v132 · miscellaneous

Private Aggregation API: ignoring site exceptions for debug mode

Currently, the availability of Private Aggregation’s debug mode is tied to a caller's eligibility to set a third-party cookie (see https://chromestatus.com/feature/5148973702840320). However, an edge case was missed in this logic: if the caller can only set a third-party cookie due to a top-level site exception (i.e. the user has generally disabled third-par

concepts

  1. PA Debug Mode

    Private Aggregation debug mode bypasses site exceptions. Developer overrides always work, regardless of user-level opt-outs.

  2. worklet flow

    contributeToHistogram + enableDebugMode produced shape: cleartext payload, debugKey, /well-known/ POST.

  3. decision tree

    Toggle enrollment, 3p cookies, site exceptions, user pref. Walk the live decision tree and watch which combination yields debug mode in v132.

  4. Debug mode comparison

    Toggle enrollment, global 3P cookie state, per-site exception, and debugKey presence. Side-by-side decision trees show the pre-132 path (site exceptions count toward eligibility) vs Chrome 132 (site exceptions are ignored — only the global cookie setting matters), highlighting the edge case that was fixed.

why it shipped

Currently, the availability of Private Aggregation’s debug mode is tied to a caller's eligibility to set a third-party cookie (see https://chromestatus.com/feature/5148973702840320). However, an edge case was missed in this logic: if the caller can only set a third-party cookie due to a top-level site exception (i.e. the user has generally disabled third-par

references