On-Device Personalization - personalization with enhanced privacy protection | Privacy Sandbox

<!doctype html> <html lang="en" dir="ltr"> <head> <meta name="google-signin-client-id" content="721724668570-nbkv1cfusk7kk4eni4pjvepaus73b13t.apps.googleusercontent.com"> <meta name="google-signin-scope" content="profile email https://www.googleapis.com/auth/developerprofiles https://www.googleapis.com/auth/developerprofiles.award"> <meta property="og:site_name" content="Google for Developers"> <meta property="og:type" content="website"><meta name="theme-color" content="#fff"><meta charset="utf-8"> <meta content="IE=Edge" http-equiv="X-UA-Compatible"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="manifest" href="/_pwa/developers/manifest.json" crossorigin="use-credentials"> <link rel="preconnect" href="//www.gstatic.com" crossorigin> <link rel="preconnect" href="//fonts.gstatic.com" crossorigin> <link rel="preconnect" href="//fonts.googleapis.com" crossorigin> <link rel="preconnect" href="//apis.google.com" crossorigin> <link rel="preconnect" href="//www.google-analytics.com" crossorigin><link rel="stylesheet" href="//fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:400,400italic,500,500italic,700,700italic|Roboto+Mono:400,500,700&display=swap"> <link rel="stylesheet" href="//fonts.googleapis.com/css2?family=Material+Icons&family=Material+Symbols+Outlined&display=block"><link rel="stylesheet" href="https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625/developers/css/app.css"> <link rel="shortcut icon" href="https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625/developers/images/favicon-new.png"> <link rel="apple-touch-icon" href="https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625/developers/images/touchicon-180-new.png"><link rel="canonical" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization"><link rel="search" type="application/opensearchdescription+xml" title="Google for Developers" href="https://developers.google.com/s/opensearch.xml"> <link rel="alternate" hreflang="en" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization" /><link rel="alternate" hreflang="x-default" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization" /><link rel="alternate" hreflang="ar" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=ar" /><link rel="alternate" hreflang="bn" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=bn" /><link rel="alternate" hreflang="zh-Hans" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=zh-cn" /><link rel="alternate" hreflang="zh-Hant" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=zh-tw" /><link rel="alternate" hreflang="fa" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=fa" /><link rel="alternate" hreflang="fr" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=fr" /><link rel="alternate" hreflang="de" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=de" /><link rel="alternate" hreflang="he" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=he" /><link rel="alternate" hreflang="hi" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=hi" /><link rel="alternate" hreflang="id" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=id" /><link rel="alternate" hreflang="it" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=it" /><link rel="alternate" hreflang="ja" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=ja" /><link rel="alternate" hreflang="ko" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=ko" /><link rel="alternate" hreflang="pl" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=pl" /><link rel="alternate" hreflang="pt-BR" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=pt-br" /><link rel="alternate" hreflang="ru" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=ru" /><link rel="alternate" hreflang="es-419" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=es-419" /><link rel="alternate" hreflang="th" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=th" /><link rel="alternate" hreflang="tr" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=tr" /><link rel="alternate" hreflang="vi" href="https://developers.google.com/privacy-sandbox/protections/on-device-personalization?hl=vi" /><title>On-Device Personalization - personalization with enhanced privacy protection  |  Privacy Sandbox  |  Google for Developers</title> <meta property="og:title" content="On-Device Personalization - personalization with enhanced privacy protection  |  Privacy Sandbox  |  Google for Developers"><meta property="og:url" content="https://developers.google.com/privacy-sandbox/protections/on-device-personalization"><meta property="og:image" content="https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-for-developers.png"> <meta property="og:image:width" content="1600"> <meta property="og:image:height" content="900"><meta property="og:locale" content="en"><meta name="twitter:card" content="summary_large_image"><script type="application/ld+json"> { "@context": "https://schema.org", "@type": "Article", "headline": "On-Device Personalization - personalization with enhanced privacy protection" } </script><script type="application/ld+json"> { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [{ "@type": "ListItem", "position": 1, "name": "Privacy Sandbox", "item": "https://developers.google.com/privacy-sandbox" },{ "@type": "ListItem", "position": 2, "name": "On-Device Personalization - personalization with enhanced privacy protection", "item": "https://developers.google.com/privacy-sandbox/protections/on-device-personalization" }] } </script> <link rel="stylesheet" href="/extras.css"></head> <body class="" template="page" theme="white" type="article" layout="docs" concierge='closed' display-toc pending> <devsite-progress type="indeterminate" id="app-progress"></devsite-progress> <section class="devsite-wrapper"> <devsite-cookie-notification-bar></devsite-cookie-notification-bar><devsite-header role="banner"> <div class="devsite-header--inner nocontent"> <div class="devsite-top-logo-row-wrapper-wrapper"> <div class="devsite-top-logo-row-wrapper"> <div class="devsite-top-logo-row"> <button type="button" id="devsite-hamburger-menu" class="devsite-header-icon-button button-flat material-icons gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Navigation menu button" visually-hidden aria-label="Open menu"> </button> <div class="devsite-product-name-wrapper"> <a href="https://developers.google.com/privacy-sandbox"> <div class="devsite-product-logo-container" size="medium" > <picture> <img class="devsite-product-logo" alt="Privacy Sandbox" src="https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo.png" srcset="https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_36.png 36w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_48.png 48w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_72.png 72w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_96.png 96w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_480.png 480w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_720.png 720w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_856.png 856w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_960.png 960w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_1440.png 1440w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_1920.png 1920w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_2880.png 2880w" sizes="64px" loading="lazy" > </picture> </div> </a> <span class="devsite-product-name"> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item "> <a