diff --git a/index.html b/index.html index c915262819..077c2f6e43 100644 --- a/index.html +++ b/index.html @@ -667,7 +667,7 @@

Attribution Reporting

-

Draft Community Group Report,

+

Draft Community Group Report,

This version: @@ -1438,7 +1438,7 @@

A trigger spec map is a map whose keys are unsigned 32-bit integers and values are trigger specs.

-

6.10. Attribution source

+

6.10. Attribution source

An attribution source is a struct with the following items:

source identifier @@ -1901,41 +1901,41 @@

8.

9. Vendor-Specific Values

Max pending sources per source origin is a positive integer that controls how many attribution sources can be in the attribution source cache per source origin.

-

Randomized response epsilon is a non-negative double that controls -the randomized response probability of an attribution source. If automation local testing mode is true, -this is ∞.

+

Max settable event-level epsilon is a non-negative double that +controls the default and maximum values that a source registration can specify +for the epsilon parameter used by compute the channel capacity of a source and obtain a randomized source response.

Randomized null report rate excluding source registration time is a double between 0 and 1 (both inclusive) that controls the randomized number of null reports generated for an attribution trigger whose [attribution trigger/aggregatable source registration time configuration] -is "exclude". If automation local testing mode is true, +is "exclude". If automation local testing mode is true, this is 0.

Randomized null report rate including source registration time is a double between 0 and 1 (both inclusive) that controls the randomized number of null reports generated for an attribution trigger whose [attribution trigger/aggregatable source registration time configuration] -is "include". If automation local testing mode is true, +is "include". If automation local testing mode is true, this is 0.

Max event-level reports per attribution destination is a positive integer that controls how many event-level reports can be in the event-level report cache per site in attribution destinations.

Max aggregatable reports per attribution destination is a positive integer that controls how many aggregatable reports can be in the aggregatable report cache per effective attribution destination.

Max event-level channel capacity per source is a map that -controls how many bits of information can be exposed associated with a single attribution source. +controls how many bits of information can be exposed associated with a single attribution source. The keys are «navigation, event». The values are non-negative integers.

-

Max aggregatable reports per source is a positive integer that controls how many aggregatable reports can be created by attribution triggers attributed to a single attribution source.

+

Max aggregatable reports per source is a positive integer that controls how many aggregatable reports can be created by attribution triggers attributed to a single attribution source.

Max destinations covered by unexpired sources is a positive -integer that controls the maximum number of distinct sites across all attribution destinations for unexpired attribution sources with a given (source site, reporting origin site).

+integer that controls the maximum number of distinct sites across all attribution destinations for unexpired attribution sources with a given (source site, reporting origin site).

Destination rate-limit window is a positive duration that controls the rate-limiting window for destinations.

Max destinations per rate-limit window is a tuple consisting of two integers. The first -controls the maximum number of distinct sites across all attribution destinations for attribution sources with a given source site per destination rate-limit window. -The second controls the maximum number of distinct sites across all attribution destinations for attribution sources with a given (source site, reporting origin site) +controls the maximum number of distinct sites across all attribution destinations for attribution sources with a given source site per destination rate-limit window. +The second controls the maximum number of distinct sites across all attribution destinations for attribution sources with a given (source site, reporting origin site) per destination rate-limit window.

Max source reporting origins per rate-limit window is a positive integer that controls the maximum number of distinct reporting origins for a -(source site, attribution destination) that can create attribution sources per attribution rate-limit window.

+(source site, attribution destination) that can create attribution sources per attribution rate-limit window.

Max source reporting origins per source reporting site is a positive integer that controls the maximum number of distinct reporting origins for a -(source site, reporting origin site) that can create attribution sources per origin rate-limit window.

+(source site, reporting origin site) that can create attribution sources per origin rate-limit window.

Origin rate-limit window is a positive duration that controls the rate-limiting window for max source reporting origins per source reporting site.

Max attribution reporting origins per rate-limit window is a @@ -1945,7 +1945,7 @@

source site, attribution destination, reporting origin site) per attribution rate-limit window.

Randomized aggregatable report delay is a positive duration that controls the -random delay to deliver an aggregatable report. If automation local testing mode is true, +random delay to deliver an aggregatable report. If automation local testing mode is true, this is 0.

