Attribution reporting api and email marketing

[Refalb]

Attribution reporting api and email marketing

[csharrison]

See GoogleChromeLabs/privacy-sandbox-dev-support#184 which is a related issue. Right now there is no direct support for this use-case within ARA (if you don't control the email hosting site).

Regarding the best practices around click IDs in links, this is probably not the right forum to ask since this repo is devoted to the Attribution Reporting API specification.

cc @jolynyao

[Refalb]

We do not have control over the email hosting site, and the use case revolves around the ability to track post-click conversions when a person clicks on the advertising inside an email message. Currently, when someone clicks on the advertisement, a 3rd party cookie allows us to track the conversion. However, with the deprecation of cookies, this process no longer functions, making it impossible to track conversions.

Our requirement is to maintain the tracking of post-click conversions from users who open an email message (via various platforms such as an app, webmail, or mail client). We are exploring ARA solutions to find a way to continue tracking conversions. After reviewing another issue you suggest (#184) and API documentation, it seems that achieving this may not be possible in the future.

[Refalb]

It's possible to register for attribution during a redirect if the first link doesn't have the attributionsrc?

For example the creativity is delivered via an adserver that doesn't support attribution api and generate a "classic" banner, the url in the href is of the third party adserver that do a redirect to an adserver that support these api and want to register it as an attribution sources.
Is the second adserve able to register to the API or not because the first link doesn't have the attributionsrc?
Is there any way to manage this scenario that is not so uncommon?

[csharrison]

Hey @Refalb , it was an intentional design decision not to support this flow, because it allows those in control of links on a page to track users on a publisher without the publisher's knowledge.

We briefly mention this here but it probably is worth expanding on.

[hierro1981]

Hi @csharrison but the publisher can use the permission policy to manage who can use the API and then track the user. He can do the opt out of specific third party, all or none and the default is that all are allowed to use the API. So the publisher know that adv could track user and if it doesn't want he can use this to do the optout.

Blocking the possibility to register to the API on redirect without starting with one with the attributionsrc parameter, other than prevent the registration to the API for link that are served by third party tool that doesn't support the parameter will also cut off from using this API for email marketing, as per @Refalb first concern, and in all the scenarios where the first click is not inside a chrome browser but the browser is opened in response to the click action on the link like on a mail client or application.

Is there any other way to enable attrbution API on these scenario?

[csharrison]

Currently the permission policy is opt-out only, whereas attributionsrc is opt-in, making attributionsrc a stronger protection. Additionally the permission policy only governs a specific frame's permission, which does not help if a frame who the publisher wants to use the API happens to also embed links which track its users without their knowledge. A stronger version of Permissions Policy could potentially mitigate this, but currently the API is fairly heavy-handed.

We don't currently have plans to address this but we appreciate the feedback on use-cases, and we do use the feedback on github to inform our roadmap.

[Refalb]

Hi @csharrison , thanks for the clarification, but I have a doubt: with this alternative solutions, you exclude the possibility to track conversion from email marketing for example, where now with 3rd party cookie you can easily track conversion and compare this marketing channels with other strategy: not supporting this case you are excluding the possibility to easily track the results in some ecosystem creating a distorsion in comparing results from different channels