Intent to Experiment: First "Locally-Executed Decision over Groups" Experiment (FLEDGE)
Paul Jensen
Contact emails
paulj...@chromium.org, kle...@google.com
Developers interested in the FLEDGE API can also join the FLEDGE API announcements group for updates and announcements.
Explainer
https://github.com/WICG/turtledove/blob/master/FLEDGE.md
Specification
May be heavily influenced by origin trial feedback, so not yet started.
Summary
FLEDGE provides a privacy advancing API to facilitate interest group based advertising. FLEDGE shifts the interest data and the final ad decision browser-side instead of server-side, offering many advantages: strong privacy guarantees, as well as time limits on group membership, transparency into how the advertiser interest groups are built and used, and granular or global controls over this type of ad targeting.
Blink component
TAG review
https://github.com/w3ctag/design-reviews/issues/723
(The first “F” and last “E” in FLEDGE stand for First Experiment, as such FLEDGE specifies a prototype for ads serving in the TURTLEDOVE family, so the TAG review request was made for the overall family, TURTLEDOVE, rather than the first experiment specification, FLEDGE.)
TAG review status
Pending
Risks
Interoperability
Gecko: No signal
WebKit: No signal
Edge: Edge is also exploring interest group based advertising, namely with the PARAKEET proposal. PARAKEET shares much of its API with FLEDGE but has a different trust model. Deployment experience is necessary to inform the choice between the trust models.
Web developers: Significant interest from many web advertising technology developers. WICG FLEDGE calls are heavily attended. Interest in FLEDGE is further evidenced by the many related discussions and proposals that FLEDGE design draws from, most notably:
The original TURTLEDOVE from Chrome.
SPARROW from Criteo.
Outcome-based TURTLEDOVE and Product-level TURTLEDOVE from RTB House.
Dovekey from Google Ads.
PARRROT from Magnite.
TERN from NextRoll.
Compatibility and WebView Application Risks
FLEDGE does not deprecate or change existing web behavior, so there should be no compatibility risk.
Activation
Successful testing of FLEDGE in-browser ad auctions requires participation from both parties selling ad space and advertisers buying ad space. This level of cooperation during an origin trial is a heavy lift, but one that seems feasible given the high level of interest we’ve seen from ad techs.
Security
FLEDGE involves downloading and running JavaScript functions, referred to as worklets. Chrome runs worklets from different origins in separate processes in very constrained environments to limit security vulnerabilities. You can read more about these constraints and security considerations here.
Privacy
Unlike third-party cookies which are readable across sites, FLEDGE intends to keep interest group information from being exposed to sites. For example this is why there is no navigator.getAdInterestGroups() API. FLEDGE worklets, which can read individual interest groups, are isolated and cannot access the network, access storage or postMessage() to other contexts. As the proposed first FLEDGE origin trial details document discusses, this first origin trial will not initially enable all of the isolation and privacy controls in order to ease developer testing. Over time, these privacy protections will be added as we introduce new releases. To protect user privacy and honor user choice, we will not enable this first origin trial for users that have disabled 3rd party cookies. We anticipate that this will also help ad-techs to more realistically compare their existing ad selection methods relying on third-party cookie availability. Privacy considerations for the overall TURTLEDOVE family are discussed here.
Browser Performance
If advertisers place users into large numbers of interest groups, there is a risk of on-device FLEDGE ad auctions consuming excessive amounts of processing resources which could make the auctions introduce significant latency into the ad serving process, or slowing down the overall browsing experience. This is an area of intense discussion, investigation, and improvement.
Goals for experimentation
Shifting interest data and final ad decision browser-side instead of server-side represents a major shift in interest group based advertising. We hope to get feedback from ad tech on FLEDGE’s effectiveness and performance.
Experiment Configuration
The origin trial for this experiment will be shared among various Privacy Sandbox APIs. Our goal is to allow for coordinated experiments to be run by multiple different sites, across multiple APIs in one OT.
This shared origin trial, Privacy Sandbox Ads APIs, will be a third-party origin trial. To ensure that developers can run coordinated experiments without concern for exceeding page load usage thresholds, this Origin Trial will be available for a subset of users by default. Therefore, it will be necessary to feature test to ensure that the API surface you want to use is available after providing your OT token. A second advantage of this configuration is that different experimenters will experiment with the same users, which enables coordination for APIs like FLEDGE across third parties.
Ongoing technical constraints
FLEDGE depends on several other in-development web technologies, e.g. Fenced Frames, trusted key-value servers, and aggregate reporting. To ease developer testing and measurement, this first FLEDGE origin trial will not require use of these other in-development web technologies. For details of exactly what we’re proposing including in this first FLEDGE origin trial and why please read https://github.com/WICG/turtledove/blob/main/Proposed_First_FLEDGE_OT_Details.md
Debuggability
FLEDGE worklets can be debugged in Chrome’s Developer tools, instructions here.
