Don Marti https://blog.zgp.org/feed.xml Personal blog for Don Marti 1,741 partners https://blog.zgp.org/1741-partners/ https://blog.zgp.org/1741-partners/ Fri, 31 Jul 2026 00:00:00 +0000 previously: paleoenshittification and a path to adoption for MyTerms

The European privacy organization noyb has filed a complaint over a common web annoyances. This one is a little more extreme than most: 1,741 “informed” consents with one click?! GDPR complaint against dict.cc filed. Who has 1,741 “partners”? Anyway, this claimed “consent” to data collection by all these “partners” is stored in the following TCF string.

CQoKcgAQoKcgAAJAGBENCpFsAP_gAEPgACiQMttR_G__bWlr-bb3abtkeYxP9_hr7sQxBgbIkm4FzLvW7JwGx2EZJAyatiIKmRIAu3DBIQNlHBDURUCgKIAFryDMaE2U4TNKJ6BkiFMZIytQCEhvm4tjeQCZ4ur_9kc0mB-t7dr-2dzyy6hHn3a5fmS1UJSdIYesDfv-ZhOS-9IEd-x8v4v4_EbpEm8eSVn9pGtp4jc6Yns6dBmxt-Tyff6Pn_f71fW7X_ve_n3zv8oXn7rr6-__f3-7___-b_-___b-__7Z_zM_37_v_YMttR_G_9bXlv-bBX4btkOYxf9_gD7sQxBAbIomYFzLqW5IwC32ETJEiaMCIIGRAAo1BBIAEpEBhEREChCIAVLxDsAE0Q4TtIAeBkgDMZYiBQAEhPi4tjWQCZ4Op-dUd0iQ2s5Nr22VyyWbAjn3KteOSVUJicKYMFHetuYhMQ-vIU93RK9otI_MbpEkIYARv9lWpl4TYa4vnKVpqxNeRydMSffdFz3fW7RO3a-91k-uqSV_rb4uXW5m__bNn_f138_f_7Z7_1x-3Zf_f__4AAAA.IMttR_G__bXlv-bb36btkeYxf9_hr7sQxBgbIsm4FzLvW7JwG32EbJEyatiIKmRIAu3DBIQNtHBjURUChKIAVrzDsaE2U4TtKJ-BkiHMZYytQCEhvm4tjeQCZ4ur_90d0mR-t7dr-2dzy27hnn3a9fuS1UJydKYetHfv-ZhOS-_IU9_x-_4v4_MbpEm8eSVv9tWtt4zc64vv6dpuxt-Tyff6f__f73fW7X__e__33_-qX3_r76-___3______f__________9_________4A.f_wAD_wAAAAA

If I visit the site from the complaint using a European VPN endpoint, Yes, I went to that site with VPN to Europe on and ad blocker off, and ended up seeing a gross fungus treatment ad. Yeech. The things I do for privacy research and click the obvious button to make the annoying dialog go away, this is what gets stored in the browser. And no, I won’t say that I “consented” because I’m still not informed enough about this industry to give informed consent in all but a few cases.

But why 1,741 partners? Because of the way that this stuff works in Europe right now.

  1. A site gets a Consent Management Platform (CMP) – a third party script that powers the annoying “consent dialog”/“cookie banner”

  2. A person with up-to-date knowledge of the site’s data practices carefully configures the CMP to match the…lol, no, somebody clicks various options in the CMP menu until the errors and warnings stop, which is how you end up with “1,714 partners” and other ludicrous messages to end users.

  3. When a user visits the site and clicks the CMP “consent” button, the CMP stores a record of “consent.” (This can be in TCF, or in a related format called Global Privacy Protocol that wraps TCF along with other strings that apply to non-EU jurisdictions.)

  4. Any company that is somehow processing the user’s information has to check the record from step 3.

There’s no step in the process for MyTerms, and the way it’s set up makes it look like a MyTerms check is not needed at all. No decision-maker at the site is going to see any need to get contractual permission to do some data processing that, as far as they can tell, they “already have consent for.” (It’s fake consent because Irish politics, but people settle for it.)

So a way to get more sites interested in MyTerms is something like a step 3.5.

  • Detect when a CMP is generating a TCF or GPP string.

  • Where the string indicates “consent” to anything that would be disallowed by any of the possible MyTerms contracts that the user has indicated they would accept, modify the string to remove the conflict.

This filtering or masking step is not going to produce as good of a result as a full MyTerms transaction that both user and site participate in, but it at least takes a step to prevent the data practices most inconsistent with the user’s preferences (and safety), and gives the site an incentive to upgrade to full MyTerms instead of just filtered GPP.

Different MyTerms implementations might approach GPP and TCF integration differently.

One possibility is to provide a surrogate script for the CMP and prevent the annoying “consent” dialog from ever showing up.

Or implement the CMP API to provide a filtered result to callers.

I’m sure that other possible approaches exist, too. The only approach to GPP and TCF that I know for sure won’t work is ignoring them.

]]> The hidden cost of New York Times AI columns https://blog.zgp.org/the-hidden-cost-of-new-york-times-ai-columns/ https://blog.zgp.org/the-hidden-cost-of-new-york-times-ai-columns/ Thu, 30 Jul 2026 00:00:00 +0000 In The Hidden Cost of China’s Free A.I., Tal Feldman writes,

A.I. models are very different from the usual inexpensive imports we buy from China. These products must promote the interests of the Chinese government. Propaganda and false claims are baked into them.

…

Whoever supplies the world’s A.I. will shape how the world thinks. As these models get smarter and more autonomous, we are outsourcing more and more thinking to them. That “cognitive offloading” must not go to models that were designed to promote a foreign government, no matter how inexpensive they are.

Two problems with that. (Aside from letting the AI shape how you think, which, yikes. But the influence is already there, and we have to expect that it will persist.)

First of all, the choice is not between propaganda AI from the PRC and some hypothetical, honest red, white, and blue AI from the good old USA. The average American has more in common with a random propaganda commissar in China then with the deeply weird TESCREAL investors, founders, and CEOs who run the AI operations here.

Second, as more and more legal opt-outs apply to LLM training sets here, the US-based AI firms will rely more and more on vibe CMS automated paraphrased versions of US and European news and culture. Legit publishers will opt out the copyrighted works they own or distribute, in the hopes of training license deals. Big AI firms will pay a few publishers for PR value, but mostly settle for first-generation lossy copies.

And a lot of that free training material will have been run through someone’s PR filter. For example, a reputation management firm could make a site that mostly generates high-fidelity paraphrases of legit news, but folds in positive mentions of the firm’s clients. Almost everyone wins: big US-based AI gets freely crawlable tokens, the client gets their crimes buried in LLM-generated answers, most news consumers get an adequate free paraphrase. Meanwhile, though, AI operations in the PRC will be able to train on material that’s one generation fresher.

