#862: TAG spec review of Bounce Tracking Mitigations

Visit on Github.

Opened Jun 16, 2023

こんにちは TAG-さん!

I'm requesting a TAG review of Bounce Tracking Mitigations.

With browser vendors now actively working to remove third-party cookies from the web, some platform trackers are moving to bounce tracking. This technique involves navigating to a tracker domain at the top level of a browser tab, setting or reading a first-party cookie, and then quickly redirecting away using a request that encodes the value of that first-party cookie. Sometimes the redirect is back to the original page and sometimes to a new site. In either case, bounce tracking semantically functions like setting a third-party cookie. This explainer outlines a proposal for mitigating the privacy impact of bounce trackers.

Further details:

  • I have reviewed the TAG's Web Platform Design Principles
  • Relevant time constraints or deadlines: Q3 2023
  • The group where the work on this specification is currently being done: PrivacyCG
  • The group where standardization of this work is intended to be done (if current group is a community group or other incubation venue): N/A
  • Major unresolved issues with or opposition to this specification: N/A
  • This work is being funded by: Google

You should also know that...

N/A

We'd prefer the TAG provide feedback as (please delete all but the desired option):

🐛 open issues in our GitHub repo for each point of feedback

Discussions

Comment by @wanderview Jun 27, 2023 (See Github)

Just to clarify, I think this is intended to cover "bounce tracking mitigations" which is one part of the nav-tracking-mitigations repository. In particular, the spec is just this section of the doc:

https://privacycg.github.io/nav-tracking-mitigations/#bounce-tracking-mitigations

The privacycg chairs asked us to include it in this repo and due to bikeshed tooling support we could only have a single document in the repo. So the spec is a section within the larger report doc.

Sorry for any confusion about this!

Discussed Jul 1, 2023 (See Github)

we spend some time reviewing the explainer

Dan: good to see no dependency on FPS.

Dan: interesting to ✨ that - in ack section - lists other browser behaviour that is "aligned" with this proposal. So it's aligned but no specific feedback from those stakeholders... what do they think of this proposal?

Dan: this is happening in the privacy CG...

Amy: I think this looks good and we should ask them to ensure other browsers are aligned on this approach. I presume they looked at what other browsers have done..

Hadley: that's what they've said in the intro.

Amy: this looks like things that are what a user agent should be doing, as an agent for the user

Hi @wanderview @amaliev @jyasskin. We (@torgo @hadleybeeman @maxpassion and I) reviewed this in our virtual face-to-face this week. We're really happy to see this being worked on! The design looks good and well aligned with the [privacy principles](https://www.w3.org/TR/privacy-principles/). 

What feedback have you had from other browsers in the PrivacyCG? It's great to see that you feel the proposal is aligned with what other implementers have done, and we would be even happier to see other implementers collaborating with you on documenting this behaviour – which would give clear guidance to web developers. ✨

We're looking forward to hearing more about your progress going forward. What are your thoughts about your next steps?
Comment by @rhiaro Aug 2, 2023 (See Github)

Hi @wanderview @amaliev @jyasskin. We (@torgo @hadleybeeman @maxpassion and I) reviewed this in our virtual face-to-face this week. We're really happy to see this being worked on! The design looks good and well aligned with the privacy principles.

What feedback have you had from other browsers in the PrivacyCG? It's great to see that you feel the proposal is aligned with what other implementers have done, and we would be even happier to see other implementers collaborating with you on documenting this behaviour – which would give clear guidance to web developers. ✨

We're looking forward to hearing more about your progress going forward. What are your thoughts about your next steps?

Comment by @wanderview Aug 2, 2023 (See Github)

Thank you!

We agree that browser interop on this feature would be great and we intend to keep working on alignment with other vendors. Next steps for us:

  1. Launch our MVP and get experience in production. We hope this will provide evidence it's safe for other browsers to move beyond list-based approaches.
  2. Run additional experiments to close the gap between chrome's coverage and the coverage achieved by other browsers. (For example, triggering on http cache state)

The coming TPAC will be a good opportunity to discuss with other browser vendors.

Comment by @wanderview Aug 2, 2023 (See Github)

What feedback have you had from other browsers in the PrivacyCG?

Sorry, missed answering this.

We have official requests for feedback from other browser vendors here:

https://github.com/mozilla/standards-positions/issues/835 https://github.com/WebKit/standards-positions/issues/214

I don't want to speak for them, but I will say personally I think our interactions in privacycg on this feature have been positive.

Discussed Aug 21, 2023 (See Github)

Amy: [good comments]... Would like to ensure they work in a collaborative manner...

Hadley: could we close it saying we like the design but that we'd like to see more multi-stakeholder engagemet and we'd like to see it again when it's more mature.

agreed to close

Comment by @hadleybeeman Aug 21, 2023 (See Github)

Hi @wanderview @amaliev @jyasskin. We are looking at this again in our W3C TAG breakout session.

We are going to close this. We like the direction and design of this feature, but we note how early it is and are glad you're collaborating with other stakeholders — though we would like to see full consensus (which we understand comes later than positive interactions).

We hope you continue to work on getting that consensus. Please do open a new review when the design (and consensus) is a bit more mature.

Comment by @wanderview Sep 13, 2023 (See Github)

FYI, @Trikolon and @bvandersloot mentioned at TPAC that Mozilla is implementing this bounce tracking mitigations feature in Firefox.