W3C Proposes Browser-Based Ad Attribution API as Privacy Sandbox Successor

Full analysis

The web's standards body wants to move ad measurement out of ad-tech's hands and into the browser itself. The W3C's Private Advertising Technology group is drafting an "Attribution API" — a way for the browser to answer "did this ad lead to a sale?" with an aggregate report, instead of ad-tech companies stitching that answer together from cookies and fingerprints. The pitch that makes this different from Google's Privacy Sandbox: it's cross-browser, with Apple, Google, and Microsoft at the table, not a Chrome-only project on the UK regulator's leash.

What's actually being decided: not "will attribution get more private" — that ship sailed. It's who owns the measurement source of record on the open web. Today that's a contested layer where LiveRamp, DoubleVerify, IAS, the DSPs, and a dozen identity vendors all get a piece. The proposal would hand the floor to three browser makers.

Reversibility: Type 1 for the ecosystem if it ships. Standards ossify. But the probability it ships coherently is low, which is the whole story. Forcing function: the PAT group is soliciting input from IAB Tech Lab, the ANA, and the MRC now — that comment window is the leverage point, not the eventual spec date.

The Skeptic

The load-bearing assumption is that Apple, Google, and Microsoft converge on one spec and implement it the same way. They won't. Apple spent a decade making Safari hostile to tracking and never shipped an attribution primitive publishers could actually use — its Private Click Measurement went nowhere. Microsoft's browser is 5% of the market. Google's incentive is to ship something that satisfies EU and UK regulators while keeping its own measurement edge inside Google Ads intact. W3C consensus is famously slow. The realistic 24-month outcome: a spec on paper, incompatible Chrome and Safari implementations, and ad-tech routing around it with server-side event matching. In plain terms: three rivals rarely agree on a shared tool when each profits from a different version.

The Market Analyst

Follow who loses the data surface. If measurement migrates into the browser, the independent identity and verification layer — LiveRamp, Experian, DoubleVerify, IAS — loses the event-level signal its models are priced on. That's a real threat to the "measurement independence" story those companies sell. The counter-trade: direct publisher pipes like The Trade Desk's OpenPath, and retail media networks that never depended on the browser in the first place. Amazon, Walmart Connect, and the walled gardens shrug at this entirely — they measure inside their own walls. The tell for investors isn't the spec's progress; it's whether verification vendors start talking up server-side and CTV revenue on their next calls to get ahead of the question. Plainly: the companies that make money measuring the open web have the most to lose here.

The Operator

The 90-day risk isn't the spec — it's false calm. Privacy Sandbox's slow-motion death and Google's cookie U-turn trained ad ops to assume these transitions take forever. This one could move faster because it's multi-browser and doesn't need one company's nerve. Fraud detection breaks first. Aggregate-only reports strip exactly the event-level pattern that invalid-traffic vendors use to flag anomalies, and reconciliation desks lose the granular logs their models eat. If you run open-web display or video, the move now is to inventory every report that depends on pixel-based click attribution and server-to-server matching — before the spec finalizes, not after. Plainly: the teams that wait for certainty are the ones that got caught flat on cookies.

The Customer / End User (the advertiser)

Nobody asked for this. Advertisers didn't wake up wanting fewer signals — regulators and browser makers decided it for them. The honest advertiser question: how much granularity do you actually use versus hoard? Most brands can't act on impression-level data anyway; they run on last-touch reports and gut. For them, a clean aggregate report from the browser might be fine — even better than the messy pixel soup they get now. The advertisers who genuinely lose are the sophisticated few running real incrementality tests and tight fraud audits. That's a smaller room than the industry's panic suggests. The rest will grumble and adapt, the way they always do.

Where the council splits

Two real disagreements. First, speed: the Skeptic says this dies in committee like every W3C effort; the Operator says multi-browser structure is exactly what lets it move faster than Sandbox did. They can't both be right, and the whole risk calculus turns on it.

Second, how much it matters to advertisers: the Operator and Market Analyst treat lost event-level data as a crisis; the Customer says most brands never used it and won't miss it. The pain is real but concentrated among the sophisticated minority — fraud desks and incrementality shops — not the broad market.

What it hinges on

Two beliefs. One: do Apple, Google, and Microsoft actually ship compatible implementations, or does this stay a PDF? The base rate for browser-vendor consensus on advertising is grim. Two: does IAB Tech Lab win event-level access for fraud audits inside the spec? That single negotiation decides whether the damage is contained or whether open-web measurement regresses to panel-based guesswork and marketing-mix models.

The council leans skeptical on near-term impact and wary on long-term power. The "cross-browser standard" framing sounds like open-web progress. What it actually describes is three companies that already own the browser layer absorbing the measurement market. If you're a verification or identity vendor, your hedge is obvious and you should already be building it: server-side, clean rooms, CTV, retail media — anywhere the browser isn't the referee.

What to verify before reacting: read the actual draft's provision for fraud auditing, and watch whether Apple commits to implementation or just attends. Apple's attendance is not Apple's endorsement.

Prediction: By the W3C PAT Working Group's status update following IAB Tech Lab / ANA / MRC input — expected within the next 12 months — the Attribution API will still be a working draft with no two major browsers shipping compatible production implementations.

Confidence: High — browser-vendor consensus on ad measurement has no successful precedent.

Why: The signal in this story is that the same three companies with opposite incentives — Apple monetizing privacy, Google protecting its own ad measurement, Microsoft at 5% share — are being asked to agree on one spec through W3C's consensus process. Every prior attempt at this, from Apple's Private Click Measurement to Google's Privacy Sandbox, either shipped in one browser only or got walked back after years of iteration. The mechanism that would produce the opposite — genuine cross-vendor alignment on production code — requires each company to subordinate a live commercial advantage to a shared standard, which none has ever done in advertising. A draft spec is cheap and likely; compatible shipped implementations are expensive, rivalrous, and historically absent.

Revisit by 2027-07-20: We're right if the API remains a draft or proposal with no two major browsers running compatible production versions. We're wrong if two or more of Chrome, Safari, and Edge ship interoperable implementations advertisers can actually measure against.