POV: Privacy Preserving Ad Click Attribution

Jun 10, 2019

Background

Apple recently stated that it is proposing a new “Privacy Preserving Ad Click Attribution” standard with the World Wide Web Consortium (W3C), in the hopes of creating a new standard for in-browser advertising measurement. 

This announcement, along with their upcoming ITP 2.2, moves Apple further toward disallowing advertisers from tracking individuals across websites from within Safari browser environments. Furthermore, this new development appears to widen the moat between Cupertino and the rest of the advertising ecosystem, reinforcing what many believe to be the company’s strategy of disambiguating advertisers from their target consumers.

As it turns out, while reducing the ability to track and attribute clicks and conversions to the same individual, this latest move introduces risk and reduces transparency in the advertising marketplace.

What is happening?

With Privacy Preserving Ad Click Attribution, Apple is proposing a fundamental change to online advertising.

Currently, when a consumer clicks on an ad and buys something online, several parties are made aware of the events and can potentially tie the two events back to the individual. For example, if you see an ad online, parties including the advertiser who buys the ad, the publisher who places the ad, and the ad network that hosts the ad are all able to track these events and profile individuals, whether they completed a purchase or not.

Apple believes that these various parties do not need to tie the action back to an individual; it should be enough to know an ad was clicked on in order to track aggregate performance (rather than individual behavior).  Therefore, Apple is proposing a system whereby advertisers and publishers can share click data with subsequent conversion data 24-48 hours later for the narrow purpose of reporting aggregate campaign results, hence “Ad Click Attribution” that preserves privacy.

What does this mean?

While still in the early days, Privacy Preserving Ad Click Attribution signals a major shift in the way ads are served and measured. This approach is fraught with many issues.

  • Frequency capping: Firstly, it would appear as if this method of tracking advertising clicks and disallowing tracking of exposures removes the ability of an advertiser to limit the number of times someone sees an ad. With the removal of click-tracking, frequency capping is rendered impossible.
  • Optimization: Since there is no real-time measurement, optimizing display ads will be constrained—if not impossible—due to limited tracking and measurement.
  • IAB’s SafeFrame: This technology for sandboxing content, which is how the overwhelming majority of online ads are shown, would not be supported in this framework.
  • Click and conversion data not sent to advertiser: Under the current proposal, attribution data is sent by the browser to the publisher and is hidden from the advertiser. This means that measurement will be in the hands of publishers and SSPs, which introduces the potential for ad fraud.
  • Ad verification and fraud: Perhaps most importantly, reliance on attribution calls are unreliable and prone to fraud.

Within the proposed system, when a user clicks on an ad, it must indicate a target page. When a conversion happens, a tracking pixel is sent from the target page to the publisher site that ran the ad. When the browser finds a match between the click and the conversion, an “attribution” request is sent to the advertiser to indicate that the conversion happened following a click on an ad on the publisher site. Throughout this exchange, any identifiers are disallowed except for the campaign ID and a value containing the conversion data.

The issue here is with the last step, where attribution data is passed. The framework purports that the browser must make the request if there’s a match, which can easily be forged from another environment. This means that any publisher having a conversion tracking pixel on the advertiser site can claim attribution for the conversion.

Since this attribution request is initiated 24 to 48 hours following a conversion, there’s no way for the advertiser to validate if this request is made from the browser following a legitimate click. The publisher can simply log the pixel call from the advertiser and claim a conversion from another environment. Sadly, there is no obvious way to guard against this.

Moreover, any third party can claim forged attribution calls at a high rate to make a legitimate publisher appear to be fraudulent.

As of the writing of this POV (May 31, 2019) none of these issues have been addressed.

What can IgnitionOne do?

New privacy initiatives across the industry show no signs of slowing down and are threatening to upend the status quo for advertisers, publishers, and ad networks. The issues that face advertisers as a result of this feature are widespread and affect everyone in the ecosystem. Therefore, no single vendor will ever have a solution to this. Vendors and others in the ecosystem could come together to find a solution, and so the work of the Advertising ID Consortium may offer some promise.

In the meantime, partnering with IgnitionOne can significantly mitigate the impact of technologies that limit browser-based tracking.

To start, IgnitionOne has been preparing for diminished access to browser-based cookies, investing heavily in identity resolution (IDR) technologies that tie together a customer’s online behavior across channels, devices, and sessions. By targeting customers as individuals rather than cookies across their devices, IgnitionOne hopes to mitigate the effects of this change on marketers’ ability to personalize websites and online advertising beyond Safari environments.

With the ever-quickening pace of change in online advertising today, it is more critical than ever for marketers to find partners who are equipped not only with technology to mitigate disruptive developments, but who also have experienced managed services teams who can coach and lead the enterprise through any transition. With nearly two decades of experience, IgnitionOne’s services teams are recognized experts in customer targeting and online advertising and can help plan for a future where browser-based tracking becomes ever more limited.

Get more information

Want to learn more about Privacy Preserving Ad Click Attribution, ITP 2.2, or about the developments in customer privacy in general?

Get in touch with IgnitionOne today.

Share This