AI is not the only front on which the Movement For An Open Web (MOW) is fighting right now. When MOW co-founder James Rosewell isn’t helping publishers protect themselves against content-harvesting LLMs, he’s alerting them to the potential threat posed by the W3C’s Attribution API, a tool that aims to give advertisers insights into audiences without revealing individual user data.
The problem, said Rosewell, is that the industry doesn’t want to hear it. When Google abandoned plans to remove third-party cookies from its browser in 2025 and then effectively shuttered the Privacy Sandbox where it incubated alternatives to user-level tracking, people lost interest. But the effort to create alternative attribution and measurement tools for open-web advertising didn’t stop.
The W3C — a non-profit forum that designs protocols and standards for the web — has carried on the work with Google’s support and, until recently, little scrutiny. Rosewell calls it ‘the Zombie Sandbox’ and he’s concerned that it will only serve to reinforce the power of the big platforms. Others, however, worry that it will drag online ad measurement back to a more primitive state.
The W3C’s proposed Attribution API — which is still in early development — isn’t really the reanimated corpse of Google’s whole Privacy Sandbox, though, just one part of it. The API essentially works by keeping all the information about a user on their browser. If someone takes an action after being served an ad, the browser will know. The API then adds that information to a pool of similar data, inserts some statistical noise so that it can’t be reverse engineered to reveal anyone’s identity, and gives it to advertisers.
Put that way, it sounds like a pretty good way to run things. And in this interview with Marketecture, Mozilla engineer Martin Thomson makes a good ambassador for the project, coming across as sensible and competent while putting forward a strong case for a system that protects user-level data without torching ad effectiveness. Nonetheless, the resistance to the API from certain pockets of the industry is strong.
The first complaint is that the W3C working group designing the API has been captured by big tech, with members from Google, Apple, Meta and Mozilla. They, it is argued, have enough first-party customer data to insulate themselves from the fallout of privacy-enhancing technologies, unlike smaller competitors. It is also thought unlikely that such a group would introduce any measures that contradict what the platforms have been saying about the effectiveness of their own advertising.
A less circumstantial criticism of the API is that it encourages advertisers to consider only the effects of lower-funnel ads in influencing a user action — a tendency the industry has worked hard to discourage. More than that, the API appears to favour last-click-attribution, and by keeping all the user data on browsers, it prevents independent measurement agencies from getting the access they need to mark the platforms’ homework.
The broader and more conceptual criticism is that the API embraces a narrow view of privacy. If you think privacy should mean your behaviours are not analysed to make companies better at selling you things, you’re out of luck. Under this conception, privacy only means that no third party has your name or email address. As a member of an anonymised group, you would still be subject to all the same targeting and whatnot — in fact, probably more so because within this regime it’s only the browsers that have to even consider privacy.
If there’s one consolation for opponents of the Attribution API, though, it’s that not even Thomson, who is working on the project, expects it to make a huge difference.
‘Success here means that some businesses decide that this is enough,’ he told Marketecture. ‘That they can get enough information from attribution without having to resort to those other things [referring to tracking and email collection, and solutions like data clean rooms, which he is sceptical about]. If it is only a few who change, that’s a win.’
The bad news is that quite a few people in this space are working on the assumption that Google is still going to eventually deprecate third-party cookies on its browser. So whether or not the API catches on, marketers are probably going to have to start thinking about them again.
By James Swift, editor, MediaCat UK