Measurement, on the Browser's Terms
Mozilla's Martin Thomson states the test for whether a privacy-enhancing technology is serious: "It is who decides." That reclassifies the W3C Attribution API from privacy machinery to governance — rules ratified at a standards body, enforced by the browser runtime, with an off-switch held by someone who is not a party to the transaction. The operator concerns in Alan Chapell's Q&A all follow from that move: differential-privacy budgets structurally punish small queriers, and Mozilla declined a technical remedy, deferring to competition law; brand work that lives in other mediums is invisible to the API; on-device impressions are vetted by no server. What the API returns is still credit, not cause — a noisier attribution number with better manners, and no browser's imprimatur turns it into evidence about what a dollar caused.
In English, please
A new ad-measurement system built directly into web browsers — with Apple, Google, Meta, and Mozilla listed as editors on the spec — is the subject of a public interview between Alan Chapell and Mozilla's Martin Thomson, published July 13, 2026. It would let advertisers see whether an ad led to a sale without the browser revealing who the individual buyer is. What's notable is what Thomson admits about who ends up controlling the system.
Thomson's central claim: the real test of any privacy tool isn't how carefully it handles data, but who gets to write the rules for using it — a question of power, not privacy. Today advertisers and publishers negotiate measurement terms deal by deal. This system sets the terms once, inside the browser, decided by a standards committee rather than either side of a transaction — including a user opt-out that websites can't detect or punish.
A limit Thomson concedes rather than downplays: the system can show that an ad and a sale are connected, but not that the ad caused the sale. 'Attribution only gives you information,' he says. Businesses should resist treating a browser-approved number as proof of what worked — it still needs a real controlled test to prove cause and effect.
Other costs surface too. Smaller advertisers fare worse than large ones, since privacy protections blur results more when there's less data to work with — and Mozilla decided that's not the browser's job to fix, calling it a matter for competition law instead.
The system also can't see advertising that happens outside the browser, risking a shift toward chasing whatever it can measure rather than what actually works. And because ad views are logged on a person's own device rather than checked by an outside server, someone could fake a view right before a purchase and steal the credit.
The suggested response: treat this as a policy shift from a major platform, not a feature to switch on casually. Decide in advance which decisions this data will and won't be trusted to drive, keeping real controlled tests as the standard for proving cause and effect. What's worth watching is not the technical fine print but which browsers adopt the system, on what defaults, and who they trust to run it — since that choice will define what 'measured' means across the web.
On this page
The interview worth reading twice
Alan Chapell just published a long Q&A with Mozilla’s Martin Thomson on the W3C Attribution API — the browser-native measurement spec coming out of the Private Advertising Technology working group, with editors from Apple, Google, Meta, and Mozilla on the masthead. It ran in Marketecture’s newsletter alongside a Monopoly Report podcast episode, and it deserves more attention than a spec debate usually gets — not because of what the API does, but because of what Thomson admits about who it makes powerful.
Most coverage of browser measurement APIs argues about the machinery: epsilon values, histogram sizes, differential-privacy noise. Thomson himself waves those off as second-order. The load-bearing sentence in the whole exchange is his test for whether any privacy-enhancing technology is serious:
“It is who decides.” — Martin Thomson, Mozilla
That is not a privacy argument. That is a governance argument. And once you read the spec that way, every operator-grade concern in the interview — the incrementality critique, the small-advertiser penalty, the lower-funnel bias — stops being a list of quibbles and becomes one coherent story: the browser is asking to write the constraints under which measurement happens. The rest of this piece is what that means for the people who buy, sell, and audit media.
A constitution, not a protocol
When the trust question closed earlier this month, it ended on an open fork: the credential that lets a system act has to be issued somewhere — by a protocol it speaks, a constitution it’s bound by, or a contract it can be sued under. The Attribution API is the cleanest specimen of the second category adtech has produced.
Look at its shape. The rules are ratified at a standards body, not negotiated per-deal. They bind the runtime itself — the browser enforces what a measurement query may know, how much noise it carries, how often you may ask. They are versioned, publicly drafted, and amendable through governance rather than commerce. And they carry the one feature contracts and protocols don’t: an off-switch held by someone who is not a party to the transaction. Thomson describes the offer with unusual candor — browsers saying, in his words, “we can help, but here are our terms.”
Operators should recognize the structure, because it is the same one arriving everywhere agents and automation touch money: the constraints move out of the negotiation and into the infrastructure, and the party who authors the infrastructure inherits the outcome. Adtech spent twenty years treating measurement rules as a commercial matter — terms of service, MSAs, data-sharing agreements. A browser-native API relocates them to a layer where no buyer or seller signs anything at all.
