A quantitative information flow analysis of the topics API

Mário S. Alvim; Natasha Fernandes; Annabelle McIver; Gabriel H. Nunes

doi:10.1145/3603216.3624959

A quantitative information flow analysis of the topics API

Mário S. Alvim, Natasha Fernandes, Annabelle McIver, Gabriel H. Nunes

School of Computing

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

Abstract

Third-party cookies have been a privacy concern since cookies were first developed in the mid 1990s, but more strict cookie policies were only introduced by Internet browser vendors in the early 2010s. More recently, due to regulatory changes, browser vendors have started to completely block third-party cookies, with both Firefox and Safari already compliant.

The Topics API is being proposed by Google as an additional and less intrusive source of information for interest-based advertising (IBA), following the upcoming deprecation of third-party cookies. Initial results published by Google estimate the probability of a correct re-identification of a random individual would be below 3% while still supporting IBA.

In this paper, we analyze the re-identification risk for individual Internet users introduced by the Topics API from the perspective of Quantitative Information Flow (QIF), an information- and decision-theoretic framework. Our model allows a theoretical analysis of both privacy and utility aspects of the API and their trade-off, and we show that the Topics API does have better privacy than third-party cookies. We leave the utility analyses for future work.

Original language	English
Title of host publication	WPES '23
Subtitle of host publication	proceedings of the 22nd Workshop on Privacy in the Electronic Society
Place of Publication	New York
Publisher	Association for Computing Machinery
Pages	123-127
Number of pages	5
ISBN (Electronic)	9798400702358
DOIs	https://doi.org/10.1145/3603216.3624959
Publication status	Published - 2023
Event	22nd Workshop on Privacy in the Electronic Society, WPES 2023 - Copenhagen, Denmark Duration: 26 Nov 2023 → 26 Nov 2023

Conference

Conference	22nd Workshop on Privacy in the Electronic Society, WPES 2023
Country/Territory	Denmark
City	Copenhagen
Period	26/11/23 → 26/11/23

Keywords

topics api
third-party cookies
quantitative information flow
interest-based advertising
privacy

Access to Document

10.1145/3603216.3624959

Cite this

@inproceedings{24007208c9e14217b86a3a361fb39ed3,

title = "A quantitative information flow analysis of the topics API",

abstract = "Third-party cookies have been a privacy concern since cookies were first developed in the mid 1990s, but more strict cookie policies were only introduced by Internet browser vendors in the early 2010s. More recently, due to regulatory changes, browser vendors have started to completely block third-party cookies, with both Firefox and Safari already compliant. The Topics API is being proposed by Google as an additional and less intrusive source of information for interest-based advertising (IBA), following the upcoming deprecation of third-party cookies. Initial results published by Google estimate the probability of a correct re-identification of a random individual would be below 3% while still supporting IBA. In this paper, we analyze the re-identification risk for individual Internet users introduced by the Topics API from the perspective of Quantitative Information Flow (QIF), an information- and decision-theoretic framework. Our model allows a theoretical analysis of both privacy and utility aspects of the API and their trade-off, and we show that the Topics API does have better privacy than third-party cookies. We leave the utility analyses for future work.",

keywords = "topics api, third-party cookies, quantitative information flow, interest-based advertising, privacy",

author = "Alvim, {M{\'a}rio S.} and Natasha Fernandes and Annabelle McIver and Nunes, {Gabriel H.}",

year = "2023",

doi = "10.1145/3603216.3624959",

language = "English",

pages = "123--127",

booktitle = "WPES '23",

publisher = "Association for Computing Machinery",

note = "22nd Workshop on Privacy in the Electronic Society, WPES 2023 ; Conference date: 26-11-2023 Through 26-11-2023",

}

Alvim, MS, Fernandes, N , McIver, A & Nunes, GH 2023, A quantitative information flow analysis of the topics API. in WPES '23: proceedings of the 22nd Workshop on Privacy in the Electronic Society. Association for Computing Machinery, New York, pp. 123-127, 22nd Workshop on Privacy in the Electronic Society, WPES 2023, Copenhagen, Denmark, 26/11/23. https://doi.org/10.1145/3603216.3624959

A quantitative information flow analysis of the topics API. / Alvim, Mário S.; Fernandes, Natasha ; McIver, Annabelle et al.
WPES '23: proceedings of the 22nd Workshop on Privacy in the Electronic Society. New York: Association for Computing Machinery, 2023. p. 123-127.

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

TY - GEN

T1 - A quantitative information flow analysis of the topics API

AU - Alvim, Mário S.

AU - Fernandes, Natasha

AU - McIver, Annabelle

AU - Nunes, Gabriel H.

PY - 2023

Y1 - 2023

N2 - Third-party cookies have been a privacy concern since cookies were first developed in the mid 1990s, but more strict cookie policies were only introduced by Internet browser vendors in the early 2010s. More recently, due to regulatory changes, browser vendors have started to completely block third-party cookies, with both Firefox and Safari already compliant. The Topics API is being proposed by Google as an additional and less intrusive source of information for interest-based advertising (IBA), following the upcoming deprecation of third-party cookies. Initial results published by Google estimate the probability of a correct re-identification of a random individual would be below 3% while still supporting IBA. In this paper, we analyze the re-identification risk for individual Internet users introduced by the Topics API from the perspective of Quantitative Information Flow (QIF), an information- and decision-theoretic framework. Our model allows a theoretical analysis of both privacy and utility aspects of the API and their trade-off, and we show that the Topics API does have better privacy than third-party cookies. We leave the utility analyses for future work.

AB - Third-party cookies have been a privacy concern since cookies were first developed in the mid 1990s, but more strict cookie policies were only introduced by Internet browser vendors in the early 2010s. More recently, due to regulatory changes, browser vendors have started to completely block third-party cookies, with both Firefox and Safari already compliant. The Topics API is being proposed by Google as an additional and less intrusive source of information for interest-based advertising (IBA), following the upcoming deprecation of third-party cookies. Initial results published by Google estimate the probability of a correct re-identification of a random individual would be below 3% while still supporting IBA. In this paper, we analyze the re-identification risk for individual Internet users introduced by the Topics API from the perspective of Quantitative Information Flow (QIF), an information- and decision-theoretic framework. Our model allows a theoretical analysis of both privacy and utility aspects of the API and their trade-off, and we show that the Topics API does have better privacy than third-party cookies. We leave the utility analyses for future work.

KW - topics api

KW - third-party cookies

KW - quantitative information flow

KW - interest-based advertising

KW - privacy

UR - http://www.scopus.com/inward/record.url?scp=85180005527&partnerID=8YFLogxK

U2 - 10.1145/3603216.3624959

DO - 10.1145/3603216.3624959

M3 - Conference proceeding contribution

SP - 123

EP - 127

BT - WPES '23

PB - Association for Computing Machinery

CY - New York

T2 - 22nd Workshop on Privacy in the Electronic Society, WPES 2023

Y2 - 26 November 2023 through 26 November 2023

ER -

A quantitative information flow analysis of the topics API

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this