If you are shown a product ad whilst browsing searchengine.example and then later look up the product at reviews.example, then end up making a purchase at shop.example, your Mozilla browser will send all of these events to one or more aggregation services that allows shop.example to understand (at least in aggregate, assuming you trust the cartels running the aggregation services) that you were exposed to their product at searchengine.example and further exposed to their product at reviews.example.
Where previously an ad tech company was ultimately able to track users based on source IP address (even if cookies had been disabled by a user), IPA now allows these companies to track users across multiple IP addresses, and regardless of the user's cookie settings, via a unique tracking identifier. It is also proposed that the operating system provides the unique tracking identifier which can then be used by all applications or browsers on a device, allowing different devices behind a single IP address to be distinguished.
[1] https://github.com/mozilla/standards-positions/issues/753
[2] https://github.com/WebKit/standards-positions/issues/142
Most of these private attribution systems are specifically designed so that the people running the ad can count how many people clicked their ads, but not who clicked them or what other things they did. Safari had a proposal in which you could only have a certain number of campaigns running per domain, so you couldn't set up a separate """campaign""" for each user and fingerprint them all at once. I don't know how the Mozilla proposal differs.
Whether or not user-agents should care about this sort of thing is an orthogonal question.
[0] https://www.theregister.com/2023/06/29/google_trueview_skept...
[1] Remarketing in particular is responsible for the "feeling of being seen" from modern ads where you search for one thing and get 10,000 ads for the thing for the next week
Something strange. So, radio advertisement, billboards, video panels, and absolutely any other type of advertisement is a scam that exists for few decades and still going good?
User Agent. Not advertiser agent, not government agent. USER AGENT!
Yes, and since "attribution" as defined here is incompatible with user's privacy (which is a human right), therefore advertising should fail. Can it please fail early and fail often?
No, attribution is what advertisers want, to do the least amount of work possible to blast you with ads that attack your deepest weaknesses, all under the pretense of "personalization".
> then the ad platform will defraud you[0]
Cool. How is that my problem as a user ? Grow a set of balls and sue the ad platform.
"blast you with ads that attack your deepest weaknesses, all under the pretense of "personalization"."
Instead it will tell advertisers how effective their blast was, and help argue that Google isn't defrauding them.
...if you let it.
This is quite different than the current design of online ads, where which ad to show is only decided when the ad loads and reloads.
Not that it matters that much - online ads are a total scam anyway. Particularly google's search ads, which 9 times out of 10 is just a copy of the first search result - but now in a version where they get money for the click.
It is however what the advertisement companies and agencies want. They are selling shitty products.
When buying internet ad space, though, the information asymmetry is vastly different.
What prevents any of the following solutions from providing assurance to advertising clients, without also destroying the Internet and general purpose computing:
1. Building trust with advertising clients be treating them with respect, honesty and transparency. If your clients don't trust your advertising network and were demanding assurances in the form of WEI and similar proposals, surely it's obvious there are bigger problems. The advertising client would likely have dropped the advertising network long ago but can't due to monopolies existing.
2. Advertising networks undergo independent audits (results available to clients) and become more transparent to clients in how their advertising spend is being used.
3. Advertising clients survey users at checkout to ask whether they found the product/service from an advert, or whether they recall seeing an advertising campaign and where they remember seeing it.
4. Advertising clients host advertisements at ads.company.example (in a few highly restricted formats) so they can keep track of impressions themselves.
5. (still a bad idea, based on user surveys, but one which Google et al should have considered for minimisation of data collection and privacy impact) Browsers collect advertising metrics during use and when a user makes a transaction at an online store, the online store asks the user (via the browser) for permission to obtain those saved advertising metrics to provide only to the online store. Users can review the entirety of information sent to the online store before it is sent. Advertising networks don't have a need to access browsing history for everyone on the Internet in real time.
6. Online stores and similar continue to rotate their marketing spend through various advertising networks and marketing campaigns, checking their own metrics to see if advertising campaigns have been having an impact. Campaigns could include marketing using the Internet but outside the reach of Google et al such as use of campaign-specific coupons and products marketed through product review websites, referral schemes, influencers, etc.
Additionally, AntiFraudCG proposals such as WEI focus on benefits they provide to PATCG proposals. For example, a Googler with historical interest in minimising inflated view counts on YouTube[4] (a benefit to YouTube's advertisers) wrote earlier this year a proposal to AntiFraudCG including:
"By transmitting signals of legitimacy from the device’s platform, such as if the device is emulated or rooted, publishers and their technology partners could use this information in part to determine if traffic is invalid. They could then choose appropriate actions like flagging advertising actions as suspicious"[5]
[2] https://github.com/antifraudcg
[3] https://www.mozilla.org/en-US/mission/
[4] https://security.googleblog.com/2014/02/keeping-youtube-view...
Okay. So this is about validating ad effectiveness and minimizing ad fraud, right?
Assuming that's your point (apologies if I'm missing something important), what does that have to do with me or my private property?
