Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

On the Differential Privacy and Interactivity of Privacy Sandbox Reports

Badih Ghazi, Charlie Harrison, Arpana Hosabettu, Pritish Kamath, Alexander Knop, Ravi Kumar, Ethan Leeman, Pasin Manurangsi, Mariana Raykova, Vikas Sahu, Phillipp Schoppmann

TL;DR

This work formalizes differential privacy guarantees for Google’s Privacy Sandbox measurement APIs, focusing on the Attribution Reporting API (ARA) and Private Aggregation API (PAA) under highly interactive workloads where queries and data can evolve based on prior outputs. It introduces a rigorous interactive mechanism model and proves that both summary reports and event-level reports satisfy $(\varepsilon, \delta)$-DP via an intermediate IDP (individual differential privacy) framework, even when features such as key discovery and requerying are enabled. The analysis hinges on noisy aggregation using discrete Laplace mechanisms and careful budgeting across sources, triggers, campaigns, and time windows, ensuring privacy budgets are respected while preserving useful aggregate statistics like reach and attributed conversions. The results provide a principled DP justification for cross-site ad measurement in practice, with implications for how budgets are allocated, how noise is calibrated, and how privacy guarantees extend to interactive and gradual-expiration settings. Overall, the paper advances the theoretical foundations of DP in real-world ad-tech privacy infrastructures, informing policymakers and engineers about the feasibility and limits of DP guarantees in privacy-preserving measurement ecosystems.

Abstract

The Privacy Sandbox initiative from Google includes APIs for enabling privacy-preserving advertising functionalities as part of the effort around limiting third-party cookies. In particular, the Private Aggregation API (PAA) and the Attribution Reporting API (ARA) can be used for ad measurement while providing different guardrails for safeguarding user privacy, including a framework for satisfying differential privacy (DP). In this work, we provide an abstract model for analyzing the privacy of these APIs and show that they satisfy a formal DP guarantee under certain assumptions. Our analysis handles the case where both the queries and database can change interactively based on previous responses from the API.

On the Differential Privacy and Interactivity of Privacy Sandbox Reports

TL;DR

This work formalizes differential privacy guarantees for Google’s Privacy Sandbox measurement APIs, focusing on the Attribution Reporting API (ARA) and Private Aggregation API (PAA) under highly interactive workloads where queries and data can evolve based on prior outputs. It introduces a rigorous interactive mechanism model and proves that both summary reports and event-level reports satisfy -DP via an intermediate IDP (individual differential privacy) framework, even when features such as key discovery and requerying are enabled. The analysis hinges on noisy aggregation using discrete Laplace mechanisms and careful budgeting across sources, triggers, campaigns, and time windows, ensuring privacy budgets are respected while preserving useful aggregate statistics like reach and attributed conversions. The results provide a principled DP justification for cross-site ad measurement in practice, with implications for how budgets are allocated, how noise is calibrated, and how privacy guarantees extend to interactive and gradual-expiration settings. Overall, the paper advances the theoretical foundations of DP in real-world ad-tech privacy infrastructures, informing policymakers and engineers about the feasibility and limits of DP guarantees in privacy-preserving measurement ecosystems.

Abstract

The Privacy Sandbox initiative from Google includes APIs for enabling privacy-preserving advertising functionalities as part of the effort around limiting third-party cookies. In particular, the Private Aggregation API (PAA) and the Attribution Reporting API (ARA) can be used for ad measurement while providing different guardrails for safeguarding user privacy, including a framework for satisfying differential privacy (DP). In this work, we provide an abstract model for analyzing the privacy of these APIs and show that they satisfy a formal DP guarantee under certain assumptions. Our analysis handles the case where both the queries and database can change interactively based on previous responses from the API.

Paper Structure

This paper contains 30 sections, 11 theorems, 7 equations, 4 figures, 2 tables, 9 algorithms.

Table of Contents

  1. Introduction
  2. Our Contributions
  3. Related Work
  4. Differential Privacy.
  5. Private Ad Measurement.
  6. Organization.
  7. Privacy Sandbox Measurement APIs
  8. Summary Reports
  9. Aggregation Service
  10. ARA Client
  11. PAA Client & Shared Storage
  12. Event-level Reports
  13. Noisy Version of $\textsf{ARA-Event-Client}\xspace$.
  14. Differential Privacy
  15. Interactive Mechanisms
  16. ...and 15 more sections

Key Result

Theorem 4.1

If an interactive mechanism satisfies $(\varepsilon_*, \delta_*)$-IDP, then it satisfies $(\varepsilon_*, \delta_*)$-DP.

Figures (4)

  • Figure 1: Illustrative example of an aggregatable report generated by ARA-SR-Client.
  • Figure 1: Possible number of reports sent on Day 1 and Day 5 for "sandals".
  • Figure 2: Illustrative example of an aggregatable report generated by PAA-SR-Client.
  • Figure 3: Illustrative example of event-level reports generated by ARA-Event-Client.

Theorems & Definitions (24)

  • Remark 2.1
  • Remark 2.2
  • Remark 2.3
  • definition 1: $(\varepsilon, \delta)$-Indistinguishability
  • definition 2: Differential Privacy
  • definition 3: Interactive Mechanism
  • definition 4: Interactive Adversary
  • definition 5: DP for Interactive Mechanisms
  • Remark 3.2
  • definition 6: Individual DP
  • ...and 14 more