Default aggregation coordinator is the aggregation coordinator that controls how to obtain the public key for encrypting an aggregatable report by default.

@@ -2282,19 +2282,19 @@

empty"
-

Neither a source nor a trigger may be registered.

+

Neither a source nor a trigger may be registered.

"event-source"
-

An event source may be registered.

+

An event source may be registered.

"navigation-source"
-

A navigation source may be registered.

+

A navigation source may be registered.

"trigger"

A trigger may be registered.

"event-source-or-trigger"
-

An event source or a trigger may be registered.

+

An event source or a trigger may be registered.

A registrar is one of the following:

@@ -2985,13 +2985,19 @@

randomized response epsilon.

+

Let epsilon be the user agent’s max settable event-level epsilon.

  • -

    If the result of computing the channel capacity of a source with randomizedResponseConfig and epsilon is greater than max event-level channel capacity per source[sourceType], return null.

    +

    Set epsilon to value["event_level_epsilon"] if it exists:

    +
  • +

    If epsilon is not a double, is less than 0, or is greater than the user agent’s max settable event-level epsilon, return null.

    +
  • +

    If automation local testing mode is true, set epsilon to ∞.

    +
  • +

    If the result of computing the channel capacity of a source with randomizedResponseConfig and epsilon is greater than max event-level channel capacity per source[sourceType], return null.

  • Let triggerDataMatchingMode be "modulus".

  • -

    If value["trigger_data_matching"] exists:

    +

    If value["trigger_data_matching"] exists:

    1. If value["trigger_data_matching"] is not a string, return null.

      @@ -3001,7 +3007,7 @@

      trigger_data_matching"].

  • -

    Let source be a new attribution source struct whose items are:

    +

    Let source be a new attribution source struct whose items are:

    source identifier
    @@ -3041,7 +3047,7 @@

    randomized response
    -

    The result of obtaining a randomized source response with randomizedResponseConfig and epsilon.

    +

    The result of obtaining a randomized source response with randomizedResponseConfig and epsilon.

    randomized trigger rate

    The result of obtaining a randomized source response pick rate with randomizedResponseConfig and epsilon.

    @@ -3072,7 +3078,7 @@

    Determine proper charset-handling for the JSON header value.

    11.4. Processing an attribution source

    -

    To check if an attribution source exceeds the time-based destination limits given an attribution source source, run the following steps:

    +

    To check if an attribution source exceeds the time-based destination limits given an attribution source source, run the following steps:

    1. Let matchingSources be all attribution rate-limit records record in the attribution rate-limit cache where all of the following are true:

      @@ -3116,7 +3122,7 @@

      Note: We do not emit an explicit source debug data type for "hit global limit", we only emit a source-success type. For this reason, when both limits are hit, just interpret it as "hit reporting limit" to ensure that the most useful report is sent.

      -

      To check if an attribution source exceeds the unexpired destination limit given an attribution source source, run the following steps:

      +

      To check if an attribution source exceeds the unexpired destination limit given an attribution source source, run the following steps:

      1. Let unexpiredSources be all attribution rate-limit records record in the attribution rate-limit cache where all of the following are true:

        @@ -3143,7 +3149,7 @@

        size is greater than the user agent’s max destinations covered by unexpired sources.

      -

      To obtain a fake report given an attribution source source and +

      To obtain a fake report given an attribution source source and a trigger state triggerState:

      1. @@ -3236,7 +3242,7 @@

        obtain and deliver a debug report on source registration given a source debug data type dataType and an attribution source source:

        +

        To obtain and deliver a debug report on source registration given a source debug data type dataType and an attribution source source:

        1. If source’s debug reporting enabled is false, return.

          @@ -3284,7 +3290,7 @@

          obtain and deliver a debug report with « data » and source’s reporting origin.

        -

        To process an attribution source given an attribution source source:

        +

        To process an attribution source given an attribution source source:

        1. Let destinationRateLimitResult be the result of running check if an attribution source exceeds the time-based destination limit with source.

          @@ -3307,9 +3313,9 @@

          attribution source cache.