href="https://developers.google.com/privacy-sandbox" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Upper Header" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="Privacy Sandbox" > Privacy Sandbox </a> </li> </ul> </span> </div> <div class="devsite-top-logo-row-middle"> <div class="devsite-header-upper-tabs"> <devsite-tabs class="upper-tabs"> <nav class="devsite-tabs-wrapper" aria-label="Upper tabs"> <tab > <a href="https://developers.google.com/privacy-sandbox" track-metadata-eventdetail="https://developers.google.com/privacy-sandbox" class="devsite-tabs-content gc-analytics-event " track-type="nav" track-metadata-position="nav - overview" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Overview" track-name="overview" > Overview </a> </tab> <tab > <a href="https://developers.google.com/privacy-sandbox/cookies" track-metadata-eventdetail="https://developers.google.com/privacy-sandbox/cookies" class="devsite-tabs-content gc-analytics-event " track-type="nav" track-metadata-position="nav - cookies" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Cookies" track-name="cookies" > Cookies </a> </tab> <tab > <a href="https://developers.google.com/privacy-sandbox/private-advertising" track-metadata-eventdetail="https://developers.google.com/privacy-sandbox/private-advertising" class="devsite-tabs-content gc-analytics-event " track-type="nav" track-metadata-position="nav - private advertising" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Private advertising" track-name="private advertising" > Private advertising </a> </tab> <tab class="devsite-active"> <a href="https://developers.google.com/privacy-sandbox/protections" track-metadata-eventdetail="https://developers.google.com/privacy-sandbox/protections" class="devsite-tabs-content gc-analytics-event " track-type="nav" track-metadata-position="nav - privacy protections" track-metadata-module="primary nav" aria-label="Privacy protections, selected" data-category="Site-Wide Custom Events" data-label="Tab: Privacy protections" track-name="privacy protections" > Privacy protections </a> </tab> <tab > <a href="https://developers.google.com/privacy-sandbox/learn" track-metadata-eventdetail="https://developers.google.com/privacy-sandbox/learn" class="devsite-tabs-content gc-analytics-event " track-type="nav" track-metadata-position="nav - learn" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Learn" track-name="learn" > Learn </a> </tab> <tab > <a href="https://developers.google.com/privacy-sandbox/blog" track-metadata-eventdetail="https://developers.google.com/privacy-sandbox/blog" class="devsite-tabs-content gc-analytics-event " track-type="nav" track-metadata-position="nav - blog" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Blog" track-name="blog" > Blog </a> </tab> </nav> </devsite-tabs> </div> <devsite-search enable-signin enable-search enable-suggestions enable-query-completion project-name="Privacy Sandbox" tenant-name="Google for Developers" project-scope="/privacy-sandbox" url-scoped="https://developers.google.com/s/results/privacy-sandbox" > <form class="devsite-search-form" action="https://developers.google.com/s/results" method="GET"> <div class="devsite-search-container"> <button type="button" search-open class="devsite-search-button devsite-header-icon-button button-flat material-icons" aria-label="Open search"></button> <div class="devsite-searchbox"> <input aria-activedescendant="" aria-autocomplete="list" aria-label="Search" aria-expanded="false" aria-haspopup="listbox" autocomplete="off" class="devsite-search-field devsite-search-query" name="q" placeholder="Search" role="combobox" type="text" value="" > <div class="devsite-search-image material-icons" aria-hidden="true"> </div> <div class="devsite-search-shortcut-icon-container" aria-hidden="true"> <kbd class="devsite-search-shortcut-icon">/</kbd> </div> </div> </div> </form> <button type="button" search-close class="devsite-search-button devsite-header-icon-button button-flat material-icons" aria-label="Close search"></button> </devsite-search> </div> <devsite-language-selector> <ul role="presentation"> <li role="presentation"> <a role="menuitem" lang="en" >English</a> </li> <li role="presentation"> <a role="menuitem" lang="de" >Deutsch</a> </li> <li role="presentation"> <a role="menuitem" lang="es" >Español</a> </li> <li role="presentation"> <a role="menuitem" lang="es_419" >Español – América Latina</a> </li> <li role="presentation"> <a role="menuitem" lang="fr" >Français</a> </li> <li role="presentation"> <a role="menuitem" lang="id" >Indonesia</a> </li> <li role="presentation"> <a role="menuitem" lang="it" >Italiano</a> </li> <li role="presentation"> <a role="menuitem" lang="pl" >Polski</a> </li> <li role="presentation"> <a role="menuitem" lang="pt_br" >Português – Brasil</a> </li> <li role="presentation"> <a role="menuitem" lang="vi" >Tiếng Việt</a> </li> <li role="presentation"> <a role="menuitem" lang="tr" >Türkçe</a> </li> <li role="presentation"> <a role="menuitem" lang="ru" >Русский</a> </li> <li role="presentation"> <a role="menuitem" lang="he" >עברית</a> </li> <li role="presentation"> <a role="menuitem" lang="ar" >العربيّة</a> </li> <li role="presentation"> <a role="menuitem" lang="fa" >فارسی</a> </li> <li role="presentation"> <a role="menuitem" lang="hi" >हिंदी</a> </li> <li role="presentation"> <a role="menuitem" lang="bn" >বাংলা</a> </li> <li role="presentation"> <a role="menuitem" lang="th" >ภาษาไทย</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_cn" >中文 – 简体</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_tw" >中文 – 繁體</a> </li> <li role="presentation"> <a role="menuitem" lang="ja" >日本語</a> </li> <li role="presentation"> <a role="menuitem" lang="ko" >한국어</a> </li> </ul> </devsite-language-selector> <a class="devsite-header-link devsite-top-button button gc-analytics-event" href="//privacysandbox.com/" data-category="Site-Wide Custom Events" data-label="Site header link" > Home </a> <devsite-user enable-profiles fp-auth id="devsite-user"> <span class="button devsite-top-button" aria-hidden="true" visually-hidden>Sign in</span> </devsite-user> </div> </div> </div> <div class="devsite-collapsible-section devsite-header-no-lower-tabs "> <div class="devsite-header-background"> <div class="devsite-product-id-row" > <div class="devsite-product-description-row"> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item "> <a href="https://developers.google.com/privacy-sandbox/protections" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Lower Header" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="" > Privacy protections </a> </li> </ul> </div> </div> </div> </div> </div> </devsite-header> <devsite-book-nav scrollbars > <div class="devsite-book-nav-filter" > <span class="filter-list-icon material-icons" aria-hidden="true"></span> <input type="text" placeholder="Filter" aria-label="Type to filter" role="searchbox"> <span class="filter-clear-button hidden" data-title="Clear filter" aria-label="Clear filter" role="button" tabindex="0"></span> </div> <nav class="devsite-book-nav devsite-nav nocontent" aria-label="Side menu"> <div class="devsite-mobile-header"> <button type="button" id="devsite-close-nav" class="devsite-header-icon-button button-flat material-icons gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Close navigation" aria-label="Close navigation"> </button> <div class="devsite-product-name-wrapper"> <a href="https://developers.google.com/privacy-sandbox"> <div class="devsite-product-logo-container" size="medium" > <picture> <img class="devsite-product-logo" alt="Privacy