Apple critique of Google's Topics API based on bad code

🌈 Abstract

The article discusses Apple's criticism of Google's Topics API, a system designed to serve online ads based on a user's Chrome browsing history, and the potential privacy risks associated with it.

🙋 Q&A

[01] Apple's Criticism of Google's Topics API

1. What are the key points of Apple's criticism of Google's Topics API?

• Apple claims the Topics API aids digital fingerprinting that could be used by advertisers to identify previously unknown web users, a longstanding privacy concern.
• Apple cites a research paper that suggests the 5% noise intended to provide plausible deniability for users can be defeated, and the Topics API can be used to fingerprint and re-identify users.
• Apple argues that the web should progress without increasing fingerprintability, and that new APIs should not compound the fingerprinting problem.

2. How does Google respond to the research paper's findings?

• A Google engineer pointed out an issue in the research paper's methodology, where the random number generator was not being reseeded on each worker, resulting in the same stream of random numbers being used.
• Fixing this bug reduced the re-identification rate from about 57% to roughly 3%.

3. What is the revised assessment of the fingerprinting risk posed by the Topics API?

• After the methodology issue was fixed, the researchers found that 2.3%, 2.9%, and 4.1% of users were uniquely re-identified after one, two, and three observations of their topics, respectively.
• While this is still a significant number of users, it is much lower than the initial 57% figure.

[02] Google's Privacy Sandbox and the Role of Third-Party Cookies

1. What was the original purpose of the Topics API?

• The Topics API was intended as a replacement for third-party cookies, the legacy tracking and targeting mechanism that Google had planned to remove from Chrome due to privacy concerns.
• The Topics API was designed to provide a privacy-preserving way for advertisers to target users with ads tailored to their interests, as inferred from their browsing activity.

2. What led Google to reconsider its plan to remove third-party cookies from Chrome?

• Pushback from advertisers and regulators prompted Google to reconsider its plan to remove third-party cookie support from Chrome.
• Google's own tests suggested that retaining third-party cookies would result in higher programmatic ad revenue, though the Topics API performs better than nothing when third-party cookies are not an option.