Partnering with Fastlyโ€”Oblivious HTTP relay for FLEDGE's ๐‘˜-anonymity server

FLEDGE is a Privacy Sandbox proposal to serve remarketing and custom audience use cases, designed with the intent of preventing third-parties from tracking user browsing behavior across sites. The browser will provide protection against microtargeting, by only rendering an ad if the same rendering URL is being shown to a sufficiently large number of people. We will require a crowd of 50 users per creative within the past 7 days before the ad can be rendered. This also helps protect users from cross-site tracking by preventing reporting rendered URLs that don't meet the minimum threshold.

This protection is referred to as ๐‘˜-anonymity, and is enabled by a centralized server operated by Google that maintains global counts. Once a creative meets the minimum threshold, it is cleared to be rendered to users. You can check out our explainer for further details on the ๐‘˜-threshold, and how the ๐‘˜-anonymity service is designed within FLEDGE.

A diagram showing that multiple sites in Chrome send requests to the ๐‘˜-anonymity server to serve FLEDGE ads.
When sites request FLEDGE ads, Google's ๐‘˜-anonymity server ensures ads can only be shown if they pass the ๐‘˜-anonymity threshold. When requests for the ads are made to the advertising company, the IP address is visible to them.

While the ๐‘˜-anonymity service provides a key privacy protection, it also could expose sensitive user data to this centralized server, such as IP address and the browser's User-Agent string. This is why we are improving Chromeโ€™s privacy measures by partnering with Fastly, an edge cloud platform that provides content delivery, edge compute, security, and observability services, to operate an Oblivious HTTP relay (OHTTP relay) as part of FLEDGEโ€™s ๐‘˜-anonymity server.

With data being relayed through an OHTTP relay, Google ๐‘˜-anonymity servers do not receive the IP addresses of end users. The ๐‘˜-anonymity server is an incremental step towards the full implementation of FLEDGE. Note that this doesn't impact IP addresses exposed to publisher origins through usual browsing behavior.

To implement OHTTP, we partnered with Fastly to operate a relay resource on our behalf. The user's Chrome browser will send an encrypted payload in the body of an HTTP POST message for the ๐‘˜-anonymity server to this relay. The browser encrypts the message using keys that it fetches directly from the ๐‘˜-anonymity server on the Google domain. The relay will forward the request to a gateway that will run on Google servers. The relay therefore doesn't see the content of the request but is aware of the user's IP address. Conversely, the ๐‘˜-anonymity server (and gateway) are unaware of the user's identity but can see the content of the request.

Google intends to operate the ๐‘˜-anonymity server on behalf of all Chrome users who are using FLEDGE. ๐‘˜-anonymity checks apply to all third-party ad tech and Google's own advertising services. The user is the person that benefits from ๐‘˜-anonymity, and the browser is the software that can choose to implement and enforce it.

A diagram showing that multiple sites in Chrome send requests to the ๐‘˜-anonymity server to serve FLEDGE ads with the OHTTP relay in between.
When sites request FLEDGE ads, Google's ๐‘˜-anonymity server ensures ads can only be shown if they pass the ๐‘˜-anonymity threshold. Fastly's relay protects user privacy by implementing OHTTP to hide the IP addresses.

The privacy-preserving properties of FLEDGE apply equally to Google and the broader ecosystem. This server will be called from Chrome, with support for Android expected later in 2023.

Photo by Ian Battaglia on Unsplash