Sandbox" src="https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo.png" srcset="https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_36.png 36w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_48.png 48w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_72.png 72w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_96.png 96w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_480.png 480w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_720.png 720w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_856.png 856w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_960.png 960w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_1440.png 1440w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_1920.png 1920w, https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo_2880.png 2880w" sizes="64px" loading="lazy" > </picture> </div> </a> <span class="devsite-product-name"> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item "> <a href="https://developers.google.com/privacy-sandbox" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Upper Header" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="Privacy Sandbox" > Privacy Sandbox </a> </li> </ul> </span> </div> </div> <div class="devsite-book-nav-wrapper"> <div class="devsite-mobile-nav-top"> <ul class="devsite-nav-list"> <li class="devsite-nav-item"> <a href="/privacy-sandbox" class="devsite-nav-title gc-analytics-event devsite-nav-has-children " data-category="Site-Wide Custom Events" data-label="Tab: Overview" track-name="overview" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Overview" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> <span class="devsite-nav-text" tooltip > Overview </span> <span class="devsite-nav-icon material-icons" data-icon="forward" > </span> </a> </li> <li class="devsite-nav-item"> <a href="/privacy-sandbox/cookies" class="devsite-nav-title gc-analytics-event devsite-nav-has-children " data-category="Site-Wide Custom Events" data-label="Tab: Cookies" track-name="cookies" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Cookies" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> <span class="devsite-nav-text" tooltip > Cookies </span> <span class="devsite-nav-icon material-icons" data-icon="forward" > </span> </a> </li> <li class="devsite-nav-item"> <a href="/privacy-sandbox/private-advertising" class="devsite-nav-title gc-analytics-event devsite-nav-has-children " data-category="Site-Wide Custom Events" data-label="Tab: Private advertising" track-name="private advertising" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Private advertising" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> <span class="devsite-nav-text" tooltip > Private advertising </span> <span class="devsite-nav-icon material-icons" data-icon="forward" > </span> </a> </li> <li class="devsite-nav-item"> <a href="/privacy-sandbox/protections" class="devsite-nav-title gc-analytics-event devsite-nav-has-children devsite-nav-active" data-category="Site-Wide Custom Events" data-label="Tab: Privacy protections" track-name="privacy protections" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Privacy protections" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> <span class="devsite-nav-text" tooltip > Privacy protections </span> <span class="devsite-nav-icon material-icons" data-icon="forward" > </span> </a> </li> <li class="devsite-nav-item"> <a href="/privacy-sandbox/learn" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: Learn" track-name="learn" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Learn" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> <span class="devsite-nav-text" tooltip > Learn </span> </a> </li> <li class="devsite-nav-item"> <a href="/privacy-sandbox/blog" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: Blog" track-name="blog" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Blog" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> <span class="devsite-nav-text" tooltip > Blog </span> </a> </li> <li class="devsite-nav-item"> <a href="//privacysandbox.com/" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Home" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> <span class="devsite-nav-text" tooltip > Home </span> </a> </li> </ul> </div> <div class="devsite-mobile-nav-bottom"> <ul class="devsite-nav-list" menu="_book"> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections" ><span class="devsite-nav-text" tooltip>About privacy protections</span></a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> <span class="devsite-nav-text" tooltip>Prevent covert tracking</span> </div></li> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections/ip-protection" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/ip-protection" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/ip-protection" ><span class="devsite-nav-text" tooltip>IP Protection</span></a></li> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections/bounce-tracking-mitigations" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/bounce-tracking-mitigations" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/bounce-tracking-mitigations" ><span class="devsite-nav-text" tooltip>Bounce tracking mitigations</span></a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> <span class="devsite-nav-text" tooltip>Limit passive fingerprinting</span> </div></li> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections/user-agent" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/user-agent" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/user-agent" ><span class="devsite-nav-text" tooltip>User-Agent reduction</span></a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> <span class="devsite-nav-text" tooltip>Fight spam and fraud</span> </div></li> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections/private-state-tokens" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/private-state-tokens" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/private-state-tokens" ><span class="devsite-nav-text" tooltip>Private State Tokens</span></a></li> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections/private-state-tokens/developer-guide" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/private-state-tokens/developer-guide" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/private-state-tokens/developer-guide" ><span class="devsite-nav-text" tooltip>Private State Tokens developer guide</span></a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> <span class="devsite-nav-text" tooltip>On-device personalization</span> </div></li> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections/on-device-personalization" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/on-device-personalization" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/on-device-personalization" ><span class="devsite-nav-text" tooltip>Overview</span></a></li> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections/on-device-personalization/developer-guide" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/on-device-personalization/developer-guide" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/on-device-personalization/developer-guide" ><span class="devsite-nav-text" tooltip>Developer guide</span></a></li> <li class="devsite-nav-item"><a href="/privacy-sandbox/protections/on-device-personalization/create-federated-learning-job" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/on-device-personalization/create-federated-learning-job" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/on-device-personalization/create-federated-learning-job" ><span