        2. -

          Remove all attribution sources entry in cache where entry’s expiry time is less than source’s source time.

          +

          Remove all attribution sources entry in cache where entry’s expiry time is less than source’s source time.

        3. -

          Let pendingSourcesForSourceOrigin be the set of all attribution sources pendingSource of cache where pendingSource’s source origin and source’s source origin are same origin.

          +

          Let pendingSourcesForSourceOrigin be the set of all attribution sources pendingSource of cache where pendingSource’s source origin and source’s source origin are same origin.

        4. If pendingSourcesForSourceOrigin’s size is greater than or equal to the user agent’s max pending sources per source origin:

          @@ -3426,7 +3432,7 @@

          set.

        5. -

          If map["event_trigger_data"] does not exist, return eventTriggers.

          +

          If map["event_trigger_data"] does not exist, return eventTriggers.

        6. Let values be map["event_trigger_data"].

        7. @@ -3486,7 +3492,7 @@

          list.

        8. -

          If map["aggregatable_trigger_data"] does not exist, return aggregatableTriggerData.

          +

          If map["aggregatable_trigger_data"] does not exist, return aggregatableTriggerData.

        9. Let values be map["aggregatable_trigger_data"].

        10. @@ -3497,7 +3503,7 @@

          ordered map, return null.

        11. -

          If value["key_piece"] does not exist or is not a string, return null.

          +

          If value["key_piece"] does not exist or is not a string, return null.

        12. Let keyPiece be the result of running parse an aggregation key piece with value["key_piece"].

        13. @@ -3505,7 +3511,7 @@

          ordered set.

        14. -

          If value["source_keys"] exists:

          +

          If value["source_keys"] exists:

          1. If value["source_keys"] is not a list, return null.

            @@ -3549,7 +3555,7 @@

            parse aggregatable values given an ordered map map:

            1. -

              If map["aggregatable_values"] does not exist, return «[]».

              +

              If map["aggregatable_values"] does not exist, return «[]».

            2. Let values be map["aggregatable_values"].

            3. @@ -3575,7 +3581,7 @@

              list.

            4. -

              If map["aggregatable_deduplication_keys"] does not exist, return aggregatableDedupKeys.

              +

              If map["aggregatable_deduplication_keys"] does not exist, return aggregatableDedupKeys.

            5. Let values be map["aggregatable_deduplication_keys"].

            6. @@ -3650,11 +3656,11 @@

              debug_reporting"] exists and is a boolean, set debugReportingEnabled to value["debug_reporting"].

              +

              If value["debug_reporting"] exists and is a boolean, set debugReportingEnabled to value["debug_reporting"].

            7. Let aggregationCoordinator be default aggregation coordinator.

            8. -

              If value["aggregation_coordinator_origin"] exists:

              +

              If value["aggregation_coordinator_origin"] exists:

              1. If value["aggregation_coordinator_origin"] is not a string, return null.

                @@ -3670,7 +3676,7 @@

                exclude".

              2. -

                If value["aggregatable_source_registration_time"] exists:

                +

                If value["aggregatable_source_registration_time"] exists:

                1. If value["aggregatable_source_registration_time"] is not a string, return null.

                  @@ -3765,7 +3771,7 @@

                  Return true.

                -

                To match an attribution source’s filter data against a filter config given an attribution source source, a filter config filter, a moment moment, and a boolean isNegated:

                +

                To match an attribution source’s filter data against a filter config given an attribution source source, a filter config filter, a moment moment, and a boolean isNegated:

                1. Let lookbackWindow be filter’s lookback window.

                  @@ -3791,7 +3797,7 @@

                  For each key → filterValues of filterMap:

                  1. -

                    If sourceData[key] does not exist, continue.

                    +

                    If sourceData[key] does not exist, continue.

                  2. Let sourceValues be sourceData[key].

                  3. @@ -3806,7 +3812,7 @@

                    Return true.

                  -

                  To match an attribution source’s filter data against filters given an attribution source source, a list of filter configs filters, a moment moment, and a boolean isNegated:

                  +

                  To match an attribution source’s filter data against filters given an attribution source source, a list of filter configs filters, a moment moment, and a boolean isNegated:

                  1. If filters is empty, return true.

                    @@ -3819,7 +3825,7 @@

                    Return false.

