[blink-dev] Intent to Deprecate and Remove: Attribution Reporting API

[Nan Lin]

Intent to Deprecate and Remove: Attribution Reporting API

Contact emails

lin...@chromium.org, jka...@chromium.org, apase...@chromium.org

Explainer

https://github.com/WICG/attribution-reporting-api

Specification

https://wicg.github.io/attribution-reporting-api/

Summary

The Attribution Reporting API (ARA) is a privacy-preserving web API designed to measure ad conversions without third-party cookies or user tracking across sites.

Following Chrome's announcement that the current approach to third-party cookies will be maintained, we are now planning to deprecate and remove the Attribution Reporting API (along with certain other Privacy Sandbox APIs, as outlined on the Privacy Sandbox feature status page).

Blink component

Internals > AttributionReporting

Web Feature ID

None

Motivation

Chrome has announced that the current approach to third-party cookies will be maintained. Given this, we expect adoption of the Attribution Reporting API to decrease over time, as cross-site measurement will remain possible in Chrome using third-party cookies. Further, although Microsoft Edge integrates with the Attribution Reporting API, most other browser engines have not signaled interest in launching the API. Removing this (and certain other Privacy Sandbox APIs) will help focus efforts on the proposed interoperable Attribution standard.

Developer-facing impact

Sites that are using the Attribution Reporting API for conversion measurement and do not migrate to alternative solutions may experience a disruption in conversion measurement on eventual removal of the API code from Chrome.

• Conversion measurement disruption: All ad conversion events relying on the deprecated API will fail to register or report. Sites using this API as their primary or supplementary method for ad measurement will lose visibility into campaign performance metrics derived from this technology.

• Public API surface: The following outlines the consequences of deprecating and removing the Attribution Reporting API for each of the interfaces defined here.

  • Potentially user-breaking

    • XMLHttpRequest.setAttributionReporting(): Calling setAttributionReporting() on an XMLHttpRequest object will throw an exception because the method will no longer exist. This is a breaking change for any site that calls this method. Given that this feature is not implemented in other browsers, it is likely that sites are already using feature detection to check the method’s existence before calling it, which would prevent breakage. We will start to track the usage of this method.

  • Non user-breaking

    • HTMLAttributionSrcElementUtils and the attributionsrc attribute: The attributionsrc attribute on <a>, <area>, <img>, and <script> elements will be ignored. Any values assigned to this attribute will have no effect, and the browser will no longer initiate background requests to register attribution sources/triggers. Additionally we will no longer process trigger headers on legacy subresource requests that lack the opt-in (either on an element or fetch/XHR). This will not cause any visible breakage or errors on the page for the user, but it will silently prevent conversion measurement for sites that rely on this attribute.

    • attributionsrc in window.open(): The attributionsrc feature in the features string of a window.open() call will be ignored. The window will still open as requested, but no attribution source will be registered. This will not cause any visible breakage or errors on the pages for the user, but it will silently prevent conversion measurement for sites that rely on this functionality.

    • AttributionReportingRequestOptions and the attributionReporting member in RequestInit: The attributionReporting property within the options of a fetch() call will be ignored. The fetch request will still be made, but it will not trigger any attribution-related functionality. This change will not cause any JavaScript errors, but conversion measurement that relies on the fetch requests will no longer work.

    • Attribution-Reporting-Eligible and Attribution-Reporting-Support headers: Since the browser will no longer process the attributionsrc attribute or the attributionReporting property in requests, it will no longer send these two headers on outgoing requests.

    • attribution-reporting permission policy: The attribution-reporting permission policy will be removed along with the API. Since the API it controls will no longer exist, the permission policy will have no effect and its removal is not considered a breaking change.

Planning and Estimated Milestones

Deprecate the browser API surface in M144 and remove in M150.

There will be one aspect of ARA that will end sooner. Server-side summary report computation will no longer operate by late December 2025. We have already communicated to the users of that service of these plans. Such users can use debug reports instead until the removal of the ARA surface as a whole. Since this impacts post-facto server-side operations, it will not incur any user-facing breakage.

Currently ~20% of page loads use the Attribution Reporting API. While ARA’s usage as a percentage of page loads is quite high, it is driven by a small number of third-party ad tech scripts present on a large number of sites. We will continue to monitor usage in addition to providing comprehensive updates on privacysandbox.google.com with the status of the API and deprecation plans.  

We will proactively work toward reducing ARA usage to low levels once this intent is approved, including disallowing any new enrollment sign-ups, and contacting enrolled sites to inform them about the deprecation timelines. 

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/6320639375966208