The modern web is funded by advertisements. Advertisements pay for all those \u201cfree\u201d services you love, as well as many of the products you use on a daily basis — including Firefox. There\u2019s nothing inherently wrong with advertising: Mozilla\u2019s Principle #9 states that \u201cCommercial involvement in the development of the internet brings many benefits.\u201d However, that principle goes on to say that \u201ca balance between commercial profit and public benefit is critical\u201d and that\u2019s where things have gone wrong: advertising on the web in many situations is powered by ubiquitous tracking of people\u2019s activity on the web in a way that is deeply harmful to users and to the web as a whole.<\/p>\n\n\n\n
The ad tech ecosystem is incredibly complicated<\/a>, but at its heart, the way that web advertising works is fairly simple. As you browse the web, trackers (mostly, but not exclusively advertisers), follow you around and build up a profile of your browsing history. Then, when you go to a site which wants to show you an ad, that browsing history is used to decide which of the potential ads you might see you actually get shown. <\/p>\n\n\n\n The visible part of web tracking is creepy enough — why are those pants I looked at last week following me around the Internet? — but the invisible part is even worse: hundreds of companies you\u2019ve never heard of follow you around as you browse and then use your data for their own purposes or sell it to other companies you\u2019ve also never heard of. <\/p>\n\n\n\n The primary technical mechanism used by trackers is what\u2019s called \u201cthird party cookies\u201d. A good description of third party cookies can be found here<\/a>, a cookie<\/em> is a piece of data that a website stores on your browser and can retrieve later. A third party<\/em> cookie is a cookie which is set by someone other than the page you\u2019re visiting (typically a tracker). The tracker works with the web site to embed some code from the tracker on their page (often this code is also responsible for showing ads) and that code sets a cookie for the tracker. Every time you go to a page the tracker is embedded on, it sees the same cookie and can use that to link up all the sites you go to. <\/p>\n\n\n\n Cookies themselves are an important part of the web — they\u2019re what let you log into sites, maintain your shopping carts, etc. However, third party cookies are used in a way that the designers of the web didn\u2019t really intend and unfortunately, they’re now ubiquitous. While they have some legitimate uses, like federated login, they are mostly used for tracking user behavior.<\/p>\n\n\n\n Obviously, this is bad and it shouldn\u2019t be a surprise to anybody who has followed our work in Firefox that we believe this needs to change. We\u2019ve been working for years to drive the industry in a better direction. In 2015 we launched Tracking Protection<\/em><\/a>, our first major step towards blocking tracking in the browser. In 2019 we turned on a newer version of our anti-tracking technology by default for all of our users<\/a>. And we\u2019re not the only ones doing this.<\/p>\n\n\n\n We believe all browsers should protect their users from tracking, particularly cookie-based tracking, and should be moving expeditiously to do so.<\/p>\n\n\n\n Although third-party cookies are bad news, now that they are so baked into the web, it won’t be easy to get rid of them. Because they\u2019re a dual-use technology with some legitimate applications, just turning them off (or doing something more sophisticated like Firefox Total Cookie Protection<\/a>) can cause some web sites to break for users. Moreover, we have to be constantly on guard against new tracking techniques<\/a>.<\/p>\n\n\n\n One idea that has gotten a lot of attention recently is what\u2019s called \u201cPrivacy Preserving Advertising\u201d (PPA) . The basic idea has a long history with systems such as Adnostic<\/a>, PrivAd<\/a>, and AdScale<\/a> but has lately been reborn with proposals from Google<\/a>, Microsoft<\/a>, Apple<\/a>, and Criteo<\/a>, among others. The details are of course fairly complicated, but the general idea is straightforward: identify the legitimate (i.e., non-harmful) applications for tracking techniques and build alternative technical mechanisms for those applications without threatening user privacy. Once we have done that, it becomes much more practical to strictly limit the use of third party cookies.<\/p>\n\n\n\n This is a generally good paradigm: technology has advanced a lot since cookies were invented in the 1990s and it\u2019s now possible to do many things privately that used to require just collecting user data. But, of course, it\u2019s also possible to use technology to do things that aren\u2019t so good (which is how we got into this hole in the first place). When looking at a set of technologies like PPA, we need to ask:<\/p>\n\n\n\n Because this isn\u2019t just one technology but rather a set of them, we should expect some pieces to be better than others. In particular, ad measurement is a use case that is important to the ecosystem, and we think that getting this one component right can drive value for consumers and engage advertising stakeholders. There\u2019s overlap here with technologies like Prio<\/a> which we already use in Firefox<\/a>. On the other hand, we\u2019re less certain about a number of the proposed technologies for user targeting, which have privacy properties that seem hard to analyze. This is a whole new area of technology, so we should expect it to be hard, but that\u2019s also a reason to make sure we get it right.<\/p>\n\n\n\n Obviously, this is just the barest overview. In upcoming posts we\u2019ll provide a more detailed survey of the space, covering the existing situation in more detail, some of the proposals on offer, and where we think the big opportunities are to improve things in both the technical and policy domains.<\/p>\n\n\n\n For more on this:<\/strong><\/p>\n\n\n\n Building a more privacy preserving ads-based ecosystem<\/a><\/p>\n\n\n\n Privacy analysis of FLoC<\/a><\/p>\n\n\n\n Mozilla responds to the UK CMA consultation on google\u2019s commitments on the Chrome Privacy Sandbox<\/a><\/p>\n\n\n\n Privacy analysis of SWAN.community and Unified ID 2.0<\/a><\/p>\n\n\n\nPrivacy Preserving Advertising<\/h3>\n\n\n\n
What\u2019s next?<\/h3>\n\n\n\n