Request for Position: Topics API

[jkarlin]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: Topics API
• Specification or proposal URL: https://github.com/patcg-individual-drafts/topics
• Caniuse.com URL (optional):
• Bugzilla URL (optional):
• Mozillians who can provide input (optional):

Other information

Chrome status page: https://chromestatus.com/feature/5680923054964736

Note that Chrome is implementing (with spec following shortly after) but we're quite open to evolving the API over time and are appreciative of your feedback.

[martinthomson]

@jkarlin, does Google intend to publish the privacy analysis of Topics that you had? I've seen a draft, but I'd like to be able to reference that in our response here as some of the details appear to be relevant to our conclusions.

[jkarlin]

Yes, that's available at https://github.com/patcg-individual-drafts/topics/blob/main/topics_analysis.pdf

[martinthomson]

Apologies for taking so long on this one. This is a very challenging area and a difficult problem to analyze.

Our conclusion is that we're "negative" on Topics. Our reasoning is different than that of Apple, though we broadly agree with many of the points they make.

Fundamentally, we just can't see a way to make this work from a privacy standpoint. Though the information the API provides is small, our belief is that this is more likely to reduce the usefulness of the information for advertisers than it provides meaningful protection for privacy. Unfortunately, it is hard to identify concrete ways in which this might be improved.

High points:

• The analysis Google provides claims to identify a worst case, but this is only in the aggregate. The worst case for individuals is potentially much worse, with some users potentially being identifiable in any population size. This appears to be more likely as the set of users that visit a site is smaller and more biased in their interests.

• The 5% chance of producing a random topic provides negligible protection against sites learning whether an interest is genuine. Though this protection appears to be critical, we aren't confident in its efficacy.

• We identify challenges and problems with topic assignment to sites and the ML-based inferences. Some design decisions appear to be open to abuse.

• The requirement that sites can only access topics that they have previously witnessed enables tracking in its current form. It also creates a strong bias toward large, established players.

• Though this is not something we're experts in, we're not clear on the value of this sort of information from an advertising efficiency perspective. More so if you consider the potential need to strengthen privacy protections.

I've written a longer analysis that goes into quite a bit more detail for those who care to dig into this more.

[estelle]

can we add the position: negative label to this issue?