The problem isn’t so much that “our side’s” AI is better than theirs, or the other way around. Every LLM is going to have embedded biases, for a variety of reasons. Propaganda and copyright-related biases are only two.

]]> How scams target you online—and how to fight back https://blog.zgp.org/how-scams-target-you-online-and-how-to-fight-back/ https://blog.zgp.org/how-scams-target-you-online-and-how-to-fight-back/ Sun, 26 Jul 2026 00:00:00 +0000 The prophet Jeremiah once asked,

Wherefore doth the way of the wicked prosper? wherefore are all they happy that deal very treacherously?

Every generation of people perceives a collapse in ethical behavior, and if the trust level of human civilization had really been sliding that badly for so long—the book of Jeremiah was written 2600 years ago—nothing would be left for us by now.

That perception of decline is not surprising, considering that most people respect norms of honesty and reciprocity, but the transgressors tend to attract more attention. Often, people who comment on moral collapse are older adults comparing their experiences with their own peer group to the crimes of the younger, higher-profile 30 under 30 crowd.

So we can’t just go by vibes, by our feelings of how much of a rip-off everything is now. We have to take a step back and look at the stats. And this time, possibly because of how network effects amplify the impact of a few big companies, it’s a real problem.

According to the FTC, people in the USA lost $2.1B to social media scams in 2025. Internal documents from Meta, which owns Facebook, Instagram, and WhatsApp, estimated that the company is involved in about 1/3 of successful scams here.

And Meta isn’t the only company that designs an Internet platform to work better for scammers. Google tweaks their systems and policies to benefit scams, too. The FBI warns,

Cyber criminals use advertisements that imitate legitimate companies to misdirect targets conducting an internet search for a specific website.

Google Search is a major scam risk because of some choices in software design and ad policies that make their platform work better for scammers and worse for those trying to catch them. As Prof. Tressie McMillan Cottom wrote, we are now living in a scam culture.

Scams weaken our trust in social institutions, but their going mainstream—divorced from empathy for the victims or stigma for the perpetrators—means that we have accepted scams as institutions themselves.

Google and Meta are large enough, and have enough impact on how people and companies find each other, that their internal collapse in business ethics has an oversized impact on the whole economy.

The ways that big companies profit from online fraud is pretty complicated, but I think I can explain it if we work backwards. And the better we understand how scam culture has been coded into everyday business practices, the better we will be able to roll it back.

The auction

Most online advertising, legit or criminal, is placed using some kind of auction. Probably the best known is the system behind Google’s search ads, which Edelman et al. explained in Internet Advertising and the Generalized Second-Price Auction: Selling Billions of Dollars Worth of Keywords.

Every time there is some opportunity to show an ad to you—whether it’s because you did a web search, scrolled a social media feed, or visited a web site with ads—some computer program in a data center somewhere acts like a very fast auctioneer, selling off the ad space to the highest bidder.

The bidders in the auction are AI, using three different kinds of information to “decide” how much to bid.

  • Context: where the ad will appear

  • Intent: what you’re doing (if a bidder infers that you’re shopping, the ads reaching you go way up in value)

  • Personal information: some other qualities about you that a bidder has collected or inferred.

If you notice that you get different ads on search engines or social media from other people, you have probably been classified differently from them, so different bidders are bidding high enough to win the auctions.

Why Facebook and Google tolerate scams

The auction mechanism explains why Meta and Google seem so incompetent at filtering out the scam ads. An auction generally gets higher prices when there are more bidders. And the ad auction is no exception. (How is it that social sites make it so easy to tag people who appear in photos, but they somehow can’t spot a bank logo in an ad and alert the real bank?)

Meta estimated that they get 10% of their revenue from illegal and policy-violating ads—but that doesn’t mean that scammers are responsible for 10% of their revenue. All of the legit advertisers are paying more, too, because every time “their” AI bidder participates in an ad auction, it has to go up against not just legit competitors, but scammers too.

No wonder that, as Bob Sullivan explains, Facebook’s algorithm pushes people into the arms of criminals. Meta and Google refuse to take some basic steps to make it easier for law enforcement and consumer organizations to spot scam advertisers, or for their real advertisers to spot their fake competitors.

Know the scam, avoid the ad?

I’m fortunate enough to avoid some kinds of online scam ads. For example, I rarely see those urgent Microsoft warnings, you know, the ones that will put you on the phone with a “tech support” person to talk you through installing a computer virus.

I don’t get those tech support ads because AI bidders can infer that I keep up with computer stuff. But I’m sure that there are plenty of scams I would be more likely to fall for. I’m probably about as gullible as average if a scammer could figure me out—maybe a realistic urgent alert related to an upcoming trip?

In general, the less accurately I can be targeted, the better. I probably won’t get any fewer scams by being misclassified, but I’d rather get scam ads that I’ll laugh at than scam ads I’ll click on.

In order for the scam problem to flourish, though, the scams must be getting matched up to the people likely to fall for them.

Normal companies passing targeting data

The Big Tech companies collect some data about what you watch and do on their sites and apps. But a lot of targeting data comes from a place you wouldn’t expect. It’s actually provided to the Big Tech platforms by normal small businesses.

Why?

Companies that advertise with Google and/or Meta are encouraged to share their customer information.

For example, they can report when somebody bought something, or send a customer list to the Big Tech company to train the AI to find people similar to their customers to show ads to. They can even report on who’s reading what pages of their web site.

And because of the built-in auction mechanisms on the platform, every advertiser ends up sharing information with every other advertiser. Every customer list that you appear on helps to train the AI to target you for ads you’re likely to respond to—including the scam ones.

Doing legit businesses a favor

People who do online marketing are family members and citizens, too. They don’t want to support Big Tech’s noisy, resource-sucking data centers, social media mental health harm, or other corporate crimes, any more than the rest of us do.

But sometimes Big Tech companies make it hard to justify not spending money with them. And it’s hard to speak out in the marketing meeting and say, “our company should do the right thing.”

But over time, privacy cases can help change that.

When a marketing person has trouble justifying moving the budget away from Big Tech and into legit marketing projects, the benefit of avoiding legal issues can shift the balance. It’s sort of like the struggle by people with disabilities to get the accommodations required by the Americans with Disabilities Act. Being able to point out the risk of legal action can help a business decision-maker do the right thing.

Next steps

The Big Tech companies want people to think of the Internet as some kind of lawless zone, and they throw around scary terms like “Section 230” to try to make people think that the fix is in, and there’s no point going after a scam at the source. But when you dig into the files from the California Legislature and the courts, that’s not how it is. Regular people are making progress in the courts against scammers and their enablers. If you want to learn more, please get in touch.

