FLEDGE + aggregate Attribution Reporting API

[jonasz]

Hi,

This is a follow up to #281, I'd like to start the discussion on how aggregate ARA could work with FLEDGE.

In terms of priorities, note that for RTB House the general ability to perform aggregate reporting from generateBid (on win/loss/imp/click events, as proposed in pull194@416) is critical before third party cookies go away (see also #93, #177). The FLEDGE-agg ARA compatibility discussed in this issue would be below that in terms of priorities, but still important.

The high level question I'd like to ask is:

• Could we make it possible to register aggregatable sources using all bidding signals that are available in generateBid?

The motivation behind this would be to unlock analysis and optimization of conversions based on bidding signals. (Note that "conversions" are used quite broadly here, and may actually mean any objectives that are measured on the advertiser's side.)

The solution discussed in #281, while satisfactory for the event-level case, would not work here - the bidding signals are not accessible in the Fenced Frame.

I anticipate there will be some technical details to work out (e.g. how to manage the privacy budget across win/loss/imp/click and conversion reporting), but I think it's best to start with a high level discussion on the general idea.

Best regards,
Jonasz

[appascoe]

See also #145 and #116 .

[csharrison]

Thank you for filing this issue. The newest iteration of the Attribution Reporting API is configured using response headers. I wonder if we can take advantage of that with the existing FLEDGE reporting system.

Currently reportEvent fires a beacon with:

• the URL configured by contextual information
• the body configured by within-a-fenced-frame data

A server receiving this ping gets the join of this information. One way to send that information to the Attribution subsystem is to have the site response to the reportEvent beacon with an HTTP response that sets the appropriate Attribution-Reporting-* headers (link, agg-extension link).

This technique would work for both event and aggregate registration. Here are the gaps I see:

1. Currently, we look for some request header Attribution-Reporting-Eligible to make the request eligible. We would need to tag the reportEvent request with this request header (or make reportEvent support developer-added headers).
2. Implementation considerations to make sure that reportEvent is observable by the Attribution system. I think this should be the case but I am not an expert on reportEvent.

Let me cc @linnan-github, @shivanigithub, and @johnivdel as well. It seems like this has benefits over the approach outlined for event-level reports (#281) in that this one doesn't require a server-side join and also supports aggregation keys combining contextual and ads-specific.

[csharrison]

One possible concern with the above formulation is that there may be parties interested in aggregate reporting that aren't present on the beacon's redirect chain, but are present within the Fenced Frame. On first glance, this seems like it makes the event-level solution more appealing: anyone in the FF can use it! However, for third parties that want a combination of contextual and per-ad signals, there is no getting around the coordination required with the buyer/seller I think.

In this design: entities getting reportEvent pings need to explicitly redirect to other parties that want to register sources.
In the event-level design: 3Ps configuring sources for event-level measurement need to coordinate with the reportEvent entity to do the contextual join.

Given that this coordination seems (somewhat) fundamental, I think this design feels better overall to me.

[jonasz]

Hi Charlie,

It seems this approach could work for the event-level case.

For the aggregate case, though, the problem would be that reportWin does not have access to all the signals we would like to use to construct aggregatable reports. The input to reportWin is limited in this way by design, to satisfy privacy requirements for event-level reporting.

In general, it seems to me that a solution based on a ping to a buyer's server will not work for the aggregate case: the signals available in the request would have to be limited to preserve privacy - and that defeats the main advantage of aggregates over event-level reports. (Being able to use more signals for source registration than are available in event-level reporting is really the main point of this issue.)

Let me know if this makes sense, it'd also be interesting to hear from the Chrome team that works on FLEDGE, if this is also how they see it.

[csharrison]

I see, thanks. Essentially the issue with the design I outlined is that the beacon URL will not contain enough information because it is only configurable from within reportWin. I agree that is worth improving, although indeed I am not an expert on how exactly reportWin is limiting information for privacy (in the short or long term).

I suppose what I outlined is still a measurable improvement over just raw aggregatable attribution reports configured from within the fenced frame (which is the proposed solution using the event-level attribution reports), in that you get fenced frame information and all the (limited) information within reportWin.

