Mozilla slams post-cookie ad tech proposals SWAN and UID2 - needs much more work
- Reference: 1628194766
- News link: https://www.theregister.co.uk/2021/08/05/mozilla_postcookie_ad_tech/
- Source link:
Third-party cookies – files deposited by code on websites to track people online and serve them targeted ads – are on their way out, eventually. Google and the rest of the online ad industry have been working feverishly to come up with replacement technology that allows the lucrative business of ad targeting to continue in a way that preserves user privacy, at least enough to satisfy regulators.
Google and its ad tech allies are doing so through a set of proposals referred to as the Privacy Sandbox, which have [1]suffered some setbacks .
[2]
Rival ad firms, worried that Google's next-generation ad targeting scheme will leave them at a disadvantage because of all the data the search giant can bring to bear from its widely used online products and services, have put forth a separate set of proposals to shift the center of gravity in the ad targeting business away from Google while accommodating regulatory concerns and fostering a competitive environment more to their liking.
[3]
[4]
[5]SWAN (Secure Web Addressability Network) and [6]Unified ID 2.0 represent two bids to replace third-party cookies outside Google's Privacy Sandbox.
SWAN is backed by 51Degrees, Engine Media Exchange, OpenX, PubMatic, Rich Audience, Sirdata, and Zeta Global – and is not to be confused with [7]SWAN (Storage With Access Negotiation), a separate proposal within the Privacy Sandbox backed by European data management platform 1plusX.
[8]
Unified ID 2.0 is backed by The Trade Desk, Criteo, Magnite, OpenX, Oracle, and [9]many others .
Both SWAN and Unified ID 2.0 aspire to provide each web user with a pseudonymous identifier that ad companies can use for tracking and targeting. And as Mozilla sees it, both fail.
"From a purely technical standpoint, these proposals are a regression in privacy in that they allow tracking of users who are presently protected against tracking," said Mozilla CTO Eric Rescorla and distinguished engineer Martin Thomson, in their assessment of the two projects
[10]PDF
. "Moreover, the techniques used here – especially redirect tracking but also identifier-based tracking – are already ones which most major browsers attempt to prevent."[11]
SWAN imagines a system of intermediaries – operators – who oversee the mapping of users to pseudonymous identifiers and ask internet users for tracking consent, all subject to policy rules referred to as [12]Model Terms .
[13]Privacy proves elusive in Google's Privacy Sandbox
[14]Google promises its days as a cold-eyed API-killer are behind it
[15]Google updates timeline for unpopular Privacy Sandbox, which will kill third-party cookies in Chrome by 2023
[16]Google herds FLoC back to the lab for undisclosed post-third-party-cookie ad tech modifications
Unified ID 2.0 takes a simpler approach by using email addresses as an initial value that gets salted and hashed to form a pseudonymous identifier.
The problem Mozilla sees with these systems is that both require participants to abide by policies without offering any way that internet users can confirm compliance and both deliberately take steps to bypass anti-tracking protection built into browsers.
The Register contacted James Rosewell, CEO of digital services company 51Degrees and a SWAN.community founder, while on holiday for comment. But he asked that we commit to running his remarks unedited or with any edit subject to his approval – not something The Register does. Suffice to say that he disagrees with Mozilla's conclusions and argues browser makers alone should not decide how the web works.
In a message to The Register , Zach Edwards, co-founder of web analytics biz Victory Medium, said he largely agreed with Mozilla's takedown of SWAN.
"It's slightly odd that Mozilla combined UID2 + SWAN into one paper, but that, in my opinion, is a huge snub by Mozilla of these two growing standards, and proof that Mozilla wants to compete with the Chromium browsers for privacy," he said. "Basically Mozilla saying we can't have policies that dictate trust, we must build technical walls that don't allow nuance or require [17]trust-falls ." ®
Get our [18]Tech Resources
[1] https://www.theregister.com/2021/07/29/google_privacy_sandbox_fledge/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQxflDiGhmPLFCf@37TCTgAAAIs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQxflDiGhmPLFCf@37TCTgAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQxflDiGhmPLFCf@37TCTgAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://swan.community/
[6] https://www.thetradedesk.com/us/about-us/industry-initiatives/unified-id-solution-2-0
[7] https://github.com/1plusX/swan
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQxflDiGhmPLFCf@37TCTgAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.thetradedesk.com/us/about-us/industry-initiatives/unified-id-solution-2-0/unified-id-2-partners#Data%20&%20Measurement%20Partners
[10] https://mozilla.github.io/ppa-docs/swan_uid2_report.pdf
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQxflDiGhmPLFCf@37TCTgAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://github.com/SWAN-community/swan/blob/main/model-terms.md
[13] https://www.theregister.com/2021/07/29/google_privacy_sandbox_fledge/
[14] https://www.theregister.com/2021/07/27/google_enterprise_apis/
[15] https://www.theregister.com/2021/07/26/google_privacy_sandbox_roadmap/
[16] https://www.theregister.com/2021/07/08/google_floc_changes/
[17] https://en.wikipedia.org/w/index.php?title=Trust_fall&oldid=981118606
[18] https://whitepapers.theregister.com/
Replacements for cookie-based tracking still pose privacy problems
Using the words privacy and tracking in the same sentence is, well, a contradiction. How the hell do you track a person with that person's privacy intact? Privacy means that you do not know about the person, hence you cannot track.
All these discussions about "intact" privacy while being tracked is a distraction. It is an impossibility; a contradiction. It is a sham of a discussion as long as the discussion cannot be honest about the meaning of both privacy and tracking. It is either/or; you cannot have both. In other words, you cannot have and eat the cake at the same time.
Politicians successfully legalised corruption by simply renaming it to lobbying. I think Ad companies are aiming at using the same trick.
I am sure many people will be fooled by this logic: "As long as they don't know it is me, I am fine being tracked."
Some of the cake, some of the time.
Yeah, though it's not binary. What they want is to be able to eat MOST of the cake(and for free), instead of none of the cake or all of the cake.
As usual it's a misdirection, just like the useless "do not track flag" that Mozilla already sold it's users out for. Don't implement real tracking protection for a decade and we'll agree to a voluntary flag that is off by default and there are zero penalties for ignoring. That worked out well.
The real terms should be, if you want my browsing history, stop stealing it, bloody pay ME for it, at the rate I set, or get buggered. Mozilla could broker that and actually have a revenue stream, as well as submitting alternate payments to websites for an add free browsing experience, but it seems they'd rather keep playing Pocket pool with themselves instead.
Good to see Mozilla stopped buying magic beans though. It's too late sadly, their share of the browser market is a rounding error at this point, but at least they can bark at Google right?
I'd like to float a new proposal
SCUM, the Sneaky Cache for User Manipulators. It pretends not to track you, while actually just tracking you. There is a premium version which reverses that, and pretends to track you, and feeds fake info to advertisers. Next year will see the release of the Platinum tier which will reverse the reversal.
The first 100 platinum subscribers will also get a free trace buster buster plus, a hand exerciser, and a signed poster of Avery Brooks.
Ban
Firefox should bundle the browser with Ad Blocker turned on by default.
They should also reject all this tracking nonsense.
These things should be opt-in only with a big red warning.