class="devsite-nav-text" tooltip>Create a federated learning job</span></a></li> <li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> <span class="devsite-nav-text" tooltip>Privacy approach</span> </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/privacy-sandbox/protections/on-device-personalization/differential-privacy-semantics-for-odp" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/on-device-personalization/differential-privacy-semantics-for-odp" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/on-device-personalization/differential-privacy-semantics-for-odp" ><span class="devsite-nav-text" tooltip>Differential privacy semantics for On-Device Personalization</span></a></li></ul></div></li> <li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> <span class="devsite-nav-text" tooltip>Server side</span> </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/privacy-sandbox/protections/on-device-personalization/federated-compute-server" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/on-device-personalization/federated-compute-server" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/on-device-personalization/federated-compute-server" ><span class="devsite-nav-text" tooltip>Federated compute server overview</span></a></li><li class="devsite-nav-item"><a href="/privacy-sandbox/protections/on-device-personalization/deterministic-build" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /privacy-sandbox/protections/on-device-personalization/deterministic-build" track-type="bookNav" track-name="click" track-metadata-eventdetail="/privacy-sandbox/protections/on-device-personalization/deterministic-build" ><span class="devsite-nav-text" tooltip>Deterministic build</span></a></li></ul></div></li> </ul> </div> </div> </nav> </devsite-book-nav> <section id="gc-wrapper"> <main role="main" class="devsite-main-content" has-book-nav > <devsite-content> <article class="devsite-article"> <div class="devsite-article-meta nocontent" role="navigation"> <ul class="devsite-breadcrumb-list" aria-label="Breadcrumb"> <li class="devsite-breadcrumb-item "> <a href="https://developers.google.com/" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="" > Home </a> </li> <li class="devsite-breadcrumb-item "> <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div> <a href="https://developers.google.com/privacy-sandbox" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="2" track-type="globalNav" track-name="breadcrumb" track-metadata-position="2" track-metadata-eventdetail="Privacy Sandbox" > Privacy Sandbox </a> </li> <li class="devsite-breadcrumb-item "> <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div> <a href="https://developers.google.com/privacy-sandbox/protections" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="3" track-type="globalNav" track-name="breadcrumb" track-metadata-position="3" track-metadata-eventdetail="" > Privacy protections </a> </li> </ul> <devsite-thumb-rating position="header"> </devsite-thumb-rating> </div> <devsite-feedback position="header" project-name="Privacy Sandbox" product-id="5335444" bucket="" context="" version="t-devsite-webserver-20241114-r00-rc02.464922260396498922" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="header" class="nocontent" disable-product-feedback project-icon="https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo.png" > <button> Send feedback </button> </devsite-feedback> <h1 class="devsite-page-title" tabindex="-1"> On-Device Personalization - personalization with enhanced privacy protection </h1> <devsite-feature-tooltip ack-key="AckCollectionsBookmarkTooltipDismiss" analytics-category="Site-Wide Custom Events" analytics-action-show="Callout Profile displayed" analytics-action-close="Callout Profile dismissed" analytics-label="Create Collection Callout" class="devsite-page-bookmark-tooltip nocontent" dismiss-button="true" id="devsite-collections-dropdown" dismiss-button-text="Dismiss" close-button-text="Got it"> <devsite-bookmark></devsite-bookmark> <span slot="popout-heading"> Stay organized with collections </span> <span slot="popout-contents"> Save and categorize content based on your preferences. </span> </devsite-feature-tooltip> <div class="devsite-page-title-meta"><devsite-view-release-notes></devsite-view-release-notes></div> <devsite-toc class="devsite-nav" depth="2" devsite-toc-embedded > </devsite-toc> <div class="devsite-article-body clearfix "> <p>Intended to be implemented in <a href="https://source.android.com/">the Android Open Source Project (AOSP)</a>, this technical explainer discusses the motivation behind On-Device Personalization (ODP), the design principles that guide its development, its privacy via confidentiality model, and how it helps to ensure a verifiably private experience.</p> <p>We plan to achieve this by simplifying the data access model and making certain that all user data which leaves the security boundary is differentially private at a per- (user, adopter, model_instance) level (sometimes shortened to user-level in this document).</p> <p>All code related to potential end user data egress from the end users' devices will be open source and verifiable by external entities. In the early stages of our proposal, we seek to generate interest and gather feedback for a platform that facilitates On-Device Personalization opportunities. We invite stakeholders such as privacy experts, data analysts, and security practitioners to engage with us.</p> <h2 id="vision" data-text="Vision" tabindex="-1">Vision</h2> <p>On-Device Personalization is designed to protect end users' information from businesses with whom they have not interacted. Businesses may continue to customize their products and services for end users (for example using appropriately anonymized and differentially private machine learning models), but they won't be able to see the exact customizations made for an end user (that depends not only on the customization rule generated by the business owner, but also on the individual end user preference) unless there are direct interactions between the business and the end user. If a business produces any machine learning models or statistical analyses, ODP will seek to ensure that they are properly anonymized using the appropriate Differential Privacy mechanisms.</p> <p>Our current plan is to explore ODP in multiple milestones, covering the following features and functionalities. We also invite interested parties to constructively suggest any additional features or workflows to further this exploration:</p> <ol> <li>A sandboxed environment wherein all business logic is contained and executed, permitting a multitude of end user signals to enter the sandbox while limiting outputs.</li> <li><p>End-to-end encrypted data stores for:</p> <ol> <li>User controls, and other user related data. This could be end user-provided or gathered and inferred by businesses, along with time to live (TTL) controls, wipe out policies, privacy policies, and more.</li> <li>Business configurations. ODP provides algorithms to compress or obfuscate these data.</li> <li>Business processing results. These results can be: <ol> <li>Consumed as inputs in later rounds of processing,</li> <li>Noised per appropriate Differential Privacy mechanisms and uploaded to qualifying endpoints.</li> <li>Uploaded using the trusted uploading flow to Trusted Execution Environments (TEE) running Open Sourced workloads with appropriate central Differential Privacy mechanisms</li> <li>Shown to end users.