form of media have never had access to this data. And they've certainly never even dreamed of only paying the person hosting the advertising in cases where an iron-clad case can be made that the advertisement led to a particular sale. Of course they wouldn't. It betrays almost the entire foundation of marketing and advertising itself. Building brand recognition, forming brand opinion, encouraging new social and personal practices, etc are big parts of advertising. And now because the Internet is around, we're just supposed to give companies all of that brand building and everything else completely for free, only having them pay for specific sales funneled directly and provably through an advertisement? Can I get an ad played during the Super Bowl and only pay the TV networks when someone can provide proof the ad was the cause of their purchase? Can I get an ad in the newspaper like that? Radio? Roadside billboards? Where? Where else do I get to just rob the person hosting the advertisements of basically all advantages of advertisement and only rarely pay them for providing the venue?
- swiley 7y ago
  I far preferred project wonderful’s model where The advertisers bid for add space. That made so much more sense. Aparently it was shut down? I wonder what happened. Edit: it looks like they were focused on independent blogs and since those have far less traffic now they couldn’t afford to stay open. That really sucks, at least it’s a good example of how the web is a much worse place when it becomes centralized.

pspeter3 7y ago

This is a really interesting proposal but I wonder if there can be more than 64 buckets. I understand that the goal is to prevent user tracking but that number seems unnecessarily low.

tgragnato 7y ago
Marketers don't want parameters to be tuned on them, I expected this reaction. And as a user I dislike that this scheme relies on delaying reports, obfuscation is not privacy if you can be deanonymized.

huac 7y ago

> In plain English this report would say: 24 to 48 hours ago, some user who previously clicked shop.example’s ad campaign 55 on search.example, converted with data 20 on shop.example. this, i suppose, assumes that the browser is active at the time, but at any rate, it will screw with attribution windows pretty hard. advertisers will definitely be very happy to now see conversion numbers which could have happened at any time and are unverified

cfarm 7y ago
Yes - this is one of the biggest issues in the proposal. Apple's browser will be in charge of all the attribution logic. This could create very perverse incentives for any browser company. For example, if Google wants to make their ads look effective, they can use Chrome to mess with the attribution and no one would know.

akersten 7y ago

Can I get a "hell no"? Why oh why would you want to normalize anything about online advertising by standardizing it as an HTML property? Why does anyone think it is the browser's responsibility to support this? If ad companies are having trouble "attributing their campaigns" or whatever - that's tough? It's their responsibility to figure it out, not browser vendors, who should be on the user's side here (c.f. user agent). This is a terrible idea, breaks the abstraction between markup and application, and should definitely not be added to HTML standard.

nicolaslem 7y ago
Because the main browser vendors are literally ad companies?
- threeseed 7y ago
  Only Google primarily is. Apple, Microsoft and Mozilla do have advertising elements but are a very minor part of their business.
CaveTech 7y ago
You're being naive. Ad companies are not having trouble attributing campaigns. The problem is that small, uncoordinated "privacy" features cause Ad Tech companies to become far more aggressive in how they track users. It's not the companies that lose here, it's you. A standardized, privacy-centric method for companies to accomplish attribution will help end the arms race and move back to a more consumer-friendly model. Small edges are worth a fortune in Ads. This is like the war on drugs. Clamping down and assuming ad companies will walk away is way too optimistic. Instead, they will move deeper into the shadows at whatever the cost.
- akersten 7y ago
  If we do standardize this, why would an ad company stop using their existing tracking? This proposal allows them to collect more data about users, not less. It's just more entropy available to them, like the DNT header. And I still don't think it's the browser's responsibility to help the ad company. This kind of stuff just doesn't belong in a markup standard. If ad company cannot exist with the way they currently track users due to GDPR or other regulations, and "need" some standard way for "privacy preserving tracking" - they can write their own browser that does it and give people incentives to use it.