]]> Links for 25 July 2026 https://blog.zgp.org/mlp-2026-07-25/ https://blog.zgp.org/mlp-2026-07-25/ Sat, 25 Jul 2026 00:00:00 +0000 Programmatic Platforms Champion Transparency, But Not If It Means Giving Activists Access by Anthony Vargas. (I said I would let you know when it’s safe to turn off your ad blocker, and nope, still wretched hive of scum and villainy. This story is about good ads sneaked onto bad sites—but every time that happens, it leaves some good site with an ad slot to fill, so more of the bad ads get served. The industry has existing tools, often already standardized, just doesn’t want to use them.)

Apple Updates Its Advertising Policies by Nick Heer. (More news from how Apple is on the enshittification curve the same as any other company.)

The political polarization of health outcomes in the USA by Elizabeth Elder and Neil A. O’Brian. Roughly half of this new health gap is due to people changing their ideology over time, with new entrants to the conservative coalition being less healthy than new liberals. But another sizeable share is due to people who were already liberal or conservative diverging more in health over time. (Maybe William James was right about the cash value of beliefs, and some people are just invested in lower-return asset classes?)

Experience Better Browsing: Introducing Native Containers in Firefox 153 (This is part of the easiest way to containerize and mostly de-enshittify YouTube, now part of the browser.)

A decade after the ‘Godfather of AI’ said radiologists were obsolete, their salaries are up to $571K and demand is growing fast vy Marco Quiroz-Gutierrez. Over the last 10 years, the number of active radiologists in the U.S. has grown by about 10%, said Christoph Herpfer, an economist and business administration professor at the University of Virginia’s Darden School of Business who studies health care finance and physician labor markets. We actually have a huge shortage of radiologists. So the exact opposite of this prediction has happened, he told Fortune.

Book publishers sue Google for copyright infringement over Gemini AI training by Emma Loffhagen. The publishers argue that Google repurposed books that had been supplied for limited services such as Google Books, Google Play Books and Google Scholar. Those services allowed Google to use the works in specific ways – for example, to display searchable snippets or sell ebooks – but not, the lawsuit claims, to copy them for training commercial AI products.

Please Stop Making Me Opt Out of AI by Reece Rogers. (not likely. Number must go up.) Related: https://マリウス.com/the-rise-of-the-bullshittery/), The Lies They’re Telling Towns And Tribes About The Benefits Of AI Data Centers by Karl Bode, The Pollution Being Churned Out by AI Data Centers Is So Severe That It’s Almost Incomprehensible by Victor Tangermann.

Please, I Beg You, Do Not Fill My TV With Pregnancy Ads by Victoria McNally—associate editor of AdExchanger. (Marketing people know that this stuff is creepy as hell, and counterproductive for the brand, but they’re so cohesive as a group that it will take a swift kick from outside to stop the slide into chickenization.) Related: Where Did It All Go Wrong For Agencies? by Brian Jacobs.

Google’s new use of IPs in Europe by Alan Chapell. Hooray, Google imposes yet another compliance tax on companies using their services. Accordingly, anyone running a third-party CMP supporting Adsense must surface Feature 3 in Google’s vendor entry before August 3 or risk understated-disclosure exposure and limited-ads degradation (not to mention legal liability). (Somewhere in Mountain View, Google lawyers are passing the bong and laughing their asses off about being able to make people do all this stuff. I got it, I got it, make them quack like a duck next, they’ll totally do it!)

Meta’s AI advertising dreams have become a nightmare for brands by Lara O’Reilly, Sydney Bradley, and Lucia Moses. Meta is pushing advertisers to use its AI tools — and results are proving chaotic: strangely twisted limbs, gibberish writing, or entirely changed products. Meta’s response to brands: That’s on you, not us. (Don’t worry, when Meta takes control of how the ad results get measured across all media, these ads will turn out to be the best ads ever.)

]]> Are ya winning, son? https://blog.zgp.org/are-ya-winning-son/ https://blog.zgp.org/are-ya-winning-son/ Wed, 22 Jul 2026 00:00:00 +0000 The attribution cartel is in Digiday, in a series by Ronan Shields.

I’m quoted, about the proposal’s biggest privacy problem.

“You get this paradoxical increase in user privacy risks, because the proposal obfuscates and rewards attribution fraud,” he told Digiday, adding the proposal’s current guise actually “creates more incentives to collect more data on more people in order to sneak ads in front of those who are about to buy anyway.”

And so is Angelina Eng, formerly VP of measurement at Interactive Advertising Bureau (IAB) U.S.

“There is no one-size-fits-all solution, and there is always customization,” she explained to Digiday, urging the importance of the ability to slice and dice data across time periods and portfolios without browser-imposed constraints or privacy budgets limiting combinations.

(The “privacy budget” feature is part of how “structural advantages” to large scale are built in to the proposal.)

So if both the free-range privacy nerd (me) and the adtech measurement expert executive are against the attribution proposal, could that mean that the attribution cartel is doing something right?

Unfortunately, no. The big companies in the middle are just taking such a big bite that it’s unacceptable to both ends.

Adtech people and privacy nerds are on opposite sites on a lot of issues, but fundamentally most members of both groups are proponents of decentralized decision-making. Markets, stigmergic learning, competition, all that good stuff.

The Big Tech companies are approaching the problem differently. In the surveillance oligopoly model, prices—instead of acting as an information-carrying medium—serve only as an output of an ML system that collects data from both buyers and sellers. The operator of the ML system can sit back and collect all the consumer surplus (which is really the only source of revenue remaining that’s large enough to justify all those data center investments, just saying).

meme version of this blog post

There is well-known criticism of economic central planning, but every so often someone predicts that this time it will be different, and central planning will totally work because now we have better information technology for central planning. This time, that supposedly enabling technology is “AI.” The Attribution proposal is not an economic central planning platform all by itself, but it’s a step toward the cartel members’ planned economy goal. Instead of a variety of advertising decision-makers evaluating the performance of different ad media for different purposes and different audiences, the cartel will be able to provide one centralized report, which will, of course back up the placements made by its own algorithms.

My view is that advertising should be an economic signal between independent players in an economy. Cory Doctorow summarizes the other side of the argument as “Facebook has built a mind-control ray out of Big Data, and we can sell anything to anyone”.

So it’s not a surprise that adtech people and privacy people are on the same side on the attribution cartel issue. If the atttribution cartel can be beaten—and it can, the freedom-loving side beat the Clipper Chip and the Fritz Chip and this time they don’t even have a chip—then the privacy nerds and the IAB can go back to arguing about cookies and stuff in the context of a market economy. I’m looking forward to that.