</li> </ol></li> </ol></li> <li><p>APIs designed to:</p> <ol> <li>Update 2(a), batch or incrementally.</li> <li>Update 2(b) periodically, either batch or incrementally.</li> <li>Upload 2(c), with appropriate noising mechanisms in trusted aggregation environments. Such results may become 2(b) for the next processing rounds.</li> </ol></li> </ol> <h2 id="timeline" data-text="Timeline" tabindex="-1">Timeline</h2> <p>This is the current plan of record for testing ODP in Beta. The timeline is subject to change.</p> <table> <thead> <tr> <th><strong>Feature</strong></th> <th><strong>H1 2025</strong></th> <th><strong>Q3 2025</strong></th> </tr> </thead> <tbody> <tr> <td>On-Device Training + Inference</td> <td>Reach out to the Privacy Sandbox team to discuss potential options to pilot during this timeframe.</td> <td>Start rolling out to eligible Android T+ devices.</td> </tr> </tbody> </table> <h2 id="design_principles" data-text="Design principles" tabindex="-1">Design principles</h2> <p>There are three pillars ODP seeks to balance: privacy, fairness, and utility.</p> <h3 id="towered_data_model_for_enhanced_privacy_protection" data-text="Towered data model for enhanced privacy protection" tabindex="-1">Towered data model for enhanced privacy protection</h3> <p>ODP follows <a href="http://globalprivacyassembly.org/wp-content/uploads/2015/02/32-Conference-Israel-resolution-on-Privacy-by-Design.pdf">Privacy by Design</a>, and is designed with the protection of end user privacy as the default.</p> <p>ODP explores moving personalization processing to an end user's device. This approach balances privacy and utility by keeping data on the device as much as possible and only processing it outside of the device when necessary. ODP focuses on:</p> <ul> <li>Device control of end user data, even when it leaves the device. Destinations have to be attested Trusted Execution Environments offered by public cloud providers running ODP authored code.</li> <li>Device verifiability of what happens to the end user data if it leaves the device. ODP provides Open Source, Federated Compute workloads to coordinate cross-device machine learning and statistical analysis for its adopters. An end user's device will attest that such workloads are executed in Trusted Execution Environments unmodified.</li> <li>Guaranteed technical privacy (for example, aggregation, noise, Differential Privacy) of outputs that leave the device-controlled/verifiable boundary.</li> </ul> <p>Consequently, personalization will be device-specific.</p> <p>Moreover, businesses also require privacy measures, which the platform should address. This entails maintaining raw business data in their respective servers. To achieve this, ODP adopts the following data model:</p> <ol> <li>Each raw data source will be stored either on the device or server-side, enabling local learning and inference.</li> <li>We will supply algorithms to facilitate decision-making across multiple data sources, such as filtering between two disparate data locations or training or inference across various sources.</li> </ol> <p>In this context, there could be a business tower and an end-user tower:</p> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-diagram1.png" alt="The business tower and the end-user tower"> <figcaption> The business tower contains data generated by the business before personalization occurs. <strong>ODP asks businesses to maintain ownership</strong> of this information, ensuring that only authorized business partners can access it. <br> The end-user tower consists of data provided by the end-user (for example, account information and controls), collected data related to an end user's interactions with their device, and derivative data (for example, interests and preferences) inferred by the business. Inferred data does not overwrite any user's direct declarations. </figcaption> </figure> <p>For comparison, in a cloud-centric infrastructure, all raw data from the end-user tower is transferred to the businesses' servers. Conversely, in a device-centric infrastructure, all raw data from the end-user tower remains at its origin, while the business's data remains stored on servers.</p> <p>On-Device Personalization combines the best of both worlds by only enabling attested, open sourced code to process data that has any potential to relate to end users in TEEs using more private output channels.</p> <h3 id="inclusive_public_engagement_for_equitable_solutions" data-text="Inclusive public engagement for equitable solutions" tabindex="-1">Inclusive public engagement for equitable solutions</h3> <p>ODP aims to ensure a balanced environment for all participants within a diverse ecosystem. We recognize the intricacy of this ecosystem, which consists of various players offering distinct services and products.</p> <p>To inspire innovation, ODP offers APIs that can be implemented by developers and the businesses they represent. On-Device personalization facilitates seamless integration of these implementations while managing releases, monitoring, developer tools, and feedback tools. <strong>On-Device Personalization does not create any concrete business logic</strong>; rather, it serves as a catalyst for creativity.</p> <p>ODP could offer more algorithms over time. Collaboration with the ecosystem is essential in determining the right level of features and potentially establishing a reasonable device resource cap for each participating business. We anticipate feedback from the ecosystem to help us recognize and prioritize new use cases.</p> <h3 id="developer_utility_for_improved_user_experiences" data-text="Developer utility for improved user experiences" tabindex="-1">Developer utility for improved user experiences</h3> <p>With ODP there's no loss of event data or observation delays, as all events are recorded locally at the device level. There are no joining errors and all events are associated with a specific device. As a result, all observed events naturally form a chronological sequence reflecting the user's interactions.</p> <p>This simplified process eliminates the need for joining or rearranging data, allowing for near real-time and non-lossy user data accessibility. In turn, this may enhance the utility that end users perceive when engaging with data-driven products and services, potentially leading to higher satisfaction levels and more meaningful experiences. With ODP, businesses can effectively adapt to their users' needs.</p> <h2 id="the_privacy_model_privacy_via_confidentiality" data-text="The privacy model: privacy via confidentiality" tabindex="-1">The privacy model: privacy via confidentiality</h2> <p>The following sections discuss the consumer-producer model as the basis of this privacy analysis, and computation environment privacy versus output accuracy.</p> <h3 id="consumer-producer_model_as_the_basis_of_this_privacy_analysis" data-text="Consumer-producer model as the basis of this privacy analysis" tabindex="-1">Consumer-producer model as the basis of this privacy analysis</h3> <p>We'll employ the consumer-producer model to examine the privacy assurances of privacy via confidentiality. Computations in this model are represented as nodes within a Directed Acyclic Graph (DAG) that consists of nodes and subgraphs. Each computation node has three components: inputs consumed, outputs produced, and computation mapping inputs to outputs.</p> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-initial-input-1.svg" alt="A graph illustrating the consumer-producer model."