The Attribution Floor: What the W3C Is Quietly Building Into the Browser
Google, Mozilla, and Meta are co-editing a browser-native attribution standard. It will not replace your measurement stack, but everything in that stack will sit on top of it.
Nate Woodman ยท July 24, 2026
In March 2026 the W3C's Private Advertising Technology Working Group published a working draft called Attribution Level 1. It received a fraction of the attention of any identity acquisition or cookie announcement, and it matters more than most of them. The editor list is the tell: engineers from Google, Mozilla, and Meta, co-editing a privacy-sensitive standards-track spec. That combination does not happen for exploratory work. It happens when the browser vendors have decided something is going to ship everywhere.
What they are building is a browser-native answer to the oldest question in digital advertising: did the ad cause the purchase, answered without anyone learning who the user was.
How it works, in one pass
When a publisher shows an ad, it asks the browser to save an impression record. The record never leaves the user's browser. When that user later converts on the advertiser's site, the advertiser asks the browser to measure the conversion. The browser matches it against its own stored impressions, adds the result into an encrypted contribution, and submits it to an aggregation service that runs multi-party computation across reports from many browsers. No single party, including the aggregator, sees any individual's contribution. What comes out the other end is a histogram: noisy, differentially private, bucketed counts of attributed conversions.
The advertiser learns that the campaign drove some number of conversions in a given bucket. Nobody learns that a particular person saw an ad and bought. Per-site privacy budgets bound how much information can ever leak about one user, and the budgets are enforced by the browser, not by policy documents.
This consolidates years of fragmented vendor work, Chrome's Attribution Reporting API, Apple's private measurement variants, Mozilla's interoperable attribution proposal, into one spec every major browser can implement. That is the significance: not a new idea, but the convergence of the ideas into a floor.
The design choice most people will miss
The spec deliberately does not standardize what the histogram buckets mean. The bucket index is an opaque integer, and its interpretation belongs entirely to the campaign. That sounds like a minor implementation detail. It is actually where all the strategy lives.
Bucket by audience cohort and you get cohort-level reward signal. Bucket by content and you learn which inventory converts. Bucket by geography and time and you get a location-and-moment-level measurement, aggregated and privacy-safe. The choice of bucketing scheme is the design of your measurement object. Teams that treat the histogram as a compliance artifact will get compliance-grade insight. Teams that design bucket schemes the way they used to design measurement taxonomies will extract real optimization signal from an API their competitors treat as a checkbox.
What it will not do
Honesty about the limits matters, because the limits define the rest of the stack. The privacy unit is the browser instance, so a person on a phone and a laptop is two unlinked worlds, and cross-device attribution is impossible by design rather than by omission. Individual user trajectories do not exist in this system, which means the per-user feedback sequences that walled-garden training pipelines consume cannot be sourced here. Off-web events, in-store, in-app, most of CTV, are out of scope. And aggregation runs on a cadence, not in real time.
So this is not the closed loop. It is the floor of one.
The floor, and what stacks on it
The right way to place this spec is as the lowest layer of a composed attribution stack, the one layer that is universal, free, and browser-enforced. Above it, clean rooms handle bilateral individual-level matching where both parties bring data. Payment networks contribute verified cross-merchant purchase truth. Identity middleware carries authenticated-user signal where consent exists. Each layer above the floor trades some universality for some resolution.
The systems that win the next phase of open-web measurement will not pick one of these. They will compose them: browser-native histograms for broad privacy-safe coverage, richer layers where relationships and consent allow, with the composition itself auditable, which source contributed what, under what privacy posture. That auditability is going to matter, because sensitive-category advertisers and their regulators will ask.
The strategic read is simple. For fifteen years, attribution on the open web was something you bought from a vendor and defended in a meeting. It is becoming something the browser does, with mathematical privacy guarantees, under a standard co-authored by companies that agree on almost nothing else. Whatever you are building in measurement, build it assuming the floor exists, because within a couple of browser release cycles, it will.