friday99 7y ago

This is such a weird proposal that I think indicates an unawareness of the advertising industry. The reason the internet tracking industry exists is entirely because the first party advertisers don't want to deal with attribution or anything like that. They are only interested with selling their product. They contract out to third party companies specifically to not have to deal with those attribution issues. The reason those third parties have to resort to tracking is because advertising fraud is rampant on the internet and the first party advertisers want some assurance that they aren't just throwing money away. In the traditional advertising world, they can see the ad on TV or printed somewhere and know they aren't getting ripped off. There is absolutely no assurance on the internet that anyone is seeing your ad. So this proposal is saying that the advertiser should be in the business of assuring that their ads are being seen and delivering value, but it still doesn't solve the problem that the advertiser wants to be sure how many of their ads are being seen. Advertisers are paying for the number of times and ad is shown not the number of times it is clicked (this isn't the year 2000), so this proposal gives the advertisers more work to do without actually solving their real problem. I don't foresee any significant adoption of this proposal from advertisers. Now, if someone could come up with a privacy-preserving solution to advertisers quality assurance problem of buying advertisements on the internet, that would be big business.

deleted 7y ago
[deleted]
gruez 7y ago
> Advertisers are paying for the number of times and ad is shown not the number of times it is clicked (this isn't the year 2000), aren't facebook and google ads cost per click rather than cost per impression?
- jsonne 7y ago
  FB is CPM (Generally) Google is both depending on the ad product.
  - jklinger410 7y ago

lostmymind66 7y ago

I never understood the anger for Ad companies tracking you. Web content costs money to create and host. The alternatives are: -Most content being paid -Ads we really don't want to see. Without some sort of user tracking, ads would just be random -Wealthy people will be subsidizing lots of content for political gain (a method of getting funding) -Many smaller companies get pushed out in favor of large corps and much more difficult for a startup to survive. Pretty much all of these have happened to some degree in the last 5 years and with the opposition to ads/many people installing ad blocking software, it's only going to get worse.

olliej 7y ago
The ads aren’t usefully targeted? In the early days of AdWords the ads weren’t based on tracking but on page content (much more useful IMO). Nowadays there is this bizarre belief that somehow knowing everyone’s intimate details means your random context-free ad will result in someone buying something. The problem with the gratuitous tracking is that people cannot opt out of it. I don’t have a FB account, I don’t go to Facebook.com, yet I know Facebook has a profile built up because of those abusive like buttons. Similarly if I go to an online store, and buy something, there is an additional invisible tax I am being charged: the ads on the store pages feed multiple ad networks my personal info. Despite me literally paying them money.
- wstuartcl 7y ago
  Some things to note, attribution and identity also allow for things like ad suppression or blanketing. If you have already bought the product or made indications you are not interested and will not be converted it is very common practice to suppress you from seeing those specific ads. Its also common to blanket you with relevant ads given shown interest in a product or service. Maybe it is fine to consider it a tax, another way to look at it is you are being paid on content and access on various sites (including sites where you make a purchase at a price that is fair for the product AND this information) for your information. Either way, if you want to jump ship from that arrangement -- it should be just as protected that accessing that content is now a violation of TOS or a liability to you that can be resolved with (at the site owners prerogative) hard costs to you for that content or service.

bjt2n3904 7y ago

On the flip side, this makes identifying and blocking ads super easy.

contravariant 7y ago
Which I reckon is, more than anything else on this page, why this is never going to take off.

nerdjon 7y ago

This is an interesting proposal... While I am not super enthused about the idea of my browser being the one that reports this data (Actively), due to the current state of ads on the web this feels better than the alternatives. We have already seen the effects of websites trying to get away with no ads and switching to a paid model. How often do we see complaints from users of sites like the Washington Post or the NYT that they can't read their news article. For the most part, attempts to get money from uses (who are at this point used to a "Free" web) has not seen great success. I would also argue that every site turning into asking for money is very problematic for anyone but the biggest players. Just saying that using ad blockers really is not a solution, if everyone used ad blockers we probably start to see issues with the available content on the internet. I don't really know how I feel about this yet. It will be interesting to see if Microsoft and Mozilla (I doubt Google will jump on this one, at least not quickly) will get involved in this. If so, it might actually see some good adoption.