[csharrison]

Hey @jonasz I have a strawman proposal to kick off the discussion here. Let me know what you think. The high level idea is:

• Add an API to FLEDGE’s generateBid to pre-register an aggregatable source event, that will be registered at a later point in time
• Add an API to Fenced Frames to “finalize” and register specific events pre-registered in generateBid
  With the end result being a generic mechanism to register sources

function generateBid(...) {
  // ... generate bid code
  attributionReporting.registerPendingAggregatableSource({
    // What kind of event will finalize this source’s registration. If multiple events
    // need different metadata, you can pre-register separate sources.
    eventType: "click",
    // Matches the Attribution-Reporting-Register-Source header more or less.
    attributionSrc: {
      destination: "https://advertiser.example",
      aggregation_keys: {
        key1: "0x123",
        key2: "0x456",
      },
      priority: "[64-bit signed integer]",
      aggregatable_expiry: "[64-bit signed integer]",
      filter_data: {...},
      ...
    },
  }
  return {...};
}

These sources will be actually registered when an accompanying event comes from the Fenced Frame.

// Within Fenced Frame. Should not require user activation.
window.fence.registerAttribution("click");

At this point, the source associated with the “click” event will be registered according to the FLEDGE buyer’s origin, i.e. the origin of generateBid. We could also support reserved events like “reserved.win” which would fire automatically when then bid wins.

Let me know what you think! I'd also be happy to discuss this in either of the WICG calls for {ARA, FLEDGE}.

[fhoering]

Hello @csharrison,
Thanks for the proposal. At Criteo we are very interested in this discussion. Please let us know when this will be discussed at the Fledge or ARA meeting.
Some questions:

• Our understanding is that ARA strictly requires an event on advertiser side. So we could track (landed) clicks, sales, .. What about the convergence with what has been proposed with the private aggregation API (https://github.com/patcg-individual-drafts/private-aggregation-api) ? In particular how to track reportwin/reportloss/viewability/click (non landed events) ? Both APIs seem not to be fired at the same place computeBid vs reportWin , as said before the interest group is not available in reportWin for the moment
• In computeBid we have access to the interest group, perBuyerSignals and and contextual signals. So it seems good for some contextual dimensions like day, domain but also for advertiser signals like purchasing power, gender, user context (i.e. Buyers) and their combinations.
  What about metrics like PreviousDisplays and PreviousClicks ? What about metrics that indicate the total number of users for an ad like reach and audience size ?

[csharrison]

Hey @fhoering , I actually put this on the agenda for today's FLEDGE discussion in 1.5 hours (agenda doc). I'm also happy to discuss it in another venue if you can't make it.

A few brief responses:

Our understanding is that ARA strictly requires an event on advertiser side. So we could track (landed) clicks, sales, .. What about the convergence with what has been proposed with the private aggregation API (https://github.com/patcg-individual-drafts/private-aggregation-api) ? In particular how to track reportwin/reportloss/viewability/click (non landed events) ? Both APIs seem not to be fired at the same place computeBid vs reportWin , as said before the interest group is not available in reportWin for the moment

We are thinking through more advanced uses of the Private Aggregation API beyond what is in the explainer currently. For now I'd prefer to keep the discussions separate and focus just on ARA for this issue. I do think there is room for alignment here on API surface though.

In computeBid we have access to the interest group, perBuyerSignals and and contextual signals. So it seems good for some contextual dimensions like day, domain but also for advertiser signals like purchasing power, gender, user context (i.e. Buyers) and their combinations.
What about metrics like PreviousDisplays and PreviousClicks ? What about metrics that indicate the total number of users for an ad like reach and audience size ?

Just to clarify, these are metrics that you want in an ARA report, right? I'd need to think more about metrics like PreviousDisplays / PreviousClicks. These seem innocent enough but the privacy model quickly gets hard to reason about. With those metrics in a FLEDGE ARA report, suddenly a report embeds information from arbitrarily many other sites (e.g. other sites the ad showed up on). We will need to analyze this to make sure it's OK to release.

For reach, can you explain the use-case with respect to ARA?

[fhoering]

For reach, can you explain the use-case with respect to ARA?

Let's say I do a retargeting campaign to an advertisers buyers.
"audience size" would be the number of my distinct users that bought something on my website.
"reach" would be the effective number of users on which this campaign delivered in %. If I bid very high the reach would be very high because I win all displays for those users, so it could be close to 100%.
All those metrics are aggregated, so normally there is no problem with exposing user information (as long as my campaign doesn't target one individual user).

[csharrison]

"reach" would be the effective number of users on which this campaign delivered in %. If I bid very high the reach would be very high because I win all displays for those users, so it could be close to 100%.

The Attribution Reporting API is all about joining together the the purchase and the ad view in one report, so reach measurement is out of scope for it at the moment. I think those use-cases are best considered for the Private Aggregation API.

