v130 · miscellaneous

Attribution Reporting API Feature (Debug Key Privacy Improvement)

We are landing the following changes to the Attribution Reporting API focused on: * Improving privacy for debug keys This change helps to mitigate a potential privacy gap with debug keys. Currently the API allows a source debug key or a trigger debug key to be specified if third party cookies are available and can be set by API callers. If either a so

concepts

  1. Debug Key Privacy simulator

    Toggle source/trigger cookie state and watch the browser strip source_debug_key/trigger_debug_key from the resulting attribution report.

  2. Leakage matrix

    The 2x2 matrix of publisher × advertiser third-party cookie state. Each cell explains the cross-side identifier that pre-Chrome 130 leaked, and how the new strip rule closes the gap.

  3. Migration checklist for ad-tech teams

    Pick your team's current debug-key setup (cookie-only / header / cross-side join / server-side dedup); the page returns a tailored before/after log diff, a per-scenario checklist, and a short message to send the engineering team. Catches the silent dedup collision case that breaks server-side pipelines.

  4. Report diff viewer

    Toggle publisher and advertiser third-party cookie states (allowed/blocked). Side-by-side attribution reports show the pre-Chrome 130 version (debug keys based on each side's cookies independently) vs the Chrome 130 version (both keys stripped unless BOTH sides have cookies) — with an explanation of the cross-site join risk that the new rule closes.

why it shipped

This change helps to mitigate a potential privacy gap with debug keys.

references