> <figcaption>A graph illustrating the consumer-producer model. This graph has 2 computation nodes. The execution sequence is Node 1 -> Node 2. Node 1 is the first to execute. It consumes 2 initial inputs: Input 1 and Input 2. Node 1 produces Output 1. Node 2 consumes the output of Node 1 and an initial input: Input 3. It produces Output 2. Output 2 is also the final output of this graph.</figcaption> </figure> <p>In this model, privacy protection applies to all three components:</p> <ul> <li><strong>Input privacy</strong>. Nodes can have two types of inputs. If an input is generated by a predecessor node, it already has the output privacy guarantees of that predecessor. Otherwise, inputs must clear data ingress policies using <a href="#policies">the policy engine</a>.</li> <li><strong>Output privacy</strong>. The output may need to be privatized, such as that provided by Differential Privacy (DP).</li> <li><strong>Computation environment confidentiality</strong>. Computation must occur in a securely sealed environment, ensuring that no one has access to intermediary states within a node. Technologies that enable this include Federated Computations (FC), hardware-based Trusted Execution Environments (TEE), secure Multi-Party Computation (sMPC), homomorphic encryption (HPE), and more. It's worth noting that privacy via confidentiality safeguards intermediary states and all outputs egressing the confidentiality boundary still need to be protected by Differential Privacy mechanisms. Two required claims are: <ul> <li>Environments confidentiality, ensuring only declared outputs leave the environment and</li> <li>Soundness, enabling accurate deductions of output privacy claims from input privacy claims. Soundness allows privacy property propagation down a DAG.</li> </ul></li> </ul> <p><em>A private system maintains input privacy, computation environment confidentiality and output privacy. However, the number of applications of Differential Privacy mechanisms can be decreased by sealing more processing inside a confidential computation environment.</em></p> <p>This model offers two main advantages. First, most systems, large and small, can be represented as a DAG. Second, DP's <a href="https://privacytools.seas.harvard.edu/files/complexityprivacy_1.pdf"> Post-Processing [Section 2.1]</a> and composition <a href="https://privacytools.seas.harvard.edu/files/complexityprivacy_1.pdf"> Lemma 2.4 in The Complexity of Differential Privacy</a> properties lend <a href="https://differentialprivacy.org/privacy-composition/">powerful</a> tools to analyze the (worst-case) privacy and accuracy tradeoff for an entire graph:</p> <ul> <li>Post-Processing guarantees that once a quantity is privatized, it can't be "un-privatized," if the original data is not used again. As long as all inputs for a node are private, its output is private, regardless of its computations.</li> <li>Advanced Composition guarantees that if each graph part is DP, the overall graph is as well, effectively bounding the <strong>ε</strong> and <strong>δ</strong> of a graph's final output by approximately <strong>ε√κ</strong>, respectively, assuming a graph has <strong>κ</strong> units and each unit's output is <strong>(ε, δ)-DP</strong>.</li> </ul> <p>These two properties translate into two design principles for each node:</p> <ul> <li><span id="property1"><strong>Property 1</strong></span> (From Post-Processing) if a node's inputs are all DP, its output is DP, accommodating any arbitrary business logic executed in the node, and supporting businesses' "secret sauces."</li> <li><span id="property2"><strong>Property 2</strong></span> (From Advanced Composition) if a node's inputs are not all DP, its output must be made DP compliant. If a computation node is one that runs on Trusted Execution Environments and is executing open sourced, On-Device Personalization-supplied workloads and configurations, then tighter DP bounds are possible. Otherwise, On-Device Personalization may need to use worst-case DP bounds. Due to resource constraints Trusted Execution Environments offered by a public cloud provider will be prioritized initially.</li> </ul> <h3 id="computation_environment_privacy_versus_output_accuracy" data-text="Computation environment privacy versus output accuracy" tabindex="-1">Computation environment privacy versus output accuracy</h3> <p>Henceforth, On-Device Personalization will focus on enhancing the security of confidential computation environments and ensuring that intermediate states remain inaccessible. This security process, known as sealing, will be applied at the subgraph level, allowing multiple nodes to be made DP compliant together. This means that <a href="#property1">property 1</a> and <a href="#property2">property 2</a> mentioned earlier apply at the subgraph level.</p> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-splitting-graph-2.svg"> <figcaption>Splitting a graph with 7 nodes into 2 subgraphs and 1 node. Each subgraph has 3 nodes in this example. If the execution of each subgraph is sealed from adversaries, only Output 3 and Output 6, the results of the subgraphs, need to be DP'ed.<br>Of course the final graph output, Output 7, is DP'ed per composition. This means there will be 2 DP altogether for this graph; compared with 3 total (local) DP if no sealing was used.</figcaption> </figure> <p>Essentially, by securing the computation environment and eliminating opportunities for adversaries to access a graph or subgraph's inputs and intermediate states, this enables the implementation of <a href="https://privacytools.seas.harvard.edu/files/privacytools/files/complexityprivacy_1.pdf">Central DP</a> (that is, the output of a sealed environment is DP compliant), which can improve accuracy compared with <a href="https://privacytools.seas.harvard.edu/files/privacytools/files/complexityprivacy_1.pdf">Local DP</a> (that is, the individual inputs are DP compliant). This principle underlies the consideration of FC, TEEs, sMPCs, and HPEs as privacy technologies. Refer to Chapter 10 in <a href="https://privacytools.seas.harvard.edu/files/privacytools/files/complexityprivacy_1.pdf">The Complexity of Differential Privacy</a>.</p> <p>A good, practical example is model training and inference. Discussions below assume that (1), the training population and the inference population overlap, and (2), both features and labels constitute private user data. We can apply DP to all inputs:</p> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-model1-3.svg" alt="On-Device Personalization can apply local DP to user labels and features before sending them to servers."> <figcaption>Local DP: <a href="#property1">property 1</a> private features + private labels -> private model. (<a href="#property1">property 1</a>) Private model + private features -> private inference.<br>On-Device Personalization can apply local DP to user labels and features before sending them to servers. This approach does not impose any requirements on the server's execution environment or its business logic.</figcaption> </figure> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-model-sealing-4.svg" alt="In this scenario, the model owner can transfer the model for inference elsewhere."> <figcaption>Central DP: (<a href="#property2">property 2</a>) alternatively, you can apply DP during model training while keeping features and labels precise. In this scenario, the model owner can transfer the model for inference elsewhere. However, to maintain privacy during inferring, the features input into the private model must also be DP compliant, per <a href="#property1">property 1</a>.