IX-103 7y ago
Advertisers (and most publishers!) are unlikely to agree to this proposal as written. In particular the restriction that only the first party site can set up campaign identifiers makes it difficult for anyone other than a major publisher which already handles their own advertising (Facebook, Google, etc). The fact is that most sites don't have a direct relationship with the advertiser, so it just won't work for 90% of publishers.
- zackbloom 7y ago
  If this is the only way they can get attribution on iOS devices, they won't have much of a choice.
  - IX-103 7y ago
    I'm saying they can't get attribution from this unless they are a major publisher. There's no choice there. This essentially means that bigger companies (that do direct advertising) can make more than double the revenue from ads as small companies. Of course the small publishers could let the ads networks host their content (in an iframe?) to recapture that revenue, but then we end up in a worse privacy position -- as there only end up being a few hundred first party hosts on the web that host all of the content and can track you with first party cookies!

olliej 7y ago

Everyone keeps claiming that exact tracking is necessary, or that this is ineffectual (as DNT). It is clear that browsers are doing everything they can to prevent user abuse. So let’s imagine they succeed. Imagine what happens to the current advertising model if browsers completely break cross origin tracking. That means you can’t link purchases to the original ads, and so the compensation model no longer works at all. This provides a mechanism to do the required attribution without also tracking or compromising a user’s privacy. Without that, there isn’t a way for the current ad model to work.

boomlinde 7y ago
> It is clear that browsers are doing everything they can to prevent user abuse. If that was true in general, my browser would block all cookies and all content from third party domains by default. It would systematically misreport Referer and User-Agent. It would disable APIs typically used for fingerprinting. It would disable all redirect-through-advertiser links. All managed by a simple and unintrusive whitelist (per first party, per third party or temporarily for a whole browser session or for a site session) so that you can opt in to these things where there is a legitimate use. It isn't because it has a much greater interest in browsing being a seamless experience and the web being a powerful application platform, and actual privacy measures are buried in some configuration menu or in third party plugins so that whiny power users can enjoy privacy while the unwashed masses go about their browsing as though the web standards aren't completely messed up from a privacy perspective. > This provides a mechanism to do the required attribution without also tracking or compromising a user’s privacy. Without that, there isn’t a way for the current ad model to work. Is that a good or bad thing?
- olliej 7y ago
  Safari already segments cookies, storage, etc such that the ability to use those to track people is limited. I see no reason to believe it’s not going to continue making tracking harder. The user agent string does not provide as much information as people seem to believe. Whitelists aren’t usable, and don’t work at scale. The whole point of breaking tracking in general is so that the “unwashed masses” get privacy. Every study and survey has found that users value their privacy, but have been told (by advertisers and I assume you) that privacy is dead, or that they cannot have the internet without it. It is absolutely not something that just “power users” care about. It’s just power users are the only ones who currently get any. Finally, the attribution isn’t attributing to a specific user - the entropy is heavily limited, the reporting is time delayed by a random amount, and is made with a stateless session so there isn’t any way to directly tie it to a single specific user, leaving just the IP address, which is now typically shared, and frequently changes.

tareqak 7y ago

I'm glad that this blog post starts off with the principles behind the design of this technology because even if the specific design or implementation turns out to be flawed there is something to go back to and refine. The principles here seem similar to what a billboard ad or a paper ad effectively requires i.e. engagement and conversion is the responsibility of the ad buyer.

driverdan 7y ago

Here's a better solution: native ad blocking turned on by default. Far less complex, far more effective.

hamilyon2 7y ago

I think this scheme is too fraud-friendly to be true

founderling 7y ago

This seems totally absurd. Clicks are not tracked via cookies but via urls. The search engine in this example would send the user to someshop.com/someproduct?clickid=7e82jv927x748342 They say nothing about how they want to prevent this and other tracking mechanisms. Yet, they propose an overly complex system to send even more data to advertisers. Also they do not say anthing about the ip that their additional ping will send out. I definitely do not want my browser to communicate with an advertiser days later and without my consent. Also, click tracking is not even a big problem in the first place. Tracking you wherever you go is. Even if you do not click on any ads.

DevKoala 7y ago

We track for targeting, not for attribution. I don't see any benefit for the targeted individual or the advertiser coming out of this proposal. This proposal only brings benefits for the parties on the publisher chain who now have one more angle for committing fraud.

