Google’s Privacy Sandbox APIs Explained: Attribution Reporting API (ARA)


In the world of adtech, attribution involves giving an ad credit for driving a specific action, such as a conversion.  However, even when these events can be correlated with a high degree of certainty, questions about how to interpret these results inevitably arise. When several ads are viewed, which receives credit for the conversion? How long after the ad view or click should it count towards conversion attribution? How should cross-device or cross-channel attribution be handled?

As a result, attribution providers have developed numerous models and advertiser-modifiable parameters in order to address this challenge and help make it easier for advertisers to understand how effective their advertising is.

Now, enter third-party cookie deprecation, which removes the ability to correlate those events. Attribution just got significantly more complicated.

This is where Privacy Sandbox’s proposed Attribution Reporting API (ARA), comes into play. ARA, which is embedded in Google’s Chrome browser, enables advertisers to perform in-browser attribution and then send those results to advertising providers for processing, all without reliance on third party cookies. 

The benefits of Privacy Sandbox’s ARA are three-fold:

  1. It enhances privacy by moving attribution into the browser, therefore preventing cross-site tracking of users.

  2. It prevents discovery of individual user actions through obfuscation, mainly through time delays and added reporting noise.

  3. It promotes privacy while preserving performance by supporting performance measurement without revealing individual user-level actions.

Since the effectiveness of ARA is critical to the future of digital advertising attribution, NextRoll and other adtech players are partnering with Google to provide feedback on its function and determine how to provide attribution insights to our customers. For NextRoll, this involves running attribution on live production-level advertising campaign data across our entire diverse customer base and analyzing the results. 

ARA is also paired with a related “Aggregation Service” that helps summarize attribution data. This service allows us to securely examine individual events and aggregate them to understand overall advertising performance.

Here’s an example of how these services work together for a NextRoll customer’s ad campaign: 

  1. When a user views or clicks an ad, their browser makes an anonymous API call to NextRoll that registers that action.

  2. NextRoll provides a response that the browser records for up to 30 days, which includes metadata about the ad, associated advertising campaigns, and other useful information about the interaction.

  3. When the same user later “converts” on our customer’s site, their browser makes another API call to NextRoll via the NextRoll Pixel, which helps us track conversion information.

  4. NextRoll provides a response with information about the conversion, such as its value. 

  5. Later on, the browser sends NextRoll two encrypted reports:

    1. A randomly delayed “event-level report”, which includes very basic conversion information, with a high degree of privacy. NextRoll has the ability to define its attributes in order to try and find the “most relevant” conversion for our customers.

    2. A “summary report”, which includes more granular information about the conversion. However, this report is encrypted and we are unable to view it directly.

  6. NextRoll then processes encrypted summary reports in aggregate and receives finalized information about the attributions.

Between the multiple API calls, the data we’re able to provide the browser, and the way summary reports are processed, NextRoll has quite a bit of control over the process. For example, we have the ability to define the “aggregation keys” that will be used to bucket the data we receive through the “summary reports” sent by browsers. This flexibility has informed many of our design and testing decisions to ensure the right balance between data granularity and accuracy as data obfuscation measures are applied.

To enable privacy while also producing relevant reporting and insights, we’ve had to test and iterate on many design decisions. Our goal is to provide customers with granular performance information that includes a variety of dimensions so they can understand the effectiveness of individual ads, audiences, and campaign types. Given NextRoll’s broad spectrum of advertising customers of all different sizes, it’s important we test different approaches and find what works for each customer set. We may find, for instance, that daily campaign-level reporting works well for our larger customers with many attributable conversions, but results in too much noise for smaller advertisers. In situations like these, we make tradeoffs between data granularity, accuracy, delay, and other variables to provide the best outcome for each group.

These APIs and the overall concept of advertising attribution, will continue to evolve. As we iterate on NextRoll’s implementation of ARA and supporting services, we’re excited to look beyond the current implementation and bring additional value to our customers. A few areas of exploration include exploring on-device and cross-device attribution, supporting different attribution models, similar to what we let customers configure today, and continuing to differentiate our attribution service offerings based on customer’s specifics, such as their size and advertising patterns.

The ARA is flexible, and provides room for many decisions. As the API grows, and our use of it evolves, we’re looking forward to the value it can help us bring to customers and the digital advertising industry at large. 

Tom Polchowski is a Senior Manager of Software Engineering at NextRoll.