[csharrison]

We discussed this on the call today and it seemed like there might be a few use-cases where a slightly more sophisticated API in the fenced frame could be useful. Two mentioned on the call were fraud signals and "which product got clicked".

As a strawman, here's a slight augmentation to the proposal above which captures these use-cases:

window.fence.registerAttribution("click", {"keyname": <keypiece>, ...});

This allows the fenced context to bit-wise OR a bunch of keys associated to the pending report for the "click" event. This should allow for use-cases like injecting a product ID or fraud signals.

My only concern with this (beyond the added complexity to the API) is in considering the untrusted fenced frame case, since this allows the fenced frame to trash your registration and give you bad data. The simplest way to mitigate this would be a per-pending-source permission to allow or ignore future mutations. Something like this:

  attributionReporting.registerPendingAggregatableSource({
    eventType: "click",
    registrationPolicy: "immutable" // or "mutable"
    attributionSrc: {...}});

I didn't include this in the original strawman due to the added complexity, but if it's really useful we can consider it.

[johnivdel]

My only concern with this (beyond the added complexity to the API) is in considering the untrusted fenced frame case, since this allows the fenced frame to trash your registration and give you bad data. The simplest way to mitigate this would be a per-pending-source permission to allow or ignore future mutations.

Unless we made the policy more granular, e.g. an origin-level policy, there is ample opportunity for 3Ps within a creative to mess with the registration.

One idea would be to require the script calling window.fence.registerAttribution to be same-origin with the winning bids bidding script (the origin which called registerPendingAggregatableSource in the first place).

From a security perspective, it would also be stronger to require this to be called from a same-origin context (which could be an iframe within the fenced frame, or the fenced frame itself if it is to a bidders origin).

This also solves the pre-existing problem of a rogue script triggering registration without the reporting origin's consent.

Another idea:

You could imagine reversing the data flow where the Fenced Frame is responsible for the source registration itself, but allow them to "insert" data that was declared as part of the auction. Something along the lines of within the auction call:

attributionReporting.registerAggregatableDataFromAuction({{"keyname": <keypiece>, ...}});

Within the FencedFrame, we would support traditional registration via HTTP headers but allow a source to optionally register with:

Attribution-Reporting-Register-Source:
{
  ....
  "use_auction_key_pieces": bool
}

This may also allow for more interop between the bidder and 3P trackers in the frame if they can standardize on the key pieces.

[csharrison]

One idea would be to require the script calling window.fence.registerAttribution to be same-origin with the winning bids bidding script (the origin which called registerPendingAggregatableSource in the first place).

I like this restriction. I guess the big question is how many FLEDGE users are going to be running ads in fenced frames where this is easy to do.

Within the FencedFrame, we would support traditional registration via HTTP headers but allow a source to optionally register with:

I considered something like this but I am nervous about long-term solutions which rely on network working in the Fenced Frame, given that it is considered temporary:

The TURTLEDOVE privacy goals mean that this cannot be the long-term solution. Rendering ads from previously-downloaded Web Bundles, as originally proposed, is one way to mitigate this leakage. Another possibility is ad rendering in which all network-loaded resources come from a trusted CDN that does not keep logs of the resources it serves.

If we're not using header-based solutions, we'd need 3ps to register with JS in their own security context (e.g. iframe) which is a tough lift. In any case, I think 3Ps will need the bidding signals, which implies extremely tight coordination with the buyer. If we have that tight coordination as a precondition, there may be other techniques we can consider.

[jonasz]

Hi,

To follow up on the last FLEDGE call, let me reiterate that this looks very promising in my view.

I'd like to make sure I understand the proposed API well. For context, let me list some example use cases:

1. Calculate total spend that happens on advertiser's page after an ad click on product category X.
   • (This is a specific example of "which product got clicked" use case.)
2. Optimizing campaign's configuration to maximize conversion value, with respect to various signals, for example the Interest's Group age.
   • Example question: what is the average conversion value when IG.age < 1day, and what is it when IG.age < 7days?
3. Calculating "effective bounce rate" (per publisher domain): how many ad clicks are followed by significant engagement on advertisers side?
4. View through engagement. How many advertiser's page visits were there, coming from users that saw a certain ad? (For sake of simplicity let's not think about unique users now.)

