How ad privacy works in Chrome

When used for advertising, ad privacy APIs protect your identity and minimise the amount of data that sites can use to learn about you. Here’s how:

• Protect your identity: The ad privacy APIs limit a site’s ability to track your activity as you browse. The APIs also protect you against re-identification. For example, based on your activity and other information that a tracker already has, like your identity on a website, a tracker could guess who you are.
  • The Topics API provides sites with a high-level sense of your interests based on your recent browsing history. Instead of essentially unlimited information, the new API only allows sites to receive up to three interests, such as 'Sports'. It also occasionally returns a random interest. We call this 'adding noise' and we do it to protect your identity. All of this means that the Topics API makes it much harder for a tracker to gather enough information to identify you. Learn more about the Topics API.
  • The Protected Audience API allows sites to store only limited browsing history on your device. Ad tech companies can only process your cross-site data on your device. This makes it much harder to identify you and to gather information about you. Learn more about the Protected Audience API.
  • The Attribution Reporting API helps advertisers measure the effectiveness of their online ads without needing to track your activity across sites and apps. Like Topics, this API also adds noise to obscure unique characteristics that could be used to identify you. And it adds time delays to reports, which also makes it much harder to connect your activity across sets of data. These safeguards prevent many re-identification attacks that are possible today with user identifiers, even if those identifiers are obscured and encrypted. Learn more about the Attribution Reporting API.
• Minimise data collection: Today, ad tech companies can collect large amounts of your data as you browse the web because of technologies like third-party cookies. The ad privacy APIs limit the amount of data that can be learned about you at any given time, particularly as you browse from one site to another, significantly improving your privacy when third-party cookies are blocked. The APIs make it much harder for an ad company to identify you, which means that it’s harder to build and associate a profile with you. The APIs also establish other data limitations, such as:
  • The Topics API limits advertisers to collecting just a small number of topics per week based on your recent browsing history. Today, third-party cookies and other identifiers allow ad tech companies to collect highly detailed information about you based on nearly all of your browsing history over time.
  • The Protected Audience API restricts who receives data and what data they receive when you see a personalised ad. With this API, only companies actually involved in showing an ad on a web page receive information about that ad impression. By contrast, today, when a personalised ad is placed on a page using third-party cookies, a wide range of companies can gather information, even if they didn’t have anything to do with showing the ad.
  • The Attribution Reporting API limits the amount of information that can be connected with you for any given ad shown. And for aggregate reports, pooling many user reports into a single report to protect your identity, the API effectively limits the types of information that can be measured and also caps the amount of conversion information recorded. Today, trackers can collect an unlimited amount of data, including detailed information about your activity.
• Greater accountability from ad tech providers: Keeping track of ad tech companies that use these APIs for ads provides new visibility and accountability. Chrome uses an 'attestation' model, which requires ad tech companies to clearly and publicly commit to using the limited data that they receive in a proper, privacy-preserving manner. Learn more about greater accountability from ad tech providers.
• More robust user controls: Today, managing your ad privacy with third-party cookies requires effort. Either you can turn third-party cookies off completely, at the cost of losing non-ad-based uses of third-party cookies, like persistent sign-in services, or you can keep third-party cookies active and sort through hundreds of cookie domains and often unrecognisable ad tech providers. With the new APIs, it’s much simpler to manage your online ad privacy. For example, when personalised ads are delivered via Protected Audience API, you can block topics and sites that you don’t want used to show you personalised ads.