privacycg / private-click-measurement

Private Click Measurement
https://privacycg.github.io/private-click-measurement/
196 stars 8 forks source link

Absolute final date for unsubmitted attribution reports #84

Open martinthomson opened 3 years ago

martinthomson commented 3 years ago

If an advertiser wants to reuse a particular click source identifier, they can't be sure that reports for the old assignment won't arrive after the new definition is used. Given that clicks are retained for 7 days and reports might be held for 2 more days, a click source might need to stop using an identifier for at least 9 days to ensure that old clicks are completely flushed from the system before starting to use a new identifier.

But reports might be held for longer than 2 days, so that value is not a hard end date. This is because not everyone runs their browser constantly. This means that attribution reports could be delayed further:

However, the user agent might not be running or the user’s device may be or disconnected from the internet, in which case the request may be delayed further.

This introduces further uncertainty for advertisers when it comes to knowing what click source identifiers might still be active.

Would it be reasonable for there to be an absolute end date for sending old attribution reports? I don't think it matters if that is based on the time of the click or the conversion.

Click plus 14 days or conversion plus 7 days would two equivalent options that are fairly conservative. You might choose that if you care more about getting attribution reports submitted, even if they might be quite stale after that long. A shorter period (click+10, conversion+3) would enable slightly faster identifier turnaround.

Standardizing the length of the relevant period would be ideal as it is simplest, but exposing it through an API might also likely be workable.

There are probably different heuristics that a click source might use to determine that an identifier is safe to reuse earlier than this. But unless you have a 100% conversion rate, there will always be some risk that an old click is being reported without a hard time limit.