]]> Starting Firefox with a temporary profile https://blog.zgp.org/starting-firefox-with-a-temporary-profile/ https://blog.zgp.org/starting-firefox-with-a-temporary-profile/ Tue, 21 Jul 2026 00:00:00 +0000 I have been starting Firefox with temporary throwaway profiles (for research and testing purposes), and wrote this to make it a little faster.

Based on the article Bypassing the Profile Manager from MozillaZine. This is the “unlisted profile” feature.

And the temporary profile directory gets cleaned up when the script exits.

]]> paleoenshittification and a path to adoption for MyTerms https://blog.zgp.org/paleoenshittification-and-myterms/ https://blog.zgp.org/paleoenshittification-and-myterms/ Wed, 15 Jul 2026 00:00:00 +0000 previously: A BATNA for MyTerms

Looking back at the history of the IT industry, it’s possible to find instances where vendors did to their customers some of the same kinds of shenanigans that oligopoly companies are doing to everyone today.

An early example of paleoenshittification was the decision by Sun Microsystems to remove the C compiler from its Solaris operating system. An OS, as a two-sided platform for developers and users, is in a position to do the enshittification cycle, and Sun did it early. The Unix software scene was the subject of an enshittification run long before artists and writers experienced one on Facebook. Sun tried to get people to pay to rebuild their own C programs long before Meta tried the same for reaching people’s own audience. Yes, many Solaris users started paying for the compiler that they used to get with the OS, but others were able to slip out of being caught in first-stage enshittification—maybe because old-school Solaris didn’t have the infrastructure, licensing, or anticircumvention law to lock out or put a toll on other compilers. The removal of this key development tool was one of the key events in the popularization of a copyleft-licensed replacement, gcc. More info in Nick Moffitt’s $7 History of Unix.

Without that move by Sun, and other attempts at enshittification of Unix, the software freedom movement and open source software business might never have gone mainstream. So for those who dig rhyming history, it’s tempting to make the analogy: MyTerms and the tools that support it are to the enshittifying web of today as the GNU licenses and tools were to Unix. But the rhyme needs to hang together. The GNU tools were initially distributed first on tape, then CD, in a convenient form for building and installing on existing Unix systems. The “autotools” that mystify the developers of today were a pragmatic response to the need to work with what’s there in order to get adoption.

Today, IEEE, IAB, and W3C are all trying to address similar problems with how personal information gets used on the web, and everybody has gaps. The winning approach will be the one that can best embrace, extend, and ameliorate where necessary, the other two.

That starts with understanding the territory.

MyTerms is not unique in offering an automated way to do the paperwork necessary for processing personal data. On a technical level, data collection on typical web sites operates not directly under control of the site ToS, but using an Interactive Advertising Bureau standard called GPP, which stands for Global Privacy Protocol. (Not to be confused with GPC or GPL.)

GPP is an existing machine-readable way—with open source documentation and sample code—for browsers to tell sites that

  • the user in in a jurisdiction that requires consent, and consent has been obtained

  • the user is in a jurisdiction that recognizes opt-outs, and no opt-out is in effect

  • the user is in some other jurisdiction, do as thou wilt shall be the whole of the law

And all of those options can apply to a bewildering grid of purposes and vendors.

Although MyTerms relies on contract instead of consent, it solves a problem that from the company point of view is already solved. Companies that process your data already have machine-readable permissions that they rely on to process your data, because they already check GPP.

From the company point of view, there is zero reason to check MyTerms for permission to do something that GPP already says is allowed.

So the path to adoption for MyTerms has to account for the widespread existing reliance on GPP. MyTerms can de-enshittify your web experience, but can’t get adopted everywhere all at once, any more than C programmers could go from proprietary Unix to a complete “GNU System” of all freely licensed software all at once.

We have to look for key influence points to work with what’s already there.

Fortunately—because GPP is open source, along with a bunch of handy tools for working with it, it will be pretty straightforward for MyTerms implementations to also support GPP.

Detect sites where GPP is in effect and modify any consent or no-objection entries that are obviously in conflict with the MyTerms contracts that the user is willing to accept. This means a little extra work is required to map the MyTerms licenses to the permissions that can be expressed in GPP, but when that’s done, a new MyTerms user can start getting value from their MyTerms tool even on non-MyTerms sites.

That would leave the MyTerms/GPP hybrid providing more privacy protection than GPP as deployed today, but not delivering the full benefits of MyTerms—kind of like how installing GNU tools on Solaris solved the immediate problem of building C programs, but you still needed a licensed copy of Solaris to run them. But it gets the MyTerms situation from (stable, no MyTerms) to (unstable, some MyTerms) on the way to the full MyTerms stack. For sites, the decision to adopt MyTerms would go from no effect to a better option than just MyTerms to GPP (lossy) encoding. And users could get a similar immediate benefit to what Rewarded Interest offers—the confusing, annoying “consent” dialogs disappear.

More: 1,741 partners

]]> Oops! All oligopoly https://blog.zgp.org/oops-all-oligopoly/ https://blog.zgp.org/oops-all-oligopoly/ Mon, 13 Jul 2026 00:00:00 +0000 Normally when I go on about the attribution cartel I try to focus on the privacy problem, because even though the anticompetitive side is important, some antitrust regulator somewhere will pick up on it eventually. And this is not a situation where antitrust and privacy are in tension. As Robin Berjon wrote, Competition & Privacy: It’s Both Or Nothing.

Sometimes, though, I’m just all, damn, dude, you said that part out loud? The Big Tech companies have corporate training for talking about doing crimes, but it looks like Mozilla doesn’t have their own Stringer Bell, and ends up taking more “notes on a criminal fuckin’ conspiracy” than the other cartel members would probably like.

In an interview with Martin Thomson from Mozilla about the W3C Attribution API, Alan Chapell asks,

Critics have indicated that the privacy-budget mechanism favors large platforms whereby a single mistaken query can lock a small advertiser out, a constraint only a dominant firm could enforce. Does the design assume a power imbalance between platform and advertiser, and if so, does it entrench one?

And the answer is one that I’m going to archive just in case.

I want to acknowledge that this is one of the hard parts. Large platforms have more data to use, so they are able to slice that data in more ways than the little guys. With noise, you can’t slice what you get into thousands of pieces unless you have many thousands of people involved. Or, more likely millions. Small players need to be more careful and make fewer queries. And a mistake will wipe out more of their potential learnings as a result.

On top of that, big players will be better able to develop the discipline necessary to get more out of the system. More people, more resources, all that.

We spent a lot of time thinking about this problem. But we concluded that this was one area where attempting to levy a technical control was unwise. Competition law — as ineffective as it has been in stemming the rise of monopoly power in this market, and others — has a better suite of tools available than we do.

