On the Differential Privacy and Interactivity of Privacy Sandbox Reports
Authors: Badih Ghazi (Google), Charlie Harrison (Google), Arpana Hosabettu (Google), Pritish Kamath (Google), Alexander Knop (Google), Ravi Kumar (Google), Ethan Leeman (Google), Pasin Manurangsi (Google), Mariana Raykova (Google), Vikas Sahu (Google), Phillipp Schoppmann (Google)
Volume: 2025
Issue: 3
Pages: 382–397
DOI: https://doi.org/10.56553/popets-2025-0104
Abstract: The Privacy Sandbox initiative from Google includes APIs for enabling privacy-preserving advertising functionalities as part of the effort to limit third-party cookies. In particular, the Private Aggregation API (PAA) and the Attribution Reporting API (ARA) can be used for ad measurement while providing different guardrails for safeguarding user privacy, including a framework for satisfying differential privacy (DP). In this work, we provide an abstract model for analyzing the privacy of these APIs and show that they satisfy a formal DP guarantee under certain assumptions. Our analysis handles the case where both the queries and database can change interactively based on previous responses from the API.
Keywords: Ads, Privacy Sandbox, Aggregation Service, Differential Privacy, Individual Differential Privacy, Key Discovery, Requerying
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