                  -

                  To match an attribution source’s filter data against filters and negated filters given an attribution source source, a list of filter configs filters, a list of filter configs notFilters, and a moment moment:

                  +

                  To match an attribution source’s filter data against filters and negated filters given an attribution source source, a list of filter configs filters, a list of filter configs notFilters, and a moment moment:

                  1. If the result of running match an attribution source’s filter data against filters with source, filters, moment, and isNegated set to false is false, return false.

                    @@ -3829,7 +3835,7 @@

                    Return true.

                  12.3. Should attribution be blocked by attribution rate limit

                  -

                  Given an attribution trigger trigger and attribution source sourceToAttribute:

                  +

                  Given an attribution trigger trigger and attribution source sourceToAttribute:

                  1. Let matchingRateLimitRecords be all attribution rate-limit records record of attribution rate-limit cache where all of the following are true:

                    @@ -3894,7 +3900,7 @@

                    Return allowed.

                  12.5. Should attribution be blocked by rate limits

                  -

                  Given an attribution trigger trigger, an attribution source sourceToAttribute, and an attribution rate-limit record newRecord:

                  +

                  Given an attribution trigger trigger, an attribution source sourceToAttribute, and an attribution rate-limit record newRecord:

                  1. If the result of running should attribution be blocked by attribution rate limit with trigger and sourceToAttribute is blocked:

                    @@ -3916,7 +3922,7 @@

                    Return null.

                  12.6. Creating aggregatable contributions

                  -

                  To create aggregatable contributions given an attribution source source and an attribution trigger trigger, run the following steps:

                  +

                  To create aggregatable contributions given an attribution source source and an attribution trigger trigger, run the following steps:

                  1. Let aggregationKeys be the result of cloning source’s aggregation keys.

                    @@ -3929,7 +3935,7 @@

                    For each sourceKey of triggerData’s source keys:

                    1. -

                      If aggregationKeys[sourceKey] does not exist, continue.

                      +

                      If aggregationKeys[sourceKey] does not exist, continue.

                    2. Set aggregationKeys[sourceKey] to aggregationKeys[sourceKey] bitwise-OR triggerData’s key piece.

                    @@ -3942,7 +3948,7 @@

                    For each id → key of aggregationKeys:

                    1. -

                      If aggregatableValues[id] does not exist, continue.

                      +

                      If aggregatableValues[id] does not exist, continue.

                    2. Let contribution be a new aggregatable contribution with the items:

                      @@ -3960,7 +3966,7 @@

                      12.7. Can source create aggregatable contributions

                      -

                      To check if an attribution source can create aggregatable contributions given an aggregatable report report and an attribution source sourceToAttribute, run the following steps:

                      +

                      To check if an attribution source can create aggregatable contributions given an aggregatable report report and an attribution source sourceToAttribute, run the following steps:

                      1. Let remainingAggregatableBudget be allowed aggregatable budget per source minus sourceToAttribute’s aggregatable budget consumed.

                        @@ -3973,7 +3979,7 @@

                        12.8. Obtaining debug data on trigger registration

                        To obtain debug data body on trigger registration given a trigger debug data type dataType, an attribution trigger trigger, -an optional attribution source sourceToAttribute, and an optional attribution report report:

                        +an optional attribution source sourceToAttribute, and an optional attribution report report:

                        1. Let body be a new empty map.

                          @@ -4027,7 +4033,7 @@

                          Return body.

                        To obtain debug data on trigger registration given a trigger debug data type dataType, -an attribution trigger trigger, an optional attribution source sourceToAttribute, +an attribution trigger trigger, an optional attribution source sourceToAttribute, and an optional attribution report report:

                        1. @@ -4073,7 +4079,7 @@

                          report limit and the new report is lower-priority than all pending reports.

                      -

                      To maybe replace event-level report given an attribution source sourceToAttribute and an event-level report report:

                      +

                      To maybe replace event-level report given an attribution source sourceToAttribute and an event-level report report:

                      1. Assert: sourceToAttribute’s number of event-level reports is less than or equal to sourceToAttribute’s max number of event-level reports.

