Technical Report: The Need for a (Research) Sandstorm through the Privacy Sandbox

TL;DR

This paper introduces Privacy Sandstorm, a research portal that compiles and analyzes proposals from Google's Privacy Sandbox to evaluate their privacy, security, usability, and utility impacts on online ecosystems.

Contribution

It presents the creation of Privacy Sandstorm, a comprehensive resource for evaluating the implications of Privacy Sandbox APIs beyond official disclosures.

Findings

Privacy Sandstorm offers broader insights than official sources.

The portal facilitates systematic evaluation of privacy and security impacts.

It highlights the need for extensive research on proposed privacy mechanisms.

Abstract

The Privacy Sandbox, launched in 2019, is a series of proposals from Google to reduce ``cross-site and cross-app tracking while helping to keep online content and services free for all''. Over the years, Google implemented, experimented, and deprecated some of these APIs into their own products (Chrome, Android, etc.) which raised concerns about the potential of these mechanisms to fundamentally disrupt the advertising, mobile, and web ecosystems. As a result, it is paramount for researchers to understand the consequences that these new technologies, and future ones, will have on billions of users if and when deployed. In this report, we outline our call for privacy, security, usability, and utility evaluations of these APIs, our efforts materialized through the creation and operation of Privacy Sandstorm (https://privacysandstorm.github.io); a research portal to systematically gather resources (overview, analyses, artifacts, etc.) about such proposals. We find that our inventory provides a better visibility and broader perspective on the research findings in that space than what Google lets show through official channels.