Right now, the best I can say is that there are no structural advantages provided to large players, other than what they obtain naturally. I understand that this might be disappointing, but it’s the pragmatic outcome in this case.

Let me check my notes here. Nope, not one of the members of the attribution cartel is Mother Nature. The “obtain naturally” has nothing to do with nature as we know it—it’s a reward to scale that results from the design of the attribution tracking system.

Oligopoly is hard-coded in—as a result of decisions made by and for the oligopoly companies. And of course it’s “pragmatic” for those who already dominate the online advertising market to design a system to keep dominating it.

When not to use the feedback sandwich

How did things get so far? Part of it has to do with the way that people responded all professionally to Google’s “Privacy Sandbox”.

The “feedback sandwich” (say something nice, make your critical point, say something else nice) is appropriate for many business contexts, but not that one. An intern who puts their private key in a script needs to be handled differently from a transnational corporation doing a multi-year plan to extend its market dominance. But every “Privacy Sandbox” op-ed was basically in the following format:

  • Super stoked that Google is exercising such great leadership in privacy. All hail Google’s wisdom!

  • Maybe Google is doing some tiny little crime that they could maybe think about doing a little less, or if not that’s fine too

  • We look forward to doing free QA work for Google to test every morsel of code that drops down to us from on high.

(Yes, I wrote some stuff that ended up getting squeezed into this format, and no I don’t have the pre-edit versions, they’re in document history at a former employer.)

That whole saga set a bad example. Sometimes an “open source project” is a bona fide open source project, sometimes it’s the form of an open source project on top of a scheme with existing goals that are incompatible with the public interest. Think before you click.

]]> Enshittification is riskier than it looks https://blog.zgp.org/enshittification-is-riskier-than-it-looks/ https://blog.zgp.org/enshittification-is-riskier-than-it-looks/ Sun, 12 Jul 2026 00:00:00 +0000 Apple as a company has a lot of advantages. They have their pick of

  • retail locations

  • suppliers

  • employees

Whether they want to hire an engineer who can design an efficient, safe power supply, or get the exact right countertop for the company’s convenient location right in Grand Central Station, Apple has more optionality than anybody. But the one place that Apple is on an equal footing with the rest of the industry is the owners. Investors want “number go up.” So enshittification comes for everyone.

In John Ternus Should Reverse Apple’s Slide Down the Advertising Slippery Slope, John Gruber writes,

Here in 2026, search results in the App Store not only show paid ads — frequently for casinos — but the search results are visually dominated by paid ads now that Apple has added a second ad to results. Apple News+ is a paid subscription that offers a genuinely great value for the number of paywalled publishers whose content it includes, but articles on the News app tend to include the weirdest AI-generated ads on the Internet. (How many young blond women am I supposed to believe need hearing aids?) And — at this writing, still “coming soon” — Apple is launching ads on Apple Maps. Apple Maps remains free of charge to use, so according to Tim Cook, we’re not the customer. We’re the product. Or, if you prefer, our frustration is the product.

He makes a strong case that Apple needs to back off on the ad revenue squeeze. People will see the ads and assume that Apple is doing the same creepy, risky stuff that Meta and Google do.

So let’s just concede that the upcoming ads in Apple Maps are completely private. How many users are going to believe that? Or assume it? I think very few. People see ads and they think “I’m being tracked.” When Apple starts showing ads in Maps, many — perhaps most — users are going to think they’re being tracked by Apple and their location “is being sold” to advertisers.

That’s true. People are creeped out just as much by “privacy-preserving” ads as by the regular kind. It’s not just anecdotal.

But there’s one part missing. It’s not that Apple’s privacy math wizards are right and the users are wrong. The “Privacy Preserving Ad Measurement” that’s built into Apple Safari (the setting for it is hidden under “Advanced” which should be a red flag) is privacy-preserving only if you analyze it as an isolated math problem. Like the W3C attribution cartel proposal, the Apple feature gives dishonest players an incentive to “snipe” the reporting by serving ads to Safari users likely to buy soon—and the best way to pick those likely buyers out from the crowd is with extra, riskier tracking.

This whole situation is another good example of how regular people are better applied behavioral economists than Internet Thought Leaders are. And the latter group is increasingly out of touch. (While high-profile LinkedIn posters are shocked about what they see as the new-found uncertainties of Big Tech jobs in 2026, the content moderators, search quality raters, drivers, and other “TVCs” have been living the precarious employment dream for a while now.)

So John Gruber is half right. Apple can keep a premium position, and win in the long run, by losing the shitty ads—which are seen by their customers as a dirty business with no place on a high-end device. But that forward-thinking decision would not just be sacrificing a real privacy technology for PR purposes. The so-called “privacy-preserving” ad tracking systems have their own risks, and need to be regulated appropriately.

(Quick tip for John Ternus. If you do zorch the ads to make the device feel more like the experience of an Apple Store and less like the last days of Fry’s, the enshittification pressure from the investors will return soon enough. But if Apple can switch out CPUs you should be able to smoothly swap out the owners, too. Take advantage of the fact that you make the best all-around personal finance device, add a “buy stock” button—and hook it up to buy a share that has extra voting rights but pays all dividends in store credit. Align the interests of owners and users enough to resist the pressure to festoon Apple products with ads or whatever other awful growth hacking thing starts trending next.)

]]> Attribution tracking on an alternate timeline https://blog.zgp.org/attribution-tracking-on-an-alternate-timeline/ https://blog.zgp.org/attribution-tracking-on-an-alternate-timeline/ Fri, 10 Jul 2026 00:00:00 +0000 In Betting on Democracy: Notes from the Fight for “Article 88b”, Aleksandre Zardiashvili writes:

Whatever the outcome of the Google Adtech case, Google is already creating other opportunities to gain even more access to data, increase its power, and evade the rules. The next opportunity could be advertising measurement and attribution. If privacy signals succeed, advertising will need to be measured without tracking. This is why browser vendors and others are working hard to standardise a device-level attribution API called Attribution Level 1, developed with the editors being from Google, Meta, and Mozilla. In my view, there is nothing inherently wrong with on-device processing for advertising use cases such as attribution, but, of course, the involvement of Google and Meta raises many questions and invites criticism. Don Marti calls the group standardising the API an “attribution cartel”, and competition lawyer Thomas Höppner compares the situation to a fox guarding the henhouse.

While these concerns are real, the situation is not straightforward, and, to be honest, has given me a lot of headaches lately. As Martin Thomson (Mozilla) explains in a conversation with Alan Chapell, the API offers some privacy and efficiency benefits, and I believe something of this sort can support contextual advertising to make it more appealing to advertisers. The problem is not on-device attribution itself, but who controls the devices and for whose benefit the attribution API works. In no way does it make sense for Google to be the largest online advertising publisher and to measure its own performance against its own competitors. The largest online advertising publisher (Google Search, YouTube) cannot own device software (Android, Chrome) or the advertiser ad server (CM360). This is something for the competition authorities to solve, and the sooner we put this in front of them, the better.