That relocation is neither good nor bad by default. But it answers the question most coverage never asks: whose terms? The W3C’s track record genuinely does tilt toward end users, and Thomson’s insistence that the off-switch is unpunishable — sites cannot detect the choice — is a real constraint, honestly engineered. What it is not, is neutral. A constitution always has an author.
Credit is still not cause
The sharpest technical critique in the interview comes from the research community: the spec standardizes an observational framework that measures association, while its own language gestures at identifying effective advertising. Thomson’s response is worth quoting because it concedes the entire point while defending the tool:
“Attribution only gives you information.” — Martin Thomson
This is exactly the distinction the retail media standards corpus spent two years formalizing, and it transfers without modification: attribution assigns credit; incrementality estimates cause — a report that answers one is not evidence about the other. A browser-native attribution number is still an attribution number. Wrapped in differential privacy, it is a noisier attribution number with better manners. The IAB’s incrementality guidelines exist precisely because credit-assignment machinery, however privacy-preserving, cannot arbitrate what a dollar caused — and the same buyer’s discipline applies here as applies to network-reported iROAS: the number is an input to experimental design, not a verdict. Thomson says as much — use it poorly and “you can convince yourself of just about anything.”
The practical reading for operators: when this API ships at scale, the temptation will be to treat browser-vetted attribution as causally superior because it is procedurally cleaner. Resist that. The privacy engineering upgrades the provenance of the claim, not its logic. Credit is not cause, even when a browser signs the credit.
The admissions that make it credible
What separates this interview from vendor communication is that Thomson concedes the costs out loud, and the concessions are the most useful intelligence in it.
The scale penalty is real and unpatched. Differential-privacy budgets punish small queriers structurally: fewer users means fewer slices, and one mistaken query burns learnings a dominant platform would shrug off. Mozilla considered a technical remedy and declined — competition law, Thomson argues, has better tools than spec authors do. Whatever you think of that punt, note what it means: the spec’s authors themselves do not claim it is scale-neutral, only that it adds no new structural advantage. On whether incumbents will press the natural one — “of course they will if they can get away with it.”
The funnel bias is admitted. The API sees what a browser sees. Brand work that lives in other mediums is invisible to it, and Thomson offers no answer beyond “businesses will need to learn.” Buyers should hear that as a measurement-mix warning: a cheap, standardized, browser-blessed signal at the bottom of the funnel will exert gravitational pull on budgets long before anyone models what it fails to see. That pressure — instruments shaping spend rather than describing it — is the oldest failure mode in measurement standards, and it does not disappear because the instrument is well-governed.
Fraud is an open problem, stated as one. Impressions register on-device where no server vets them; the spec’s mitigation is delegation discipline, not detection. The interview’s critics worry about conversion-sniping — sneaking an “impression” in front of someone already buying. Thomson calls the risk real but bounded. Either way, it is refreshing to see known limitation printed where the industry usually prints roadmap.
This is what serious standards work sounds like: the tradeoffs are named by the people who chose them. The contrast with a decade of privacy-washing — Thomson’s own phrase for the industry’s PET practice is considerably less polite — is the strongest argument the spec has.
What to do with this
Three moves, none of which require an opinion on the W3C’s politics:
- Classify the spec correctly in your planning. This is not another identity workaround or clean-room variant; it is infrastructure-level rulemaking that will not care about your MSA. Track it the way you track platform policy, not the way you track vendor tooling.
- Pre-commit your causal discipline. Decide now which decisions browser-attributed numbers will be allowed to make in your organization — and which remain gated on designed experiments. The moment the number arrives with a browser’s imprimatur is the wrong moment to draw that line.
- Watch the issuance, not the epsilon. The parameter debates will churn for years. The durable question is the constitutional one: which browsers ship it, on what defaults, with which aggregators trusted — because whoever controls that issuance controls what “measured” means for the open web.
The season’s running argument on this site has been that trust — the standing that lets a claim act on money — is the one asset the machinery can’t mint for itself, and that the fight worth watching is over who gets to issue it. The Attribution API is the first major bid from the browser layer to become that issuer for measurement. Thomson, to his credit, isn’t pretending otherwise. The terms are on the table. Reading them is now part of the job.
Update, July 14: the methodological thread moved from critique to proposal on the same list — a PATWG post proposes standardizing attribution’s unit of analysis as a geo-time bucket (H3 geographic cell × ISO week × hour; convention only, no API change), attacking the cross-site diversion gap with geographic randomization units rather than user identifiers. The where and the when acquiring native coordinates is the four-dimensions argument arriving in a standards body.
Sourced from Alan Chapell’s Q&A with Martin Thomson, published via Marketecture (July 13, 2026), and the public PATCG/PATWG drafts. Quotes are Thomson’s, from that interview; the readings are mine.