Reporting on User signals and trusted server signals

[BasileLeparmentier]

Dear Michael,

As already discussed in meetings, and pushed by Jonasz in this pull request https://github.com/WICG/turtledove/pull/194 I would like to reiterate the need to have reporting on both the trusted server signals and user bidding signals.

This reporting may be differential private, but it is extremely important to have reporting on signals that are used in the bidding if we want to be able to optimize our campaigns, leading to higher ROAS for marketer and spend on publishers.

Without this, we won't be able to use fledge as intended during the origin trials and the testing steps, meaning that we will have misleading results to share, as either we will use models not trained on fledge (not available once 3rd party cookies are removed) or used a degraded version of fledge without the signals that can be used to have better performance.

Could you please therefore confirm that you intend to incorporate reporting on all signals in fledge, by a secure reporting mechanism, as soon as possible in the process?

Many thanks!

[michaelkleber]

Are you asking about the ability to do aggregate reporting from inside the Fledge worklets, i.e. tying these signals to auction outcomes? Or is this about a use of conversion measurement, tying these signals to later user behavior on a different site?

[BasileLeparmentier]

I mean both. It is important for both use cases, we need positive and negatives, to have reporting on the cost of the auction for instance, and then conversion reporting in order to be able to optimize ML models

[vincent-grosbois]

There is also another upside if reporting on trusted signal is allowed at event level : this would allow us to more easily sign reporting events. For instance:

• during bidding, trusted server computes on server-side a signature for the bid value (for instance), returns it to the JS bidder
• we get this value back during event-level reporting. Now we can internally check if the data sent via reporting API really came from us or if it was manufactured The signature has to occur on server-side to be safe, so it has to be done via trusted bidding signals