Advertisers have business relationships with advertising platforms. Advertisers might also have a business relationship with me, assuming I choose to purchase their product(s).
But the advertising platform has no business relationship with me (assuming I'm not buying ads on that platform). As such, why do I have to give data, CPU cycles and privacy so the advertising platform can provide metrics about ad effectiveness and fraud?
None of that has anything to do with me, and I don't wish to give up those things (especially my privacy) on the devices I own.
It's unethical for these rapacious scumbags to limit what I can do on my devices (which are my private property) If I refuse to provide third (the ad platform) and fourth (the advertisers) parties specific information about who I am and what I see or don't see (which is what a permanent identifier in secure storage would do) when I visit a site of my choosing.
I'll say it again to make sure I'm clear: I don't care about advertisers or ad platforms. They can go an play with each other all they want -- but don't limit what I can do on my devices because it will make you more money. Fuck. That. Noise.
Edit: Clarified prose.
- OP responds with “what about IPA”
It's litteral whataboutism.
They don't give a single shit about my happiness, as long as I buy their product. Whether that's through a happy ad that made me laugh, or through being blasted with it every day for a year so that their brand is the only one I think of when I need to buy X.
Companies do not see you as a person. They don't even lack empathy, they didn't have any to begin with. You're a walking wallet they have to empty, by any means necessary, and if that's through making you feel that you're ugly and you should buy their new skincare, they will.
Alright, let's see the next senten-
>It's about proving to advertisement customers that their ads were seen and were useful.
So, it's about making sure that the ads that they showed me were personalized enough that they accurately target me. Ads that are built to be efficient because they create a need from a very small part in me that can normally be reasoned with. Or attack some deep seated fears to make me purchase their magic fat loss pills, that they accurately targeted because of attribution, and because of being repeatedly told how effective their blasts are.
So it's about personalization, got it.
I do recall it being common for internet ads to be sold directly like billboards back in the day, before the action model took over, especially for higher value sites that could be likened to the prime real estate of a billboard on a city square or key highway with their guaranteed literal traffic.
But such direct deals probably didn't scale well, and definitely left smaller sites wanting to earn some extra revenue in the dust. There was a time when ads weren't as shit as they are now - most wouldn't worry about a banner ad or two on their favorite forum.
The majority of companies are small to medium businesses that do actually care about their customers - when your customers are measured in thousands or less instead of billions, you will go belly up if you don't. They still use ads because how the heck would you otherwise know they even existed, and yes they want you to buy stuff but they hope you actually like the product afterwards so you end up helping them get known.
Think of it a bit like when your favorite tiny, niche YouTube channel uses clickbaity titles and thumbnails, or target the 10-15 minute mark, or use the same intro/outro format and duration as everyone else. If they didn't, no one would ever see their videos as they'd get deselected by the algorithm. No one will watch a video, or buy a product, that they do not know exists.
I'm sure OP is glad that Mozilla takes a negative position on WEI, but when they take other positions simultaneously that seem to counter their WEI positioning, that is a legitimate criticism. I share in that view.
I'm glad to see Mozilla push back in a case like this, but they need to do more, and more consistently so.
2. Great, they should do that, but good luck doing that when the data you need to audit is on a bajillion client machines.
3. People do that already
4. This became a thing a while back as a way to defeat third-party tracking blockers in browsers
5. This is literally the attribution system you're arguing against
6. They do that already. But good luck finding an ad marketplace that Google and Facebook don't have their fingers already in.
Also...
> What prevents any of the following solutions from providing assurance to advertising clients, without also destroying the Internet and general purpose computing
I was replying to a comment asking why Mozilla supports Interoperable Private Attribution (IPA). None of what I said should be taken as support for Web Integrity, which is cancer.
The pitch of modern advertising certainly seems to be 'more personalised ads are the only way to be effective'. And within that pitch, attribution is about finding out if the way an ad was personalized was indeed effective. But I am not sure I trust google and facebook when they claim "only personalized ads are effective".
Indeed
> what does that have to do with me or my private property? ... But the advertising platform has no business relationship with me
I am not convinced that you owe the advertising platform attribution. My original point was just that attribution is not about dragnet surveillance for personalizing ads. But I can try to argue why browsers should do attribution, just to interrogate the question.
Specifically, you have a business relation with whatever website you are going to that serves you ads. That website has a clear interest in helping their ad-platform attribute ads on their website. After all, that website depends on those ads for your income.
It is then within the perogative of that website to effectively say I only want to serve my website to users who will cooperate with attribution. This request is not a request for mass surveillance, because attribution is limited in what it reveals about a person. So this request could be construed as reasonable.
Given that websites have a reasonable standing to make these demands, it is reasonable for a user-agent to be able to accept these demands. Since otherwise the user for which the user-agent is acting cannot visit the website they requested the user-agent display. Of course a user-agent should let you opt out, but then websites are within their rights of refusing you access.
