Building a more private web

Key Takeaways

[Music] another area in which the web is evolving is privacy as we seek to curtail third-party tracking practices while preserving important and critical capabilities that enable a vibrant global web ecosystem to tell us more i'd like to introduce my colleague barb thank you ben we believe it's important for people to be in control of their information including their online activity most users believe it's important too with privacy concerns increasingly driving choices about what people do online we also see regulations around the world stepping up privacy requirements at a rapid pace and yet it's difficult for developers to meet growing expectations for privacy when so many capabilities rely on third-party cookies and other cross-site tracking mechanisms that weren't designed with privacy in mind we need new technologies for a modern privacy focused web and that's what the privacy sandbox is about we're working with the web community and industry stakeholders to develop new privacy preserving technologies that can support a healthy sustainable ecosystem this includes purpose-built apis to support advertising which is a critical part of the ecosystem and funds much of the web's content as well as many other capabilities that modern sites need like fraud detection identity or content that's customized to a user's device now let's take a minute to clarify what we mean by purpose-built apis many of the use cases that i just mentioned were never really built into the web platform but layered over it using general purpose technologies like third-party cookies the browser has no way to tell whether you're using third-party cookies for something helpful like providing a customized experience or keeping a user logged in or for cross-site tracking by designing apis for each specific use case we can ensure appropriate privacy protections give people more useful controls and ideally make each api better at what it does over time once these new apis are in place we'll make sure that developers have time to adopt them so that we can safely phase out support for third-party cookies in chrome while continuing our work to mitigate other types of tracking so that cross-site tracking doesn't simply shift from third-party cookies to more covert methods to make this complex project easier to follow we're sharing progress in two places privacysandbox.com explains the vision goals and concepts behind this initiative it also includes a high-level timeline that we're updating every month the timeline links to each of the technologies we're working to test and launch and lays out a stage plan for phasing out third party cookies in chrome the second resource is the privacy sandbox section at developer.chrome.com here you'll find more technical detail and implementation guidance including a blog with the latest updates for developers we've just added a post with all the links and updates from this session now we talk a lot about the importance of collaboration in this project and i'd like to show you what that looks like at each stage of development i'll mention some apis as examples but the broader idea is to illustrate how ecosystem involvement is shaping this work this process will be familiar to many of you in the web development community but the privacy sandbox is bringing a lot of newcomers to this process including industry stakeholders who will use these purpose-built apis and whose expertise is critical in their development the first stage of the process is discussion where anyone can propose and weigh in on ideas for new technologies there have been dozens of privacy preserving proposals offered by chrome and others over the last couple of years they're all online so you can read them ask questions offer ideas to improve them and see what others are saying to find live conversations where all of the proposed solutions are being discussed and debated together there are a number of w3c groups that you can join or monitor depending on the types of use cases you're interested in here's one example to illustrate how involved this discussion stage can get fledge is a proposal to support interest-based advertising without cross-site tracking with valuable input from privacy advocates and many industry stakeholders fledge has evolved from two previous proposals with more than a hundred organizations joining w3c meetings to help refine the current version and over 200 online discussion threads there have also been more than half a dozen other proposals in the same solution space through continued incubation we hope will reach consensus on a path forward and at the same time we're starting developer testing for the initial version of fledge behind a flag in chrome so that developers can get their hands on it not all of these proposals will go through such an intense incubation period some will move much more quickly but there's a lot of innovation happening here these are new ideas and it can take a lot of work to get them right the next stage is testing there are already a handful of proposals ready for developer testing today and you can expect more as we head into 2022 and don't be surprised to see some iterative cycles of discussion and testing testing is important precisely because it surfaces issues or gaps that may require more work testing in chrome usually starts with a feature behind a flag for developers to test locally this means you need to turn it on in your browser to try it out this code is often very fresh so you can expect to find some issues and then origin trials each running for a limited time with a limited population of chrome users origin trials are public and open to all developers you just need to register to opt in your site or service this is when we get actionable feedback from developers on what works what doesn't and where those gaps are success at this stage depends not only on developers doing hands-on testing but on their being willing to share what they learn for example yahoo japan recently published a detailed analysis of their test of the attribution reporting api highlighting areas for improvement like the need for a better way to deliver conversion reports which has now been added these are the sorts of things that turn up once developers can get their hands on an api we also hope to see companies talking about their approach to testing and how they expect to use an api during the origin trial for the first version of flock a proposal to support interest-based advertising and content we were pleased to see companies like cafe media publishing their analysis and insights so that others could see what they'd learned and chrome tests aren't the only way to explore how new technologies might work some companies are also building simulations based on privacy sandbox concepts advertising platform criteo recently ran a competition with more than 150 teams testing different machine learning models to evaluate how differential privacy concepts such as noise insertion and aggregation might impact advertising performance it's helpful to examine these concepts since they underlie several of the privacy sandbox apis we are truly appreciative of the companies investing their time to test these new technologies and of their being willing to share their perspectives and learnings publicly now once an api is tested and ready for general use in chrome we'll announce the launch and make sure public documentation is ready for scaled adoption user agent client hints or uach launched in chrome earlier this year and is now ready to scale it's part of the privacy sandbox work stream to reduce covert tracking such as browser fingerprinting but first let's back up and take a look at the legacy mechanism it's replacing like cookies the user agent string is an early web feature by default it provides a lot of information about the user's browser and device making it a readily available surface for fingerprinting it also has a format that can be a headache to parse we recently announced plans to start reducing the granularity of information available in chrome's user agent string starting in april of 2022 to get that information in the future you'll need to transition to user agent client hints it'll give you some information by default which may cover most of your use cases with more detailed information on request in a straightforward format we were happy to make this ergonomic improvement for developers while at the same time moving the majority of user agent information from an available by default model to an on request model that way you can request only the information you need which is good practice today and the pattern we want to set for the future so let's go back to the timeline i showed you a moment ago gradual ua string reduction starts in april of 2022 the replacement solution user agent client hints has been launched and ready for scaled adoption since march so you can begin testing and migrating to it any time now to help with that there's an origin trial to opt in to the reduced ua string early so that you can see what that future state will look like and if it turns out that you need more time you'll be able to opt in to keep using the user agent string as is through march 2023 the details of this plan are all online and while the scaled adoption stage might not look exactly like this for other apis you can expect to see consistency in the overall approach we'll continue to explain what's happening provide as much visibility as we can encourage your involvement and hear your input we appreciate all contributions to this complex and vitally important project as we seek to create durable web features with broad utility and strong privacy protections for users it's worth this effort to get the foundations right and ben i will hand it back to you thanks barb the privacy sandbox is one of the largest efforts we've seen to evolve the web we believe that it's critically important to help ensure the web's continued health and success for decades to come [Music] you