Design Review #862

#862: TAG spec review of Bounce Tracking Mitigations

Opened Jun 16, 2023

こんにちは TAG-さん!

I'm requesting a TAG review of Bounce Tracking Mitigations.

With browser vendors now actively working to remove third-party cookies from the web, some platform trackers are moving to bounce tracking. This technique involves navigating to a tracker domain at the top level of a browser tab, setting or reading a first-party cookie, and then quickly redirecting away using a request that encodes the value of that first-party cookie. Sometimes the redirect is back to the original page and sometimes to a new site. In either case, bounce tracking semantically functions like setting a third-party cookie. This explainer outlines a proposal for mitigating the privacy impact of bounce trackers.

Explainer¹ (minimally containing user needs and example code): https://github.com/privacycg/nav-tracking-mitigations/blob/main/bounce-tracking-explainer.md
Specification URL: https://privacycg.github.io/nav-tracking-mitigations/
Tests: None. (Our algorithm runs on a long timer, and there is no support for moving the clock forward in WPT tests.)
User research: N/A (some additional background in Google-internal doc)
Security and Privacy self-review²: https://github.com/privacycg/nav-tracking-mitigations/blob/main/tag-privacy-security.md
GitHub repo (if you prefer feedback filed there): https://github.com/privacycg/nav-tracking-mitigations
Primary contacts (and their relationship to the specification):
- [Jeffrey Yasskin] (jyasskin, Google): Primary spec author and reviewer
- [Ben Kelly] (wanderview, Google): Primary spec author
- [Anton Maliev] (amaliev, Google): Spec contributor
Organization(s)/project(s) driving the specification: Google, Privacy Sandbox
Key pieces of existing multi-stakeholder review or discussion of this specification: N/A
External status/issue trackers for this specification (publicly visible, e.g. Chrome Status): N/A

Further details:

I have reviewed the TAG's Web Platform Design Principles
Relevant time constraints or deadlines: Q3 2023
The group where the work on this specification is currently being done: PrivacyCG
The group where standardization of this work is intended to be done (if current group is a community group or other incubation venue): N/A
Major unresolved issues with or opposition to this specification: N/A
This work is being funded by: Google

You should also know that...

N/A

We'd prefer the TAG provide feedback as (please delete all but the desired option):

🐛 open issues in our GitHub repo for each point of feedback

Discussions

2023-07-mos-eisley

Minutes

we spend some time reviewing the explainer

Dan: good to see no dependency on FPS.

Dan: interesting to ✨ that - in ack section - lists other browser behaviour that is "aligned" with this proposal. So it's aligned but no specific feedback from those stakeholders... what do they think of this proposal?

Dan: this is happening in the privacy CG...

Amy: I think this looks good and we should ask them to ensure other browsers are aligned on this approach. I presume they looked at what other browsers have done..

Hadley: that's what they've said in the intro.

Amy: this looks like things that are what a user agent should be doing, as an agent for the user

Hi @wanderview @amaliev @jyasskin. We (@torgo @hadleybeeman @maxpassion and I) reviewed this in our virtual face-to-face this week. We're really happy to see this being worked on! The design looks good and well aligned with the [privacy principles](https://www.w3.org/TR/privacy-principles/). 

What feedback have you had from other browsers in the PrivacyCG? It's great to see that you feel the proposal is aligned with what other implementers have done, and we would be even happier to see other implementers collaborating with you on documenting this behaviour – which would give clear guidance to web developers. ✨

We're looking forward to hearing more about your progress going forward. What are your thoughts about your next steps?

2023-08-21

Minutes

Amy: [good comments]... Would like to ensure they work in a collaborative manner...

Hadley: could we close it saying we like the design but that we'd like to see more multi-stakeholder engagemet and we'd like to see it again when it's more mature.

agreed to close