demo · v130
Report Diff Viewer
Chrome 130 strips source_debug_key and trigger_debug_key from attribution reports when the other side doesn't have third-party cookies, or when the report crosses the app/web boundary. This prevents cross-side identifier joins. Toggle the publisher, advertiser, and context states below and watch exactly which fields the browser includes or redacts in the resulting report.
Pre-Chrome 130 report
Chrome 130 report
// Chrome 130: debug key stripping rule
// source_debug_key is only included if:
// - publisher 3P cookies are ALLOWED, AND
// - advertiser 3P cookies are ALLOWED
// trigger_debug_key is only included if:
// - advertiser 3P cookies are ALLOWED, AND
// - publisher 3P cookies are ALLOWED
//
// Cross-app/web reports strip debug keys even when both web-side
// cookie states are allowed, because the cookie boundary cannot
// be crossed safely.
// Why: if only one side has cookies, the debug keys from both sides
// being present lets the other side join user identities cross-site.
// Pre-130: both keys could appear regardless of the other side's state.
// Chrome 130: neither key appears unless BOTH sides have
// 3P cookies and the report stays in the same web context.