search

privacy-tech-lab / privacy-pioneer

Privacy browser extension for analyzing web traffic of visited websites
https://www.privacytechlab.org/
Other
28 stars 1 forks source link

Look into Restricted Data Processing #89

Closed rgoldstein01 closed 3 years ago

rgoldstein01 commented 3 years ago

via https://support.google.com/adsense/answer/9598414?hl=en

SebastianZimmeck commented 3 years ago

Here is an explanation I received as to whether it is possible to detect at the frontend whether Do Not Sell is followed:

Regarding detection, it's complicated, but it should be possible to:

Check that calls to GAM include the RDP flag

Check that calls to adtech vendors (especially header bidding) are either suppressed or include the appropriate USPAPI flags

(I do not know what GAM is; maybe something related to Google.)

And:

Basically, when ads are inserted the URL is known as an "ad call". This is just a series of query string parameters that control how the ad server will process the ad.

One such parameter is "Restricted Data Processing" aka RDP. It's present in URLs as rdp=1 (I think it can be any truthy int). These should look like:

https://securepubads.g.doubleclick.net/gampad/ad?iu=/12345/adunit&sz=728x90&rdp=1&c=12345

(Note that I don't know if there are variations on the domain, etc. — the important part is that before Do Not Sell has been activated, rdp should be absent or 0, and after it should be present and truthy.)

For USPAPI, that piece of information should be interceptable too

I will ask more and maybe we can have a meeting. Also, if you, @rgoldstein01 or anyone else has a question, I can ask.

SebastianZimmeck commented 3 years ago

Note to self: This is also related to the IAB's privacy string.

rgoldstein01 commented 3 years ago

So to be clear @SebastianZimmeck , this is probably not a possible functionality to add to our extension?

SebastianZimmeck commented 3 years ago

Good question! I am leaning towards no because it seems to me that the analysis is a bit different from our current HTTP request analysis. What are your thoughts, @rgoldstein01? This is one of the main points I wanted to bring up today in our meeting.

rgoldstein01 commented 3 years ago

I agree I think we should probably table it for now.

SebastianZimmeck commented 3 years ago

Closing this issue per our discussion.