WICG / turtledove

TURTLEDOVE
https://wicg.github.io/turtledove/
Other
514 stars 216 forks source link

See Interest Groups Via the DevTools #1128

Open abirbenzaamia opened 3 months ago

abirbenzaamia commented 3 months ago

Hello πŸ‘‹ ,

As I'm trying to test the actual Protected Audience API by visiting random website and trying to see my Interest Groups just via the DevTools, I'm noticing that it is not possible to see Interest Groups when I don’t consent / decline third-party cookies which is possible when I consent/accept.

I would like to know if this is true or should I do something to fix it.

Thank you πŸ™ !

MattMenke2 commented 3 months ago

Yes, when 3P cookies are disabled, we disable Protected Audience APIs.

thegreatfatzby commented 3 months ago

@MattMenke2 I'm actually a little curious what this is saying...is this saying if a Chrome user disables cookies in a Chrome setting, or via a Publisher CMP pop-up? Assuming the later, if a publisher is using a CMP, and the user declines consent (reject all or something like that) how does Chrome know to disable PS? Is Chrome getting a signal from the CMP?

dmdabbs commented 3 months ago

Assuming the later, if a publisher is using a CMP, and the user declines consent (reject all or something like that) how does Chrome know to disable PS? Is Chrome getting a signal from the CMP?

My understanding/assumption has been that, like today, Chrome would not be making decisions. In the IG joining use case, when there is insufficient consent to process, the advertiser (or adtech operating on their behalf) will not activate joinAdInterestGroup(). Likewise for runAdAuction().

MattMenke2 commented 3 months ago

I don't know what "Publisher CMP pop-ups" are.

If a user disables cookies for an origin (either via a per-origin basis or globally), the origin can neither join InterestGroups nor run auctions. I think that origin's IG's can't be joined on 3P pages (via .well-known delegation), but am not positive of that.

If a user disables 3P cookies, no auctions can run, not can pages join 3P InterestGroups via permissions delegation. I don't believe you can join 1P InterestGroups, either, but I'm not 100% positive of that.

This is entirely a Chrome setting, rather than a web standard - browser-configurable cookie blocking is not currently part of any web standard.

Currently, InterestGroups can be used much like cookies, since not all privacy protections are in place. I have no idea if we'll keep a setting once privacy protections are in place, and 3P cookies are deprecated. I don't think anyone can currently give a definitive answer whether we'll maintain this behavior, though could be wrong. Unclear if we'll even have a "3P" cookie blocking option.

brusshamilton commented 2 months ago

@MattMenke2 That information is outdated. Currently Chrome has separate controls to enable/disable third party cookies and the Privacy Sandbox Ads APIs. It is true that if a user had 3rd party cookies disabled the Privacy Sandbox Ads APIs would default to disabled when they upgraded to a version that had separate controls. Otherwise the user would be given the opportunity to opt-in/opt-out of the Privacy Sandbox Ads APIs.

Currently, however, the Privacy Sandbox Ads APIs can be available when third party cookies are disabled, depending on user preference.

thegreatfatzby commented 2 months ago

Sounds like we'll reconvene on a few things but just to provide the response I should have last week:

CMP Publishers will use Consent Management Platforms to manage their users "consent elections" for something like GDPR or US Privacy, so the "pop up", which now that I think about it was maybe a poor word choice, is the modal that asks if you're ok with using cookies, or want to make interesting elections.

So what I was asking was whether Chrome was integrating with that in some way, which I wouldn't have thought it was.

Cookie Disabling vs PS APIs I was curious about this and it sounds like we have some clarification to get to, but given that for Mode B traffic the 3PC is off by default I wasn't quite following exactly how those two are coupled...sounds like we'll sort that out here.

brusshamilton commented 2 months ago

Disabling third-party cookies is now completely independent from disabling Privacy Sandbox APIs. So if a user turns off third party cookies that does not affect Privacy Sandbox APIs.