Read the whole thing.

Internet optimism, antitrust department

What if Lex is right, and the problems with in-browser attribution tracking turn out to be just that a powerful tool is being handed to some existing oligopoly companies?

And what if, on some future optimistic timeline, the Big Tech companies are broken up, effectively regulated, or otherwise brought low, and legit sites are free to reap the benefits of a somehow cartel-free fair attribution system?

On that timeline, a bunch of good things happen.

Also on that timeline, the attribution tracking gets handed over to some neutral, well-resourced entity or entities—attribution tracking is totally independent of any party with a stake in pushing search, social, and app store ads, and totally under the control of someone who will fairly report the halo effect of legit ad-supported content as it pops up.

So, in that bright future, would all be well for honest attribution?

Of course, it doesn’t hurt to try. The global benefits of bulk-erasing Meta and all their works, of restoring Google to “create more value than you capture” mode, and of resetting Apple to work for the hardware customers instead of against them would be huge in a bunch of other ways, so of course I’d be all for trying the experiment. But I’d bet against it working.

The attribution cartel problem is more than a problem of empowering an existing cartel by giving them attribution tracking. Adding attribution tracking to some future, squeaky-clean, advertising business would create a new cartel, because of the Bruner paradox. On the optimistic timeline, the opportunity to do what Martin Thomson calls “sniping credit” is still there. With the Attribution proposal in place, every player that could touch user data has the temptation and incentivization to do nasty surveillance in order to “snipe” or “front-run” and claim attribution. Some company you have never heard of that operates a demand-side platform (DSP) using data from a network of “smart” air fryers and tire pressure sensors would be in a better position to claim ad effectiveness than even the best legit site.

And that hypothetical unknown company has incentives to consolidate with some other companies that have different surveillance data, because machine learning and lobbying work better at scale. So the air fryer and tire pressure “sniper” merges with someone else who has smart TVs. Learning management systems. E-toilets. Pretty soon there’s a new oligarch in the business.

The problem is not just that the Attribution proposal works in favor of the existing Big Tech cartel. It does. The underlying problem is that the proposal is so cartel-friendly that it would bring forth a new cartel even if started in a situation without one. (Unless you could somehow ban all surveillance other than the attribution tracking itself, with totally effective enforcement.)

So what do we do instead, smartass?

I don’t know. In advertising, some kinds of data practices tend to support the creation of ad-supported short stories, news, bus benches, and other resources. Other kinds of data practices, not so much.

The future advertising measurement methods that turn out to be both acceptable to people who get advertised to, and rewarding to people who make the ad-supported content, will have to be the result of market design grounded in advertising history and user research.

Starting with cool math is a great way to get a publishable paper (which the Attribution proposal is, and it could probably be applied in other fields) but not the way to get where we need to go for ads.

]]> Explaining why the attribution cartel is a privacy menace (almost) https://blog.zgp.org/privacy-menace-almost/ https://blog.zgp.org/privacy-menace-almost/ Wed, 08 Jul 2026 00:00:00 +0000 Previously: there are many paradoxes but this one is mine

The attribution cartel came up on the Monopoly Report podcast again: Alan Chapell interviews Mozilla’s Martin Thomson. Subjects covered include Attribution proposal’s lower funnel bias and the fraud problem. Listen to the whole thing (or read the transcript). And they almost get to why the proposal is a privacy menace.

We understand that there are a number of circumstances in which you have essentially low trust settings that is very common in sort of open web advertising where there’s this low trust setting and you have essentially people in the system that are able to register impressions with these these systems that you don’t entirely trust to do the right thing. And so in in the general sense, you do advertise with them. You you expect to be recording impressions with them, but you fundamentally don’t trust that they will participate faithfully. And you kind of do create these situations, I think, with the design that we’re putting forward where there is that that latent risk. There are impressions that are registered very very late in the process with a specific design to to snipe credit from others and that depends on an assumption of things like last touch attribution styles and various other assumptions but that’s still very common. So we have to acknowledge that there is that possibility in the system. However, we’ve built in a bunch of controls around all of that. And we’ll freely admit they’re not perfect. But one of the things, one of the most basic controls is that if the DSP wants to manage the attribution process, then they’re the ones that ultimately register the impressions and there are controls to ensure that they’re the only ones that are able to do that. And that gives them the ability to put safeguards or in place around having those nasty conversion stealing arrangements. Not perfect, I will freely admit, but not as bad as as some people making it.

I was in suspense. Just one more step to explain the biggest problem with this proposal. Now that it’s clear that some players out there are trying to “snipe credit from others,” what are they going to be doing in order to figure out who to snipe?

Attribution fraud perpetrators are not just placing impressions indiscriminately—that would be counterproductive because on average the results would look weak. Think about it from the attribution fraud point of view for a minute.

In order to snipe snipe, you need to pick rewarding targets.

To pick a target, you figure out who’s about to buy anyway.

And if you’re a cool kid in 2026, the way you figure out who’s about to buy is machine learning.

In order to train the ML system for sniping, you feed it a lot of people’s personal info.

And that personal info doesn’t have to be justifiable, or disclosed, or anything, because the attribution cartel is going to obfuscate the reports. Go ahead and deploy speech to text on a bunch of smart appliances to pick up people talking about shopping lists—the attribution cartel reports are just going to show which ads “made a sale” so the advertiser is going to have no idea about the appliance feature. So people end up with more privacy risk, not less. (The Bruner paradox is real.)

Anyway, listen to the whole interview. We’re almost there.

On a related subject, a good article from HFT University. The C++ Standard Library Has Been Walking Itself Back for Fifteen Years, and the Receipts Are Public.

The committee is not only failing to remove bad features. It is also continuously adding new ones that no working engineer asked for, championed by individuals who get professional recognition for shipping the proposal, and the result is a language whose surface area expands faster than any single team of implementers can keep up with.

Professional recognition—and advancement at work by participants in standards organizations—should not be determined by scoring goals, getting features into some standardized platform. A paper that describes a feature in the steelmanliest way possible, and then explains why the platform is not doing it, is more valuable in the long run than another Battery Status API or Third-Party Cookie. Just as lines of code is a bad metric for programmers, people who participate in standards organizations should be recognized and rewarded for keeping a standard free of trendy but problematic baggage and explaining why. As I mentioned when I was on the Monopoly Report podcast, the Attribution proposal has a future as an open-access publication that developers in other fields can work with, even if it’s a bad fit for web advertising. As a wise Muppet once said, Think before you click.

