In a relatively obscure industry standards body, the World Wide Web Consortium, Big Tech players, including Apple, Google, Meta, and Mozilla, are making inroads to introduce a new ad attribution tool to the industry’s major web browsers
Simply dubbed “Attribution API,” the proposals evoke memories of the Google Chrome team’s abortive Privacy Sandbox proposals, i.e., its bid to phase out third-party cookies for online ad tracking, along with the accompanying concerns about competitiveness in the wider ad tech landscape.
However, for advocates, such proposals are being discussed in open forums, with the aim of replacing the ad industry’s current opaque tracking flows with a transparent, well‑scoped API that can be explained to users and audited by privacy experts.
These deliberations are taking place within separate entities of the web standards body, which was cofounded by Tim Berners-Lee and is widely known as the W3C, across its Private Advertising Technology, or “PAT,” and working groups over a course of several years. Both W3C groups have dozens of members from across the industry, with their membership organizations composed to reflect a range of opinions.
However, critics argue that the working groups within the standards org, which developed technologies such as HTML and URLs, require more man-hours for input; a commercial reality that inherently biases approval processes toward large organizations, such as Big Tech.
Such parties also point to grievances, such as the W3C recently overruling formal objections to the proposed charter of the PAT working group, when objectors maintained there were inherent conflicts of interest, among other issues, from those backing the proposals.
So, what is it?
In short, the goal of W3C’s Attribution API is to produce aggregate statistics on how advertising drives conversions without compromising the privacy of individual web users – hence the comparisons with Google’s Privacy Sandbox.
Below is a brief summary of the formal language used for the proposals in their current guise.
- The API proposes to collate information about people across multiple web origins, which could pose a significant privacy risk.
- To manage this risk, the gathered information is aggregated by a third-party trusted by the user agent within strict limits.
- “Noise” is then added to the aggregates produced by this service to provide differential privacy.
- Websites may select an aggregation service from the user agent’s list of approved aggregation services.
As mentioned, the current proposals have been debated for years; in fact, they predate the Privacy Sandbox proposals, which were first unveiled in late 2019 but later wound down in 2024 and 2025, with advocates pointing out how they are now entering a “wide review” process.
Digiday understands that part of this review process has involved outreach to multiple third parties, including academics in the sector, the National Center for Democracy & Technology, IAB Tech Lab, and the National Advertising Initiative.
‘Private attribution’
Washington Post’s engineering manager for advertising engineering Aram Zucker-Scharff, who also serves as co-chair of the W3C groups involved in developing the Attribution API, emphasized to Digiday the multi-stakeholder review process, adding that W3C’s most senior engineers from its Technical Architecture Group review such proposals for potential security pitfalls.
“The hope here is that we can look at things that the browser was accidentally enabled to do and build out specific use cases that are transparent and clear and easy to use and under user control directly, so that they can make informed and clear choices about them,” he explained.
Zucker-Scharff further noted that the current proposals use multi-party computation and differential privacy principles in a way that “changes the way the attribution flows.”
He added, “Essentially, this is just a way of taking a whole bunch of numbers from a wide variety of users, and instead of trying to directly track every single third-party cookie that runs through every single part of the web… the APIs (through the browser) connect to a multi-party compute process.”
Lower funnel bias?
However, not all who have participated in W3C discussions around the Attribution API agree with Don Marti, principal at Aloodo LLC and a one-time participant in the involved community group, who told Digiday the proposals could actually prove counter-productive.
“You get this paradoxical increase in user privacy risks, because the proposal obfuscates and rewards attribution fraud,” he told Digiday, adding the proposal’s current guise actually “creates more incentives to collect more data on more people in order to sneak ads in front of those who are about to buy anyway.”
Ultimately, Marti maintained that the API’s current form creates persistent statistical bias toward search, social, and app‑store advertising – the big ad-related money-spinners for Apple, Google, and Meta – at the expense of regular websites, such as news publishers.
You need input from data practitioners, and those involved with analytics, not engineers, developers or programmers
Angelina Eng
For Angelina Eng, formerly the vp of measurement at IAB U.S., most marketers would prefer raw, event-level data rather than pre-aggregated or pre-attributed outputs, as this would enable them to build and adjust their own attribution models.
“There is no one-size-fits-all solution, and there is always customization,” she explained to Digiday, urging the importance of the ability to slice and dice data across time periods and portfolios without browser-imposed constraints or privacy budgets limiting combinations.
Pointing to the earlier failure of Google Chrome’s Privacy Sandbox to win over the industry, Eng noted that Google’s timeline was most likely too aggressive – its initial goal was to implement a process within two years – and that it likely didn’t involve the right parties to establish consensus.
“What you need [for success] is input from data practitioners, and those involved with analytics, not engineers, developers or programmers, what you need are actual marketers on the agency and the brand-side as well as the publisher,” she added.
Those familiar with the process expect proceedings to move comparatively quickly from here, with the current horizontal review expected by the close of this year, and a more formal recommendation from the W3C expected by the close of 2026. Feedback on the current proposals can be submitted via email to the API proposal editors here.
So, while perspectives on the motivations from the current process vary wildly, what’s clear is that if successful, they could prove more consequential than Google Chrome’s Privacy Sandbox, given the potential for the current Attribution API to be mandated as a technical requirement underpinning all web browsers.