FLEDGE interest groups can also be viewed in Chrome’s Developer tools: in the "Application" tab, there is an "Interest Groups" item on the left side-bar that, when clicked, should display all interest groups that this page interacted with, e.g. when a page joins/leaves an interest group, bids on an auction, or wins an auction on this page then the interest group should show up.
Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?
No, this origin trial will be supported on all platforms except Android for reasons discussed here.
Is this feature fully tested by web-platform-tests?
No. More web-platform-test coverage is expected when the specification is closer to completion.
Flag name
privacy-sandbox-ads-apis
Requires code in //chrome?
Nearly all code is outside //chrome, the exception being the related Privacy Sandbox Settings UI.
Launch bug
https://bugs.chromium.org/p/chromium/issues/detail?id=1181739
Estimated milestones
We hope to start the Origin Trial sometime during M101 beta. We plan to continue the Origin Trial until at least M104 to give developers time to test the API and provide feedback. Once we are confident that the APIs are working properly, we will transition the OT from beta to stable channel.
Link to entry on the Chrome Platform Status
https://chromestatus.com/feature/5733583115255808
Links to previous Intent discussions
Intent to prototype: https://groups.google.com/a/chromium.org/g/blink-dev/c/w9hm8eQCmNI
Yoav Weiss
Yoav Weiss
On Friday, March 25, 2022 at 11:46:45 PM UTC+1 Paul Jensen wrote:Contact emails
paulj...@chromium.org, kle...@google.com
Developers interested in the FLEDGE API can also join the FLEDGE API announcements group for updates and announcements.
Explainer
https://github.com/WICG/turtledove/blob/master/FLEDGE.md
Specification
May be heavily influenced by origin trial feedback, so not yet started.
Summary
FLEDGE provides a privacy advancing API to facilitate interest group based advertising. FLEDGE shifts the interest data and the final ad decision browser-side instead of server-side, offering many advantages: strong privacy guarantees, as well as time limits on group membership, transparency into how the advertiser interest groups are built and used, and granular or global controls over this type of ad targeting.
Blink component
TAG review
https://github.com/w3ctag/design-reviews/issues/723
(The first “F” and last “E” in FLEDGE stand for First Experiment, as such FLEDGE specifies a prototype for ads serving in the TURTLEDOVE family, so the TAG review request was made for the overall family, TURTLEDOVE, rather than the first experiment specification, FLEDGE.)
TAG review status
Pending
Risks
Interoperability
Gecko: No signal
WebKit: No signal
Paul Jensen
Yoav Weiss
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABQTWrmTRunapDYR4hMfmFyv2Cp5OpXTwNBqOLJJXdmLrn%3Dp6g%40mail.gmail.com.
Shaojie Wang
Paul Jensen
The feature "FLEDGE interest groups can also be viewed in Chrome’s Developer tools: in the "Application" tab, there is an "Interest Groups" item on the left side-bar that, when clicked, should display all interest groups that this page interacted with, e.g. when a page joins/leaves an interest group, bids on an auction, or wins an auction on this page then the interest group should show up." stated in the "Debuggability" section is useful. Are there any plans of its rollout?
Geoffrey Yaworski
- Were/are page loads capped at 0.5%?
- What is the plan (if any) to scale up % of page loads?
- Will FLEDGE be promoted to M101 Stable on 4/26?
Paul Jensen
- Were/are page loads capped at 0.5%?
The Origin Trial will be available for a subset of users by default. This subset is controlled by a Chrome Field Trial. This is described in the Chrome Origin Trials description of how usage is limited: https://github.com/GoogleChrome/OriginTrials/blob/gh-pages/explainer.md#monitoring-and-limiting-usage
- What is the plan (if any) to scale up % of page loads?
We recently announced intentions to roll out to 50% of Chrome Beta here: https://groups.google.com/a/chromium.org/g/fledge-api-announce/c/i6Ijv_vPynM/m/DezFYH7GAAAJ
Will FLEDGE be promoted to M101 Stable on 4/26?
Once we are confident that the APIs are working properly, we will transition the OT from beta to stable channel. We recently announced plans to roll out to 50% of Chrome Beta and we have not yet announced plans to ramp up to Chrome Stable. We will continue to run the origin trial in Chrome Beta to evaluate the functionality of the APIs and the accompanying user controls. Technical testing is an important first step in the origin trial process; developers are encouraged to provide feedback on API functionality, documentation and ease of integration.
Philippe de Lurand Pierre-Paul
Since this origin trial began on Desktop, we've updated how FLEDGE uses processes on Android to be more in line with that of site-isolation. This should minimize the impact of process startup times on FLEDGE auction latency. We'd like to expand the current origin trial to include Android. We received approval to extend this origin trial to M107 in this thread, and plan to roll out the origin trial to Android going forward, starting with Chrome canary/dev channels and when confident it's working well, moving to beta and then stable.
Cheers,
Philippe