So far, so reasonable (or at least not completely unreasonable).
The sticking point is of-course that most website do want attribution, but don't want to block people with older browsers. So they want users to agree to give them the attribution data without giving the users anything in return. At which point a user-agent has no more business cooperating with attribution on behalf of the user.
In that case, there remains an argument of "if we don't do attribution the entire web is worse off, so we solve the tragedy of the commons by 'making the right decision' in the defaults for the user-agent". But that argument is clearly unreasonable to me.
If pissing me off after they've gotten $100 out of me means they get three other to spend $100, it's much more valuable than having me as a repeat customer. If someone found a way to triple my monthly spend but it made me miserable, said company would inevitably do it. Because if they don't, someone will come in, and eat them alive.
Advertising is purposefully inflicted misery, on all of us. The CEO of TF1, a french TV channel, called his job "selling available brain time to advertisers". That is all you are to them, whether we're talking about Coca Cola or Joe's Snoe and Foe: they want your money, because they die without it. Every company is a parasitic organism, and advertising is currently the most efficient way to spread.
Just a nit, "...that website depends on those ads for their income," not mine.
But yes, you're correct. And I do, in fact, aggressively block ads and the trackers/spyware/malware that goes with them.
And website owners are well within their rights to block me from viewing their site if (when, actually) I refuse to view their ads -- a point I've made in perhaps a half-dozen comments here on HN just in the past 12 months or so.
And I'm fine with that. For exactly the same reasons I gave for not wanting anything to do with ads/trackers/spyware running on my private property -- a site is the website owner's private property and they should be able to "charge a cover fee" (i.e., require that I view ads) to view the content of that site.
But WEI doesn't change that dynamic even a little. Rather, it forces me to give up control of my private property and privacy whether I want to do so or not.
I'd add that the "benefit" here isn't giving website owners the option to block me if I don't wish to view the ads run on their site -- they can already do that without WEI. In fact, some sites already do so. The only "benefit" AFAICT is that the ad platforms would now have enormously more information (in that they can now track me everywhere with a cryptographic signature regardless of any steps I might take to protect my privacy) to validate ad impressions and reporting metrics for the advertisers.
The result is that website owners have the same capability they've always had, but now I'm forced to subsidize some of the richest companies in the world with my electricity, CPU cycles, data, network bandwidth, browsing history, and likely my PII.
That's what I object to.
>In that case, there remains an argument of "if we don't do attribution the entire web is worse off, so we solve the tragedy of the commons by 'making the right decision' in the defaults for the user-agent". But that argument is clearly unreasonable to me.
Yes, it is unreasonable. I take great pains (I never log in/create accounts on any Google properties, block trackers and "analytics," self-host my email and content I wish to share in the Internet, etc., etc., etc.) to maintain at least a semblance of privacy, which is already a time/cost sink for me.
And these rapacious scumbags want me to jump through more hoops and run their code on my systems just so they can charge advertisers more for shit I don't want anyway? I'll say it again: Fuck. That. Noise.
tl;dr: Websites can already (and I support their ability to do so) block me (or anyone else) who runs an ad blocker from viewing their site. As such, the only folks that will have new capabiliities/benefits from WEI are ad platforms and advertisers. With whom I have no relationship whatsoever and don't want their spyware to execute on my private property.
Were you expecting only responses of praise for Mozilla, that users have been heard on WEI and therefore everyone can move on? Mozilla has invested resources together with Meta into developing the IPA proposal that also prioritises the needs of advertisers over users. The problem that IPA seeks to solve is:
"Advertisers need accurate reporting about how their ad campaigns are performing. Currently, businesses use data about the people who viewed their ads and bought their products to determine ‘return on ad spend’. But the ecosystem is moving towards more privacy and less personal data sharing."[1]
"Detecting fraud and invalid traffic is a challenging problem that we're interested in helping address."
A further error of your framing is assuming WEI and IPA proposals can be meaningfully discussed in isolation of each other. With such framing, there is an avoidance of discussion of the combined impact of proposals if they were implemented together, or whether proposals such as IPA still make sense to pursue without WEI (or future equivalent proposal).
[1] https://docs.google.com/presentation/d/1NpQz0Wm73eEKw24V7B0y...
[2] https://www.rfc-editor.org/rfc/rfc8890.html
[3] https://www.w3.org/TR/design-principles/#priority-of-constit...
[4] https://www.w3.org/TR/ethical-web-principles/#control, https://www.w3.org/TR/ethical-web-principles/#multi, https://www.w3.org/TR/ethical-web-principles/#render
Having you spend money on a product you end up liking is positive for both parties of that transaction. Imagine it's a book you like, and you recommend it to others - who then buy it too to read it. Or a song you get others to hear. That's a happy customer of an arbitrary product. Does the author or artist know who you are personally? Of course not, but they didn't need to for them to care about their customers and make something that they enjoyed.
I agree that it convenient to be able to see each ad information, but that doesn't mean that it should be this way.