Attribution Reporting API
What is Attribution Reporting API?
Attribution Reporting APIA Privacy Sandbox API in Chrome and Android that lets advertisers measure ad conversions across sites without cross-site identifiers, using browser-mediated, noise-injected event-level or aggregated reports.
The Attribution Reporting API (ARA) is the Privacy Sandbox mechanism for measuring ad-driven conversions without exposing cross-site identifiers. Sources (ad clicks or views) are registered on the publisher side; triggers (conversions) are registered on the advertiser side. The browser maintains the join between them locally and, at delayed and randomized intervals, sends one of two kinds of report. Event-level reports return a noisy, low-resolution mapping from a source event to a conversion event, suitable for click attribution. Aggregatable reports go through a separate Aggregation Service running in a trusted execution environment, which adds calibrated noise (differential privacy) before returning aggregate dashboards across many users. Both report types are designed to bound the cross-site information any caller can learn. ARA is one of the central pieces of the post-third-party-cookie measurement story and a focus of regulator attention (CMA, French CNIL, German DPAs). For ad-tech and measurement vendors, integrating ARA requires substantial backend changes for noise budgets, report aggregation, and trust-establishment with the Aggregation Service.
● Examples
- 01
An advertiser registers click-trigger and conversion-trigger callbacks; Chrome delivers event-level reports days later, with noise to limit user-level inference.
- 02
A measurement vendor stands up an Aggregation Service in a TEE so that ARA aggregatable reports can be processed into campaign-level dashboards.
● Frequently asked questions
What is Attribution Reporting API?
A Privacy Sandbox API in Chrome and Android that lets advertisers measure ad conversions across sites without cross-site identifiers, using browser-mediated, noise-injected event-level or aggregated reports. It belongs to the Privacy & Data Protection category of cybersecurity.
What does Attribution Reporting API mean?
A Privacy Sandbox API in Chrome and Android that lets advertisers measure ad conversions across sites without cross-site identifiers, using browser-mediated, noise-injected event-level or aggregated reports.
How does Attribution Reporting API work?
The Attribution Reporting API (ARA) is the Privacy Sandbox mechanism for measuring ad-driven conversions without exposing cross-site identifiers. Sources (ad clicks or views) are registered on the publisher side; triggers (conversions) are registered on the advertiser side. The browser maintains the join between them locally and, at delayed and randomized intervals, sends one of two kinds of report. Event-level reports return a noisy, low-resolution mapping from a source event to a conversion event, suitable for click attribution. Aggregatable reports go through a separate Aggregation Service running in a trusted execution environment, which adds calibrated noise (differential privacy) before returning aggregate dashboards across many users. Both report types are designed to bound the cross-site information any caller can learn. ARA is one of the central pieces of the post-third-party-cookie measurement story and a focus of regulator attention (CMA, French CNIL, German DPAs). For ad-tech and measurement vendors, integrating ARA requires substantial backend changes for noise budgets, report aggregation, and trust-establishment with the Aggregation Service.
How do you defend against Attribution Reporting API?
Defences for Attribution Reporting API typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for Attribution Reporting API?
Common alternative names include: ARA, Attribution Reporting.
● Related terms
- privacy№ 960
Privacy Sandbox
Google's umbrella initiative for replacing third-party cookies and cross-site identifiers with privacy-preserving alternatives — Topics, Protected Audience (FLEDGE), Attribution Reporting, and on-device APIs — under heavy regulatory and competitor scrutiny.
- privacy№ 1286
Topics API
A Privacy Sandbox API in Chrome and Android that derives a small set of high-level interest topics from the user's recent browsing locally on the device, exposing them to participating sites instead of cross-site tracking identifiers.
- privacy№ 351
Differential Privacy
A mathematical framework that quantifies privacy loss when releasing statistics or training models, by adding calibrated noise so any single individual's contribution is provably bounded.
- privacy№ 1263
Third-Party Cookie
A cookie set by a domain different from the one in the browser's address bar, historically used to track users across websites.
- privacy№ 266
Cross-Site Tracking
The practice of linking a user's activity across multiple unrelated websites to build a long-lived behavioural profile.
- cloud-security№ 1300
Trusted Execution Environment (TEE)
A secure, isolated execution context within a processor where code and data are protected in confidentiality and integrity, even from the host OS and hypervisor.