Browser Vendors' 'Attribution Level 1' Is an Ad-Tracking Cartel in Disguise

Meta, Google, Apple, and Mozilla are jointly drafting Attribution Level 1, a built-in browser API that records ad impressions and correlates them with purchases via an aggregation service. The proposal frames itself as privacy-preserving because it blocks cross-site recognition of individuals, but the spec contains no consent flow, no opt-out-of-sale handling, and no objection-to-processing hooks — creating a two-tier regime where third-party ad tech must comply with privacy law while the browser’s own tracker runs by default.

The author argues the narrow mathematical privacy guarantee misses the real-world harms. Last-touch attribution structurally favors search, social, and app store ads, which intercept demand created elsewhere, funneling more of the roughly $1,200 per US adult spent annually on advertising toward Big Tech and away from publishers whose journalism produces positive externalities. Worse, because the system can’t distinguish ads that created a sale from ads shown to people already about to buy, it rewards aggressive ML-driven targeting and effectively launders intrusive data sources (smart-TV microphones, etc.) into ‘measured’ ad placements.

The piece calls on W3C to shelve the proposal the way Google shelved Privacy Sandbox under regulatory pressure, and warns that browser-emitted attribution reports will be wielded as lobbying ammunition in state privacy hearings. As a fallback, the author wants attribution APIs made controllable by extensions, like every other ad mechanism — noting privacy is now the top reason Americans install ad blockers.