                        @@ -4103,7 +4109,7 @@

                        add-new-report".

                      -

                      To trigger event-level attribution given an attribution trigger trigger, an attribution source sourceToAttribute, and an attribution rate-limit record rateLimitRecord, run the following steps:

                      +

                      To trigger event-level attribution given an attribution trigger trigger, an attribution source sourceToAttribute, and an attribution rate-limit record rateLimitRecord, run the following steps:

                      1. If trigger’s event-level trigger configurations is empty, return the triggering result ("dropped", null).

                        @@ -4265,7 +4271,7 @@

                        triggering result (triggeringStatus, debugData).

                      12.10. Triggering aggregatable attribution

                      -

                      To trigger aggregatable attribution given an attribution trigger trigger, an attribution source sourceToAttribute, and an attribution rate-limit record rateLimitRecord, run the following steps:

                      +

                      To trigger aggregatable attribution given an attribution trigger trigger, an attribution source sourceToAttribute, and an attribution rate-limit record rateLimitRecord, run the following steps:

                      1. If the result of running check if an attribution trigger contains aggregatable data is false, @@ -4362,7 +4368,7 @@

                        12.11. Triggering attribution

                        To obtain and deliver a debug report on trigger registration given a trigger debug data type dataType, -an attribution trigger trigger and an optional attribution source sourceToAttribute:

                        +an attribution trigger trigger and an optional attribution source sourceToAttribute:

                        1. Let debugData be the result of running obtain debug data on trigger registration with dataType, trigger, sourceToAttribute and report set to null.

                          @@ -4513,7 +4519,7 @@

                          obtain an event-level report delivery time given an attribution source source and a moment triggerTime:

                          +

                          To obtain an event-level report delivery time given an attribution source source and a moment triggerTime:

                          1. If automation local testing mode is true, return triggerTime.

                            @@ -4536,7 +4542,7 @@

                            randomized aggregatable report delay.

                          12.13. Obtaining an event-level report

                          -

                          To obtain an event-level report given an attribution source source, an attribution trigger trigger, an event-level trigger configuration config, and a non-negative +

                          To obtain an event-level report given an attribution source source, an attribution trigger trigger, an event-level trigger configuration config, and a non-negative 64-bit integer triggerData:

                          1. @@ -4587,7 +4593,7 @@

                            12.14. Obtaining an aggregatable report’s required budget

                            An aggregatable report report’s required aggregatable budget is the total value of report’s contributions.

                            12.15. Obtaining an aggregatable report

                            -

                            To obtain an aggregatable report given an attribution source source and +

                            To obtain an aggregatable report given an attribution source source and an attribution trigger trigger:

                            1. @@ -5326,7 +5332,7 @@

                              parameters associated with value.

                            2. -

                              If params["debug-reporting"] exists and params["debug-reporting"] is a boolean, +

                              If params["debug-reporting"] exists and params["debug-reporting"] is a boolean, set debugReporting to params["debug-reporting"].

                            3. Let registration be a new OS registration struct whose items are:

                              @@ -5607,14 +5613,14 @@

                              source origin could intentionally hit a rate-limit to identify sensitive user data. These attribution debug data cannot be reported explicitly and may be reported as a source-success attribution debug report. This is a tradeoff between security and utility, and mitigates the security concern with respect to the Same-Origin Policy. The risk is of less concern for -trigger registrations as attribution sources have to be registered to start with and +trigger registrations as attribution sources have to be registered to start with and it requires browsing activity on multiple sites.

                              17.2. Opting in to the API

                              This section is non-normative.

                              As a general principle, the API cannot be used purely at the HTTP layer without some level of opt-in from JavaScript or HTML. For HTML, this opt-in is in the form of the attributionSrc attribute, and for JavaScript, it is the various modifications to fetch, XMLHttpRequest, and the window open steps.

                              -

                              However, this principle is only strictly applied to registering attribution sources. For triggering attribution, we waive this requirement for the sake of compatibility with existing +

                              However, this principle is only strictly applied to registering attribution sources. For triggering attribution, we waive this requirement for the sake of compatibility with existing systems, see 347 for context.

