W3C's Attribution API Faces 'Privacy Sandbox 2.0' Criticism Over Big Tech Bias

Google's Privacy Sandbox was supposed to reshape digital advertising. Instead, it collapsed under the weight of industry skepticism and regulatory pressure, wound down across 2024 and 2025. But the conversation about how to track ads without tracking people didn't end—it just moved to a different room.

Inside the W3C, the standards body that gave the world HTML and URLs, a new proposal is quietly advancing. Called the Attribution API, it aims to do what the Privacy Sandbox couldn't: produce aggregate statistics on how advertising drives conversions without compromising individual privacy. The work has been underway for years, predating Google's failed initiative, and now it's entering what the W3C calls a "wide review" process. Academics, privacy advocates, and industry groups including the National Center for Democracy & Technology and the IAB Tech Lab have been brought in to scrutinize the proposals.

The technical approach sounds elegant in theory. Instead of tracking individual users across websites, the API would collate information across multiple web origins and then aggregate it through a trusted third party. Noise gets added to the aggregates to provide what researchers call differential privacy—a mathematical technique that obscures individual data while preserving patterns useful for advertisers. Websites would choose from a list of approved aggregation services. Aram Zucker-Scharff, an engineering manager at the Washington Post who co-chairs the W3C groups developing the API, frames it as a way to make attribution "transparent and clear and easy to use and under user control." The browser itself becomes the intermediary, connecting to a multi-party computation process rather than enabling direct tracking of every third-party cookie.

But the proposal has drawn sharp criticism from those who see it as a solution that creates new problems. Don Marti, who participated in the W3C community discussions, argues the API would actually increase privacy risks by obscuring attribution fraud and creating incentives to collect more data on more people. More pointedly, he contends the current design creates a statistical bias toward the ad formats that make money for Apple, Google, and Meta—search, social, and app-store advertising—while disadvantaging regular websites like news publishers. The API, in his view, rewards the platforms that already dominate digital advertising.

Angelina Eng, formerly the vice president of measurement at IAB U.S., raises a different concern: most marketers want raw, event-level data so they can build their own attribution models rather than accepting pre-aggregated outputs. She points out that there is no one-size-fits-all solution in measurement, and that privacy budgets imposed by the browser would constrain the ability to slice data across time periods and portfolios. Looking back at Google's Privacy Sandbox failure, Eng suggests the timeline was too aggressive and the wrong people were in the room. "What you need is input from data practitioners and those involved with analytics, not engineers, developers or programmers," she told Digiday. "You need actual marketers on the agency and brand side as well as the publisher."

Underlying these technical disagreements is a structural concern: the W3C's approval process itself may be biased toward large organizations. Developing standards requires significant man-hours and resources that only Big Tech can easily afford. The W3C recently overruled formal objections to the PAT working group's charter when objectors raised concerns about conflicts of interest among the proposal's backers. For critics, this signals that the standards body's deliberative process, however well-intentioned, systematically advantages the companies that can afford to staff working groups.

The timeline is accelerating. The W3C expects to complete its horizontal review by the end of 2025, with a formal recommendation expected by the close of 2026. If adopted, the Attribution API could become a mandatory technical requirement underpinning all web browsers—a far more consequential outcome than the Privacy Sandbox ever achieved. The stakes are not merely technical. They are about who gets to measure advertising effectiveness, who controls the data, and whether the web's next era of measurement will be shaped by the same companies that dominated the last one.