First there were birds, and now there are PETs.
On Monday, the IAB Tech Lab took the wraps off a new working group focused on developing standards and best practices for deploying PETs, or “privacy-enhancing technologies.”
PETs rely on data-masking techniques that protect and minimize sensitive information within data sets so they can still be used but without compromising privacy.
Classic examples include differential privacy, on-device learning and processing, secure multiparty computation and various forms of cryptography.
Differential privacy, for instance, involves purposely adding noise or randomness into a data set so that it’s possible to learn something about a population (and share data) without disclosing information about any individual person.
Secure multiparty computing, meanwhile, allows for computation to be distributed across multiple parties so that no single party can see the data being processed by any of the other parties.
The objective of a PET in an advertising context is to strike the right balance between keeping data secure and private while also allowing companies to derive value from data for things like analytics, measurement and attribution, said Shailley Singh, SVP of product for the IAB Tech Lab.
“We strongly believe these technologies will be the foundation of a long-term and sustainable private internet,” said Singh, who’s chairing the new PETs workstream. “But it will require interoperability in the market – and that means standardization.”
The industry is already brimming with self-described privacy-preserving tech and proposals for future privacy-first technology development, from Apple’s SKAdNetwok, Unified ID 2.0 and Meta and Mozilla’s proposal for interoperable private attribution (IPA) to Microsoft’s PARAKEET, Google’s Topics API and other projects currently percolating in the Privacy Sandbox.
And not to mention Project Rearc, a collaborative industry effort launched by the IAB Tech Lab in 2020. Its goal is to rearchitect how personalized advertising functions online in light of signal loss due to platform changes and privacy regulations.
The PETs Working Group is the next concrete step in the Rearc process, Singh said.
“When we started Rearc, the core objective was to understand the landscape and then define what kinds of solutions we’ll need and the different types of audiences we’ll encounter in a privacy-first landscape,” he said. “I think of this as the next phase of Rearc – the build phase.”
The first order of business for the PETs Working Group will be to develop standards for secure multiparty computation and determine which types of cryptographic techniques make sense in different scenarios.
By midyear, the goal is to finish the initial work and move on to vetting existing post-cookie proposals, like Meta and Mozilla’s IPA, and, eventually, launching new open-source projects.
“We really want to drive this [working group] towards delivering actual open-source software people can directly download and deploy, rather than just specifications,” Singh said.
The IAB Tech Lab has a good track record of facilitating open source projects. One example is the open measurement SDK, which allows publishers to work with multiple viewability vendors without requiring multiple SDK integrations. Integral Ad Science originally developed the source code and later gave it to the IAB Tech Lab to manage as a way to encourage wider adoption.
But developing specs and software for PETs comes with an inherent challenge – which is that privacy-enhancing technologies don’t automatically enhance privacy. It really depends on how they’re used.
Processing data on-device, for example, doesn’t necessarily protect a user’s privacy if that data is eventually transferred elsewhere.
That’s why any PET solution requires the use of multiple technologies in combination. One alone “probably won’t cut it,” Singh said.
“If I just use on-device technology to process data, but then anybody can read the data, that’s not private,” he said. “But if I encrypt it before sending it to a trusted server and apply differential privacy, that prevents anybody from reverse engineering.”
The IAB Tech Lab plans to invest a lot of time, effort and money into the PETs Working Group this year and into the future, Singh said, including hiring several full-time people and technology experts to support the effort.
The workstream is open for anyone to join, but the hope is to attract a good mix of data scientists, privacy and security systems engineers and developers with a specialty in advanced cryptography.
“We’re looking to invite experts and researchers from the field,” Singh said. “Not everybody or every company in ad tech understands the core technology here.”
The first meeting of the PETs Working Group is scheduled for March 4.