I was thinking about how to best use the proposed API to satisfy these example use cases, and that leads me to a couple questions:

• a. How many sources may we register for a single ad impression? (Actual sources, not pending sources.)
  • Would the recommended approach be to have a separate source, and a separate accompanying trigger on the advertiser side for each use case? Or should we rather have a single source with multiple aggregation_keys?
• b. For each such source, how many triggers can it be matched with? Should we, in the FLEDGE setting, distinguish between navigation and event sources?
• c. What happens if we call window.fence.registerAttribution twice with the same identifier? (As is likely for use case 1.)

When it comes to the "untrusted FF" problem - if I understood your concerns correctly - FWIW, in our case, we are working with renderUrls (Fenced Frame's source) that match the biddingUrl's origin.

Best regards,
Jonasz

[csharrison]

a. You may register multiple sources, but they will "compete" for attribution in that we only pick a single source to attribute when there is a matching trigger. This may be tolerable in some cases (e.g. you register both a view-through and a click-through, with the expectation that the click-through will be the last-touch / highest priority source). We suggest using multiple aggregation keys to measure multiple use-cases for the same source.

b. Currently there is no limit on the number of triggers a source can match with. The effective limit is imposed by the overall value contribution bound, which is tracked per source. Once that budget runs out then further triggers are effectively no-ops. This allows the ad-tech to choose to trade-off variance vs. bias, in that for so-called "many-per-click" models, running out of budget is like data truncation, but capturing more conversions leads to more effective noise per conversion.

For aggregatable reports, we don't in the browser have a strong distinction between click and view (i.e. the privacy mechanism is the same). This is a more important distinction for event-level reports.

c. Good question, I think it's up in the air right now :) Can you elaborate on why use-case (1) requires this?

When it comes to the "untrusted FF" problem - if I understood your concerns correctly - FWIW, in our case, we are working with renderUrls (Fenced Frame's source) that match the biddingUrl's origin.

Thanks this is a useful data point.

[csharrison]

BTW @jonasz you mentioned in the meeting that as currently written you'd register a lot of pending sources with a lot of redundancy. Would you mind sharing an example? I am currently brainstorming options for reducing redundancy and it would help me.

[jonasz]

a. When it comes to competing for attribution, could that be addressed with filters? (Each use case could get its specific filter value, both on source and trigger side?)

b. Makes sense, thanks.

c. In case 1, we have no way of coordinating between product fenced frames, so we have no way to check if registerAttribution has already been called from a different fenced frame. I think it's necessary to specify what happens when we call it multiple times. Let me think about it some more, and see if we have a preference here.

When it comes to redundancy - this is exactly the case 1 - we'd potentially have to register a pending source for each product. It seems that the mechanism with supplying a keypiece from within the fenced frame would address that.

[csharrison]

a. No, attribution filters as they are currently specified do not affect which source matches the trigger. See 10.6.5 in the spec which happens prior to filtering. This is done for privacy reasons, because allowing a rich declarative language to determine how attribution could work can leak unexpected data, especially in the event-level case (you can imagine choosing an event-level source out of many based on the advertiser's user data).

c. Ack gotcha.

When it comes to redundancy - this is exactly the case 1 - we'd potentially have to register a pending source for each product. It seems that the mechanism with supplying a keypiece from within the fenced frame would address that.

A mechanism that just supplies a single keypiece has the problem that we need to know how to apply it to a list of keys, unless we apply it indiscriminately to all of them, but I think I understand the use-case (something like aggregate splits by product)

[csharrison]

@jonasz mentioned in the FLEDGE call today that any solution we have in generateBid should be amendable to multiple calls to setBid. This seems fairly straightforward to solve if we allow subsequent calls to registerPendingAggregatableSource to overwrite any existing pending source with the same eventType. By the time the auction is over, we'd lock the pending sources and just use the most recently set sources.

@jonasz : does that work for you?

cc @alexmturner

[jonasz]

Hi Charlie, sorry for the delay.

One potential issue is that generateBid may time out between the call to setBid and the corresponding registerPendingAggregatableSource. To the extent we can minimize the chances of this happening, it'd be great. (Ideally, if possible, we would do this "atomically" - call setBid and pass it all the aggregatable sources along with the bid, if that doesn't complicate the APIs too much on your end.)

From the functional perspective, it'd be useful to ensure we can also remove a pending source. (Maybe overwrite with a null as the value?)

Best regards,
Jonasz

[michal-kalisz]

Hi,
It seems that there hasn’t been much activity on this issue lately. It appears that most of the details have been covered. Is there anything else that needs clarification?
Regarding the proposed functionality, do you think it could be implemented?
We’d appreciate your insights on this matter.

BR,
Michal