</figcaption> </figure> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-model-5.svg" alt="Improving inference accuracy by sealing training and inferring."> <figcaption>You can further improve inference accuracy by sealing training and inferring. This enables feeding precise features into the private model.</figcaption> </figure> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-federated-model-6.svg" alt="Sealing the final inference."> <figcaption>Taking it a step further, you can seal the final inference too. In this case, the model owner has no access to the inference either.<br><strong>This is the current On-Device Personalization design.</strong></figcaption> </figure> <h2 id="verifiably_private" data-text="Verifiably private" tabindex="-1">Verifiably private</h2> <p>On-Device Personalization aims to be verifiably private. It puts the focus on verifying what happens off the user devices. ODP will author the code that processes the data leaving end users' devices and will use NIST's <a href="https://www.rfc-editor.org/rfc/rfc9334">RFC 9334 Remote ATtestation procedureS (RATS) Architecture</a> to attest that such code is running unmodified in a <a href="https://confidentialcomputing.io/">Confidential Computing Consortium</a>-compliant, instance admin de-privileged server. These codes will be open sourced and accessible for transparent verification to build trust. Such measures can give individuals confidence that their data is protected, and businesses can establish reputations based on a strong foundation of privacy assurance.</p> <p>Reducing the amount of private data collected and stored is another critical aspect of On-Device Personalization. It adheres to this principle by adopting technologies like Federated Compute and Differential Privacy, enabling revelation of valuable data patterns without exposing sensitive individual details or identifiable information.</p> <p>Maintaining an audit trail that logs activities related to data processing and sharing is another key aspect of verifiable privacy. This enables the creation of audit reports and identification of vulnerabilities, showcasing our commitment to privacy.</p> <p>We ask for constructive collaborations from privacy experts, authorities, industries, and individuals to help us continuously improve the design and implementations.</p> <p>The graph below shows the code path for cross-device aggregation and noising per Differential Privacy.</p> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-8y8b9hwi0of.png" alt="Structure of the Federated Compute service."> <figcaption>Structure of the Federated Compute service, which handles both Federated Learning and Federated Analytics. Unencrypted, un-noised data is only processed on device (the red line). The processing results are uploaded encrypted, both in transit and at rest (the <span style="color: teal;">teal-colored lines</span>). Only On-Device Personalization authored, open sourced cross-device aggregation and noising workload has access to the unencrypted raw device result, after successful attestation with multiple-party coordinators. After noise is applied properly per Differential Privacy mechanisms Inside the Trusted Execution Environment, all downstream data flows can be unencrypted (the <span style="color: orange;">orange lines</span>).</figcaption> </figure> <h2 id="high-level_design" data-text="High-level design" tabindex="-1">High-level design</h2> <p>How can privacy via confidentiality be implemented? At a high level, a policy engine authored by ODP that runs in a sealed environment serves as the core component overseeing each node/subgraph while tracking the DP status of their inputs and outputs:</p> <ul> <li>From the policy engine's perspective, devices and servers are treated the same. Devices and servers running the identical policy engine are considered logically identical, once their policy engines have been mutually attested.</li> <li>On devices, isolation is achieved through AOSP isolated processes (or <a href="https://source.android.com/docs/core/virtualization/architecture#hypervisor">pKVM</a> in the long run once availability becomes high). On servers, the isolation relies on a "trusted party," which is either a TEE plus other technical sealing solutions that is preferred, a contractual agreement, or both.</li> </ul> <p>In other words, all sealed environments installing and running the platform policy engine are considered part of our <a href="https://en.wikipedia.org/wiki/Trusted_computing_base">Trusted Computing Base</a> (TCB). Data can propagate without additional noise with the TCB. DP needs to be applied when data leaves the TCB.</p> <p>The high-level design of On-Device Personalization effectively integrates two essential elements:</p> <ul> <li>A paired-process architecture for business logic execution</li> <li>Policies and a policy engine for managing data Ingress, egress and permitted operations.</li> </ul> <p>This cohesive design offers businesses a level playing field where they can run their proprietary code in a trusted execution environment, and access user data that has cleared appropriate policy checks.</p> <p>The following sections will expand on these two key aspects.</p> <h3 id="paired-process_architecture_for_business_logic_execution" data-text="Paired-process architecture for business logic execution" tabindex="-1">Paired-process architecture for business logic execution</h3> <p>On-Device Personalization introduces a paired-process architecture in AOSP to enhance user privacy and data security during business logic execution. This architecture consists of:</p> <ul> <li><p>ManagingProcess. This process creates and manages IsolatedProcesses, ensuring they remain process-level isolated with access limited to allow-listed APIs and no network or disk permissions. The ManagingProcess handles the collection of all business data, all end user data and policy clear them for the business code, pushing them into the IsolatedProcesses for execution. In addition, it mediates the interaction between IsolatedProcesses and other processes, such as system_server.</p></li> <li><p>IsolatedProcess. Designated as isolated (<a href="https://developer.android.com/guide/topics/manifest/service-element#isolated"><code translate="no" dir="ltr">isolatedprocess=true</code></a> in the manifest), this process receives business data, policy-cleared end-user data, and business code from the ManagingProcess. They allow the business code to operate on its data and policy-cleared end-user data. The IsolatedProcess communicates exclusively with the ManagingProcess for both ingress and egress, with no additional permissions.</p></li> </ul> <p>The paired-process architecture provides the opportunity for independent verification of end-user data privacy policies without requiring businesses to open-source their business logic or code. With the ManagingProcess maintaining the independence of IsolatedProcesses, and the IsolatedProcesses efficiently executing the business logic, this architecture ensures a more secure and efficient solution for preserving user privacy during personalization.</p> <p>The following figure shows this paired process architecture.</p> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-qm1nvb2hub.png" alt="The entity that authors the 'Adopter App' may or may not be the same entity as the one that authors the 'Adopter apk' in the graph."> <figcaption>The entity that authors the "Adopter App" may or may not be the same entity as the one that authors the "Adopter apk" in the graph. The entity that authors the "Adopter apk" are the same as the one that owns the "Adopter Local Store" in the graph.