Provide a written competition review of the specification

[jwrosewell]

This issue asks the Working Group to commission and publish a written competition review of this specification against the W3C Antitrust and Competition Policy 2024.

The market statements

One of the specification's six editors, Martin Thomson, discussed the work in a written Q&A (archived copy) and podcast published by The Monopoly Report on 8 July 2026. He writes that "Browsers will also ultimately decide who is trusted to do aggregation" (source), and the specification's abstract states that "Websites may select an aggregation service from the list of approved aggregation services provided by the user agent". In the podcast he confirms the specification continues the Privacy Sandbox programme, "this is one of the few surviving pieces of that... just a refinement of the aggregated version of the attribution reporting API that Google uses" (approx. 16:30). With regards to the firms that measure advertising today, he says, "I don't think that the measurement partners have a natural right to the information that they're collecting" (podcast, approx. 32:50). On the position of smaller participants he writes, "Small players need to be more careful and make fewer queries. And a mistake will wipe out more of their potential learnings as a result" (source), and "big players will be better able to develop the discipline necessary to get more out of the system" (source). These are statements about which firms may operate in a market and on what terms. Statements of this kind, made in public by an author of the specification, make a written competition review necessary rather than discretionary.

Why that matters was put well by Alan Chapell in his NAI Summit keynote (video), and discussed with Thomson on the podcast. Robert Moses built the parkway bridges to Jones Beach too low for buses. Robert Caro's biography of Moses records that the people who relied on those buses were poor and, disproportionately, Black. No law excluded them from the beach. The infrastructure did. Technical standards are infrastructure in the same sense, and design choices within them can exclude particular groups without any law being written. Thomson accepts the analogy (approx. 40:45).

The question has been asked before

Formal objections raised competition concerns when this Working Group was chartered. The W3C CEO's decision stated that all Working Groups are required to operate within W3C policies and left the substance to review of the work itself. I have raised competition questions at W3C since 2020, among them w3c/security-questionnaire#111 in 2020, WICG/ua-client-hints#244 in 2021, patcg.github.io#5 on this group's chartering in 2022 and w3c/AB-public#80 to the Advisory Board in 2023. Most recently #388 raised compliance with the policy against this specification. It was closed with the assurance that "W3C is abiding by its antitrust policy". No analysis was published, and a further assurance in the same form would leave the question where it stands.

The risk is also recorded in W3C's own work. A TAG privacy-principles discussion documented in 2023 that noise-based designs can be "effectively usable... but only by one or a few large third parties" (w3ctag/privacy-principles#261). That issue moved into the draft Societal Impact Questionnaire, whose section 2.8 asks whether a specification restricts "flows of information", whether it makes use of existing gatekeepers and whether it brings new ones. There is no record of those questions being answered for this specification.

Outside W3C, the UK Competition and Markets Authority supervised the Attribution Reporting API, which this specification refines, between 2022 and 2025. Its reports record concerns that coarser measurement "may make it harder for publishers to value their ad inventory" and that dependence on browser APIs for measurement "raises concerns about the ability to audit and verify results". That monitoring ended in October 2025 after Google decided not to remove third-party cookies. The concerns were not answered, and they read onto the design as it continues here. Public commentary continues to make the same point, most recently Don Marti's Oops! All oligopoly of 13 July 2026.

The process question

W3C already reviews specifications in writing for other kinds of risk. The wide-review tracker (#425) shows accessibility, architecture, internationalization, privacy and security each receiving a written review, tracked through "feedback integrated" and "Review confirmed completed". Competition receives no equivalent at any point in the process. All are equally important. As Robin Berjon has argued, competition and privacy come together or not at all (Competition & Privacy: It's Both Or Nothing).

Requests.

1. Commission and publish a written competition review of the specification against the Antitrust and Competition Policy 2024, equivalent in form to the horizontal reviews tracked in Seek wide review #425. It should state the problem the specification solves and for whom, assess whether the design's restrictions on competition are necessary and proportionate to that problem, list the alternatives considered with the reasons each was rejected, and address the concerns already on the public record, including those above. Its findings should be tracked to resolution as other horizontal reviews are.
2. If no process exists for reviewing a specification against the Antitrust and Competition Policy 2024, equivalent to the reviews conducted for accessibility, architecture, internationalization, privacy and security, please confirm that in reply to this issue.

@christinegefaell, the assurance on #388 was yours, so your reply to this issue would be valuable.