]]> Rosemary potatoes https://blog.zgp.org/rosemary-potatoes/ https://blog.zgp.org/rosemary-potatoes/ Sun, 05 Jul 2026 00:00:00 +0000 2 lbs. yellow or red potatoes

1 large or 2 medium onions

1 head garlic

6-8 sprigs fresh rosemary

Olive oil

1 tbsp. kosher salt

Preheat the oven to 425 degrees F.

Wash the potatoes and remove any bad spots but leave as much skin as possible on. Chop into bite-sized pieces.

Peel the onion and chop into large chunks.

Peel the garlic cloves.

Pull rosemary leaves off the sticks, discard sticks, and chop coarsely.

Place potatoes, onions, garlic, and rosemary in a 9 in. × 13 in. glass baking dish. Sprinkle with the salt. Add olive oil and stir until all exposed potato surfaces are shiny.

Bake for 20 minutes, stir, then bake for 20 more minutes.

Leftovers can be heated in a frying pan and served as breakfast potatoes.

]]> July 4 link dump https://blog.zgp.org/mlp-2026-07-04/ https://blog.zgp.org/mlp-2026-07-04/ Sat, 04 Jul 2026 00:00:00 +0000 The Internet needs more You by Arun Ravindran. The indie web is slowly staging a comeback. People are returning to personal sites, RSS readers, and hand-curated blogrolls — not out of nostalgia, but because the algorithmic feed has failed them.

SoftBank’s untitled AI goose game — eggs do not lay eggs by David Gerard. SoftBank was also the main backer of WeWork, which was almost as stupid as OpenAI. WeWork’s 2019 stock market offering failed spectacularly and SoftBank’s investment went down 90%. WeWork still exists in 2026, but it’s a lot smaller. As well as the spectacular messes, SoftBank has a pile of quietly successful portfolio companies — like ARM, which designs the chips in all the phones, and makes a bundle. These pay for the messes.

I drove the Slate Truck — there’s more to it than EV minimalism by Rani Molla. The vehicle runs counter to a broader trend in the auto industry sometimes referred to as trimflation — the push to increase margins by bundling vehicles with more technology and luxury features.

War by Other Means by John Severini. Combined with recent and forthcoming improvements to industrial automation, all signs point toward governments relying on a much smaller pool of human capital for labor and war. Accordingly, this means that a fundamental source of political power has begun to shift from the people toward the firms that make those machines. (Those firms, though, have labor forces. So the importance of labor/management issues goes up, too?)

There is minimal downside to switching to open models by Andrew Marble. (A thought-provoking comparison of desktop Linux to open* AI models. And yes, we still need open-source/Eurostack CAD.)

Sixty percent of US consumers say ‘AI’ in brand messaging is a turnoff, survey finds by Sarah Perez. (If people knew how much “AI” investment is there to implement surveillance and price discrimination/surveillance pricing, IMHO the “AI” boom would be even less popular.)

You Should Make Cross Views by Ryan Moulton. All you need is two pictures taken from two different positions shifted horizontally.

Improvements to Web for AI Should Benefit All Users by Jason Grigsby. When a site’s actions are hard for an AI agent to use, that is a gap in the page’s own semantics, and we should first seek to close it in the platform’s shared layers (HTML and ARIA), where the user, assistive technology, and agents all benefit.

The Costco theory of the internet by JA Westenberg. (But who is left who’s trusted enough to be the curator?)

The Future of Everything is Lies, I Guess by Kyle Kingsbury. (Long series on how LLMs change things.)

]]> News from Sacramento https://blog.zgp.org/news-from-sacramento/ https://blog.zgp.org/news-from-sacramento/ Fri, 03 Jul 2026 00:00:00 +0000 I went to the SB 690 hearing at the California Assembly Privacy And Consumer Protection committee meeting this week.

  • Opponents of SB 690 say that, in its original form, the bill would have removed the right of victims to sue over heinous abuses by Big Tech.

  • Supporters of SB 690 say that without it, small businesses are at legal risk for some ordinary online marketing practices.

The hard part is that they’re both right.

Big Tech’s oligopoly on small business advertising makes the villainous and the ordinary hard to tease apart.

And that’s by design. Big Tech’s advertising systems are designed to maximize their own revenue from harmful practices at the expense of small business advertisers. Whether it’s Instagram promoting child sexual abuse material, or Facebook getting away with enabling a real estate scam, the common enabling practice is AI-powered adversarial personalization—targeting the social media scam epidemic and other problematic material to those likely to fall for it, while avoiding enforcement. (Update: India orders Meta to pull Instagram child abuse ads by Alina Maria Stan)

And Mark Zuckerberg was not born with supernatural surveillance powers. The adversarial personalization is done by AI systems trained on customer data that small businesses send to Big Tech. Small business decision-makers are no more fans of Big Tech’s crimes than anyone else. But the Meta Pixel and other enabling technologies for Big Tech value extraction are easy to set up, and come with friendly tutorials and free credits to get started. Meanwhile, legit forms of advertising are often prohibitively complex, come with hard-to-afford minimum spending levels, or both.

you gotta FIGHT for your (private) RIGHT (of action)

An amended version of SB 690 made it out of committee. The new version would preserve CIPA private right of action for wiretapping and confidential recording, but remove private right of action for pen register and trap and trace. Bethany G. Lukitsch, Paul G. Karlsgodt, Andrew C. Burnquist and Safina Motiwala summarize the new version in Click, Track, Sue: California Reconsiders CIPA’s Reach.

And preserving the private right of action for the most heinous Big Tech surveillance would be a quiet win for small business. Lawsuits and lawyer letters are noisy and obvious, but the risks to small businesses of not having CIPA protection in place are larger and longer-lasting.

  • Big Tech must keep growing at startup-like rates even in an advertising business they already dominate—so must extract a larger and larger piece of each sale. (If the claims of Big Tech fans in academia were true, the rise of smartphones would have meant a small business boom. Instead, we have, well, all this.)

  • The surveillance data collected from small businesses ends up being used to train machine learning that works against customers, and when customers lose, the small businesses they buy from lose too. Money that is lost to Big Tech-enabled fraud, or gambled away on lootboxes and sportsbook apps, or just wasted on regrettable drop-shipped crap is money that’s not available to be spent at legit businesses.

The immediate problem for small businesses in California now is how to keep marketing working while fixing the Big Tech value extraction.

Big Tech won’t make it easy. They are doing as much as possible to snarl up the process for setting up the marketing basics with the process for feeding data into all kinds of harmful schemes.