Despegar 7y ago
Apple is banning targeting (ITP) and creating a privacy-preserving technology to address the only legitimate interest of the ad-tech complex.
- DevKoala 7y ago
  I am aware of ITP. There is no ad-tech without targeting. There are >50 million ad opportunities out there at any second, you need to target to delivery the message to a proper recipient. Attribution is a bottom of the chain problem, often problematic due to fraud.
  - Despegar 7y ago
    Apple should reduce the fidelity of targeting so that an online ad is the equivalent of a billboard ad.
  - megous 7y ago
    Sure there is still targeting, just target based on the site/page topic, not based on the supposed user's profile.
    - DevKoala 7y ago
      Of course we do that. But then how do you validate that wasn’t a bot generating a request trying to increase the publishers traffic? Do you trust the publisher blindly? You need some sort of insight into the web request other than a single integer counter claiming an impression occurred in order to validate the individual. Part of targeting is ignoring the fraud.

bitwize 7y ago

Bahahahaha. Advertisers make more money the less privacy you have. Talk about a technical solution to a social problem.

dillondoyle 7y ago

This will never work. Just a few things off the top of my head: - tracked link must not be in an iframe, which is how basically all ads are served - only 64 campaign_ids. what about tracking individual ads? i need to optimize which ads perform the best, what targeting is converting, and more - delayed conversion POST, 7 day window. What if a user makes purchase and then doesn't open safari again during the 7 day window? since POST is delayed wont arrive. also what about 30d windows? - what about view conversions? and other non-last click attribution? - when combined with ITP, how do they propose updating audience/targeting? I often see complains of people seeing retarget ads for products they already purchased.

floatingatoll 7y ago
Remember that ITP's goal is to break all tracking to begin with, so assuming Apple successfully implements ITP to the degree they clearly intend to, this proposal is built on the ground principles of: - no tracked link, iframe or not - no campaign ids - no conversion POST at all - no view converstions, no non-last-click attributions In that scenario, is this proposal an improvement? It sounds like an improvement. It's certainly more than the nothing that anyone will get from Apple's users without it. They didn't have to throw anyone a bone here, and they're going to take massive flak from a few users for doing so at all. I imagine Apple would be thrilled if advertisers chose the destruction of the tracking-based advertising industry over using this offering. Perhaps advertisers will learn from the music industry's experiences trying to bury their head in the sand re: iTunes and pay attention and participate in designing this system. Perhaps they will not.
- dillondoyle 7y ago
  There are still ways to do conversion tracking with ITP, mostly moving to first party cookies and I wouldn't be surprised if we see a return of server side tracking like old Urchin so google & FB can store http only secure cookies that are indistinguishable from login/session cookies If the goal is to stop all tracking why create this (bad) plan in the first place?
  - 7y ago

verisimilitudes 7y ago

This page wouldn't display for me, even after disabling the CSS. I don't care for this attempt at redefining what privacy is. I could go step-by-step with this article, but I don't care to. These cretins want to track people more and more and we're all asked to voluntarily make concessions for their benefit; I disagree. I'll continue blocking JavaScript and performing almost all of my WWW browsing through Tor; I won't weep for these advertisers; they're owed nothing.

z3t4 7y ago

Just append ?campain=55 to the href

skizm 7y ago

Is there any reason bigger new sites don't just run ads like their paper counterparts? Sell sections of the site directly B2B. The business provides a static image, and the website shows that image for some amount of time for some predetermined amount of money. The image would be hosted with the parent site. They can target certain zip codes for more local ads, exactly like newspapers. I'm assuming it is significantly less profitable?

mattklewis 7y ago
This would have a similar effectiveness to advertising on linear TV today -- your ad reaches everyone who is tuned in (or visits the site), whether they are in your target demographic or not. This also wouldn't work on things like Google Adwords.

cfarm 7y ago

This very much looks like browsers will be handling all the attribution for ads. In this case it creates perverse incentives for companies who main own ads businesses and also own browsers...

vincent-toups 7y ago

I care about privacy but I also just fucking hate ads and never want to look at them. I don't even want them to exist and I don't want ad supported business models to exist on the internet.

mleonhard 7y ago

This is excellent timing. Google & Facebook's lobbyists are trying to get a weak US national law to overrule California's strong new privacy law. Apple's proposal will help the few pro-privacy people in Congress to push for a stronger national law.