                              18. Privacy considerations

                              @@ -5624,30 +5630,31 @@

                              18.2. Cross-site information disclosure

                              This section is non-normative.

                              The API is concerned with protecting arbitrary cross-site information from being passed -from one site to another. For a given attribution source, any outcome associated with it +from one site to another. For a given attribution source, any outcome associated with it is considered cross-site information. This includes:

                              The information embedded in the API output is arbitrary but can include things like browsing history and other cross-site activity. The API aims to provide some protection for this information:

                              18.2.1. Event-level reports

                              -

                              Any given attribution source has a set of possible trigger states. +

                              Any given attribution source has a set of possible trigger states. The choice of trigger state may encode cross-site information. To protect the cross-site information disclosure, -each attribution source is subject to a randomized response mechanism [RR], -which will choose a state at random with pick rate dependent on the user agent’s randomized response epsilon.

                              +each attribution source is subject to a randomized response mechanism [RR], +which will choose a state at random with pick rate dependent on the source’s event-level epsilon, which has an upper bound of the +user agent’s max settable event-level epsilon.

                              This introduces some level of plausible deniability into the resulting event-level reports (or lack thereof), as there is always a chance that the output was generated from a random process. We can reason about the -protection this gives an individual attribution source from the lens of differential privacy [DP].

                              +protection this gives an individual attribution source from the lens of differential privacy [DP].

                              Additionally, event-level reports limit the amount of relative cross-site information associated with -a particular attribution source. We model this using the notion of channel capacity [CHAN]. For every attribution source, +a particular attribution source. We model this using the notion of channel capacity [CHAN]. For every attribution source, it is possible to model its output as a noisy channel. The number of input/output symbols is governed by its associated set of possible trigger states. With the randomized response mechanism, -this allows us to analyze the output as a q-ary symmetric channel [Q-SC], with q equal to the size of the set of possible trigger states. This is normatively defined in the compute the channel capacity of a source algorithm.

                              -

                              Note that navigation attribution sources and event attribution sources may -have different channel capacities, given that event attribution sources can be registered without user activation or top-level navigation. Maximum capacity for each type is governed by the vendor-defined max event-level channel capacity per source.

                              +this allows us to analyze the output as a q-ary symmetric channel [Q-SC], with q equal to the size of the set of possible trigger states. This is normatively defined in the compute the channel capacity of a source algorithm.

                              +

                              Note that navigation attribution sources and event attribution sources may +have different channel capacities, given that event attribution sources can be registered without user activation or top-level navigation. Maximum capacity for each type is governed by the vendor-defined max event-level channel capacity per source.

                              18.2.2. Aggregatable reports

                              Aggregatable reports protect against cross-site information disclosure in two primary ways:

                                @@ -5655,8 +5662,8 @@

                                attribution trigger, whether it is attributed to a source is subject to one-way noise via generating null reports with some probability. Note that because the noise does not drop true reports, this is only a partial -mitigation, as if an attribution source never generates an aggregatable report, an -adversary can learn with 100% certainty that an attribution source was never matched with +mitigation, as if an attribution source never generates an aggregatable report, an +adversary can learn with 100% certainty that an attribution source was never matched with an attribution trigger.

                              1. Cross-site information embedded in an aggregatable report's contributions is encrypted with a public key, ensuring that individual @@ -6037,6 +6044,7 @@

                                Max number of event-level reports, in § 6.10
                              2. Max pending sources per source origin, in § 9
                              3. Max settable event-level attributions per source, in § 8 +
                              4. Max settable event-level epsilon, in § 9
                              5. Max settable event-level report windows, in § 8
                              6. Max source reporting origins per rate-limit window, in § 9
                              7. Max source reporting origins per source reporting site, in § 9 @@ -6134,7 +6142,6 @@

                                Randomized null report rate excluding source registration time, in § 9
                              8. Randomized null report rate including source registration time, in § 9
                              9. randomized response, in § 6.10 -
                              10. Randomized response epsilon, in § 9
                              11. Randomized response output configuration, in § 6.1
                              12. Randomized source response, in § 6.2
                              13. @@ -7129,7 +7136,7 @@