And, I hate to say it, but privacy people aren’t making it any easier, either. The conventional privacy nerd party line is something like, Big Tech companies are surveilling users for the benefit of advertisers when that can’t even make sense in a market economy. Legit businesses and their customers are on the same side. The whole point of a working market is win-win deals. Every beneficial purchase by a consumer is also a sale by some legitimate company.

For those who provide any kind of online service to small businesses in California, it’s time to figure out the roadmap to a common sense, research-driven approach to data practices. There’s an immediate to-do item for removing the most obvious, most heinous tracking, which is easy to justify because lawyer letters.There are LinkedIn thought leaders and even lawyers who will tell you the way to do this is to stick a Europe-style consent dialog on a site, and then do adtech/martech as usual as soon as the user clicks through. This is bad advice. I am not a lawyer and can’t give legal advice, but I can call out bullshit when I see it. More: common sense one, bullshit documents zero And yes, it is possible to do this while continuing to participate in society. But the real wins will come as service providers are able to protect small businesses from Big Tech’s tendency to force everyone into economic central planning and better enable a free market approach. History shows [citation needed] that societies with an empowered jury system have rewarding entrepreneurship.

Fun California fact: Until 1907, the state of California was not allowed to use banks or paper money, so the entire state budget was stored in the form of gold and silver in the Treasurer’s office on the first floor of the Capitol building.

]]> Arguments for the attribution cartel https://blog.zgp.org/arguments-for-the-attribution-cartel/ https://blog.zgp.org/arguments-for-the-attribution-cartel/ Tue, 30 Jun 2026 00:00:00 +0000 previously: Think before you click

I’m collecting the best arguments for the attribution cartel, and so far I have four. Well, six by now if you count “it’s not third-party cookies” which I probably shouldn’t.

Although the kinds of privacy-preserving measurements that they’re proposing are technically interesting, and would probably work for other applications, it looks like the cartel is just going to make things a lot worse.

(Updated 10 Jul 2026 to include links, quotes, and items 5 and 6.)

1. The attribution tracking is a replacement for riskier data collection.

False. No attribution cartel company has backed off on their own, more intrusive, tracking systems. And if they can get users to accept one ad feature in the browser, they’ll move on to more. Google “Privacy Sandbox” was proposed as an alternative to fingerprinting—then when it achieved some acceptance, Google went on to allow fingerprinting.

In an interview with Alan Chapell, Martin Thomson from Mozilla says,

I’d like to see a whole lot less tracking, collection of email/phone numbers, clean rooms, and the other bullshit privacy apparatus that the advertising industry created. In practice, however, I don’t expect this to change anything significantly. Success here means that some businesses decide that this is enough. That they can get enough information from attribution without having to resort to those other things. If it is only a few who change, that’s a win.

Those few, if any, would be massively outweighed in impact by the Big Tech execs who learn the real lesson: hooray, we got one advertising feature into the browsers, now it’s time to add more.

Appeasement doesn’t work. (In general, better to overreact to the Big Tech value-extraction schemes you do hear of, because they’re doing something you haven’t heard of in the background that they would have deserved to catch hell for too.)

2. Attribution reporting math protects privacy.

Only in isolation. In combination with other technologies available on the web, though, the Bruner paradox kicks in.

More broadly, I think there is an important privacy paradox embedded here. The specification is motivated by legitimate privacy goals, which I support. But many practical implementations of identity-based incrementality measurement appear likely to increase incentives for more first-party identity harvesting, more authenticated-user environments, more CRM onboarding, and more identity reconciliation infrastructure.

Selling a product or service is hard. It’s easier to identify someone about to buy, then claim credit for the sale. By making the difference harder to spot, the attribution cartel increases incentives for surveillance. For example, a sketchy appliance manufacturer would find it hard to sell a data feed of shopping-related keywords from always-on microphones in people’s homes. But that data could be used to place ads in a way that would look surprisingly effective on the attribution reports.

The attribution cartel would enable the monetization of more surveillance data, from more and riskier sources. (More: Explaining why the attribution cartel is a privacy menace (almost))

3. For legit sites, some attribution data is better than none.

False. The attribution cartel will combine the obfuscated attribution reports from legit sites with the individualized tracking from their own contexts—in a way that makes the legit sites look consistently worse.

Some people suggest attribution cartel tracking as a possible way to measure contextual advertising—supposing some combination of laws and regs that would make it possible for scripts running on web sites to invoke the Attribution API even in situations where they lack a basis for processing that would be required for other ad measurement. That could be appealing if contextual advertising plus attribution cartel tracking were the whole system. But the attribution tracking data will be fed into the same reporting systems as, and be compared to, the individualized tracking on search, social, and app store ads. And it’s impossible on the corporate politics level for the advertiser “dashboard” to produce a result suggesting that the advertiser is spending too much on Big Tech ads and not enough on legit sites.

We can expect that the attribution cartel has learned the lessons of the massive “Privacy Sandbox” revenue hit (Google got too greedy, too fast, last time) and throw some legit publishers a bone early on. A pilot project involving some legit advertisers and legit sites will show encouraging results. Then, as soon as that news cycle is over, the attribution data will go to work “proving” that the cartel’s own ads are a better value than ads elsewhere.

4. If you don’t like the attribution tracking, you can turn it off.

Technically true. But not really the point. The attribution cartel’s data collection is part of a political program, and the reports will be used to show how small businesses depend on search, social media, and app store advertising.

Even if you personally don’t participate in attribution cartel tracking, or believe the reports, the politicians who are supposed to represent you will be swamped with them. And that creates more more work for legit public interest organizations, and more risk of Big Tech-friendly laws.

5. Third-party cookies are bad. The attribution cartel is not third-party cookies. Therefore the attribution cartel is good.

Is that even a fallacy?

6. The attribution tracking proposal is neutral, ad oligopoly is the problem.

The problem is not just that the Attribution proposal works in favor of the existing advertising oligopoly. The underlying problem is that the proposal is so cartel-friendly that it would bring forth a new cartel even if started in a situation without one. With attribution tracking, every party that could do surveillance is incentivized to do as much as possible, in order to feed machine learning systems to claim attribution. And machine learning and lobbying work better at scale, so those parties are incentivized to combine into a new cartel. (More: Attribution tracking on an alternate timeline)

Conclusion

The pressure on the attribution cartel companies is not a situation I would want to be in. Value extraction by Big Tech is non-optional, because…

  • They must show startup-like growth in order to maintain high stock prices.

  • They already control a majority of an industry, advertising, that grows about as fast as the economy does.

The only way out is to keep increasing the percentage that they’re able to capture. The attribution cartel is one aspect of a larger technological, business, criminal, and political program—ending it won’t stop Big Tech oligopoly entirely, but stopping it will be the same kind of win as the end of “Privacy Sandbox” was—something to build on.

]]>