Ad Measurement with Chromium's Attribution Reporting API

This article explains how the Chromium web browser's Attribution Reporting API enables advertisers to measure ad conversions without relying on third-party, cross-site tracking cookies. It covers the core mechanics of the system, including how the browser logs ad interactions locally on a user's device, matches those interactions with subsequent conversions, and generates two distinct types of privacy-preserving reports—event-level and summary reports—using data limits, encryption, and randomized noise to protect user identity.

Local On-Device Matching

Traditionally, third-party cookies tracked users across different websites to see if an ad led to a sale. The Attribution Reporting API eliminates this by moving the tracking responsibility directly into the user's Chromium browser. Cross-site identifiers are never shared with advertisers or ad tech companies. Instead, the process relies on two local steps:

  1. Registering Ad Interactions (Attribution Sources): When a user clicks or views an ad on a publisher's website, the ad tech platform instructs the browser to record this event locally on the device. The browser saves specific contextual data, such as the ad ID, the time of the interaction, and the destination website where a conversion is expected to happen.
  2. Triggering Conversions (Attribution Triggers): Later, when the user visits the advertiser's website and completes a desired action (like making a purchase or signing up for a newsletter), a pixel or script on the page informs the browser that a conversion has occurred.

The browser then checks its private, local storage to see if this conversion matches any previously recorded ad interactions for that specific advertiser. If a match is found, the browser generates a report to send back to the ad tech platform.

Two Types of Attribution Reports

To balance the need for marketing data with strict user privacy, the browser generates two different kinds of reports. Ad tech platforms can use both simultaneously for different analytical purposes.

1. Event-Level Reports

Event-level reports connect a specific ad click or view with a conversion, answering optimization questions like "Which specific ad creative led to the most conversions?"

Because these reports link an individual ad interaction to a conversion, the browser strictly limits the amount of conversion data attached to it. For example, a click might only allow 3 bits of conversion data (a number between 0 and 7), which is enough to categorize the conversion as a "purchase" or "signup," but not enough to include a specific purchase amount or user ID.

2. Summary Reports (Aggregatable Reports)

Summary reports provide detailed conversion data, such as the exact dollar value of a purchase or geographic location, but only for groups of users rather than individuals. They answer questions like "What was the total return on ad spend for this specific campaign?"

When a conversion occurs, the browser generates an "aggregatable report" containing high-resolution data, encrypts it, and sends it to the ad tech platform. The ad tech cannot read these individual reports. Instead, they must batch them together and send them to a secure "Aggregation Service" (run in a trusted execution environment). This service decrypts the data, combines the totals, adds a small amount of statistical noise, and outputs a final summary report. This ensures that no single user's behavior can be isolated.

Built-in Privacy Mechanisms

Simply moving the data to the browser is not enough to prevent bad actors from trying to link a user's identity across sites. The Attribution Reporting API enforces several cryptographic and statistical defenses to prevent cross-site tracking:

  • Delayed Reporting: The browser does not send reports immediately when a conversion happens. If it did, an advertiser and a publisher could compare timestamps to identify the exact user who just converted. Instead, the browser sends event-level reports during randomized time windows (ranging from two days to several weeks after the ad click), and delays aggregatable reports randomly by up to an hour.
  • Noise and Differential Privacy: A small percentage of the time, the browser will intentionally send fake conversion data or suppress real conversion data. This mathematically guarantees "differential privacy," meaning an ad tech company can never be 100% certain that a specific individual actually converted, while still allowing them to calculate accurate overarching trends by factoring in the known noise rate.
  • Rate Limits: The browser restricts how many conversions can be measured per ad click, how many ad tech platforms can register events on a single site, and how many destinations can be linked to a single source. This prevents companies from abusing the system to build covert user profiles.