</figcaption> </figure> <h3 id="policies" data-text="Policies and policy engines for data operations" tabindex="-1">Policies and policy engines for data operations</h3> <p>On-Device Personalization introduces a policy enforcement layer between the platform and the business logic. The goal is to provide a set of tools that map end-user and business controls into centralized and actionable policy decisions. These policies are then comprehensively and reliably enforced across flows and businesses.</p> <p>In the paired-process architecture, the policy engine resides within the ManagingProcess, overseeing ingress and egress of end-user and business data. It will also supply allow-listed operations to the IsolatedProcess. Sample coverage areas include end-user control honoring, child protection, prevention of unconsented data sharing, and business privacy.</p> <p>This policy enforcement architecture comprises three types of workflows that can be leveraged:</p> <ul> <li>Locally initiated, offline workflows with Trusted Execution Environment (TEE) communications: <ul> <li>Data downloading flows: trusted downloads</li> <li>Data uploading flows: trusted transactions</li> </ul></li> <li>Locally initiated, online workflows: <ul> <li>Real-time serving flows</li> <li>Inference flows</li> </ul></li> <li>Locally initiated, offline workflows: <ul> <li>Optimization flows: on-device model training implemented via Federated Learning (FL)</li> <li>Reporting flows: cross-device aggregation implemented via Federated Analytics (FA)</li> </ul></li> </ul> <p>The following figure shows the architecture from the perspective of policies and policy engines.</p> <figure> <img src="/static/privacy-sandbox/assets/images/android/on-device-0yqv3oqr1jx.png" alt="Policy engine sits at the center of the design."> <figcaption> Policy engine sits at the center of the design. Examples (not exhaustive): <ul> <li>Download: 1 -> 2 -> 4 -> 7 -> 10 -> 11 -> 3</li> <li>Serving: 1 + 3 -> 4 -> 6 -> 9 -> 11 -> 3</li> <li>Optimization: 2 (provides training plan) -> 1 + 3 -> 4 -> 5 -> 8 -> 11 -> 2</li> <li>Reporting: 3 (provides aggregation plan) -> 1 + 3 -> 4 -> 5 -> 8 -> 11 -> 2</li> </ul> </figcaption> </figure> <p>Overall, the introduction of the policy enforcement layer and the policy engine within On-Device Personalization's paired-process architecture ensures an isolated and privacy-preserving environment for executing business logic while providing controlled access to necessary data and operations.</p> <h2 id="layered_api_surfaces" data-text="Layered API surfaces" tabindex="-1">Layered API surfaces</h2> <p>On-Device Personalization provides a layered API architecture for interested businesses. The top layer consists of applications built for specific use cases. Potential businesses can connect their data to these applications, known as Top-Layer APIs. Top-layer APIs are built on the Mid-layer APIs.</p> <p>Over time, we expect to add more Top-layer APIs. When a Top-layer API is not available for a particular use case, or when existing Top-layer APIs are not flexible enough, businesses can directly implement the Mid-Layer APIs, which provide power and flexibility through programming primitives.</p> <h2 id="conclusion" data-text="Conclusion" tabindex="-1">Conclusion</h2> <p>On-Device Personalization is an early stage research proposal to solicit interest and feedback on a long-term solution that addresses end user privacy concerns with the latest and best technologies that are expected to bring high utility.</p> <p>We'd like to engage with stakeholders such as privacy experts, data analysts, and potential end users to ensure that ODP meets their needs and addresses their concerns.</p> </div> <devsite-recommendations display="in-page" hidden yield> </devsite-recommendations> <devsite-thumb-rating position="footer"> </devsite-thumb-rating> <devsite-feedback position="footer" project-name="Privacy Sandbox" product-id="5335444" bucket="" context="" version="t-devsite-webserver-20241114-r00-rc02.464922260396498922" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="footer" class="nocontent" disable-product-feedback project-icon="https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo.png" > <button> Send feedback </button> </devsite-feedback> <devsite-recommendations id="recommendations-link" yield></devsite-recommendations> <div class="devsite-floating-action-buttons"> </div> </article> <devsite-content-footer class="nocontent"> <p>Except as otherwise noted, the content of this page is licensed under the <a href="https://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution 4.0 License</a>, and code samples are licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache 2.0 License</a>. For details, see the <a href="https://developers.google.com/site-policies">Google Developers Site Policies</a>. Java is a registered trademark of Oracle and/or its affiliates.</p> <p>Last updated 2024-11-04 UTC.</p> </devsite-content-footer> <devsite-notification > </devsite-notification> <div class="devsite-content-data"> <template class="devsite-thumb-rating-feedback"> <devsite-feedback position="thumb-rating" project-name="Privacy Sandbox" product-id="5335444" bucket="" context="" version="t-devsite-webserver-20241114-r00-rc02.464922260396498922" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="thumb-rating" class="nocontent" disable-product-feedback project-icon="https://developers.google.com/static/privacy-sandbox/assets/images/privacy-sandbox-logo.png" > <button> Need to tell us more? </button> </devsite-feedback> </template> <template class="devsite-content-data-template"> [[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2024-11-04 UTC."],[],[]] </template> </div> </devsite-content> </main> <devsite-footer-promos class="devsite-footer"> </devsite-footer-promos> <devsite-footer-linkboxes class="devsite-footer"> <nav class="devsite-footer-linkboxes nocontent" aria-label="Footer links"> <ul class="devsite-footer-linkboxes-list"> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Get support</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="https://github.com/privacysandbox/privacy-sandbox-dev-support" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" > Ask a question on our GitHub support repo </a> </li> <li class="devsite-footer-linkbox-item"> <a href="https://goo.gle/privacy-sandbox-feedback" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" > Submit project feedback </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Get updates</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="/privacy-sandbox/blog" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" > Developer blog </a> </li> <li class="devsite-footer-linkbox-item"> <a href="https://privacysandbox.com/news/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" > Project news </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Resources</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="https://privacysandbox.com/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" > Project site </a> </li> <li class="devsite-footer-linkbox-item"> <a href="https://privacysandbox.com/open-web/#the-privacy-sandbox-timeline" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" > Privacy Sandbox timeline </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Tools</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="https://goo.gle/psat" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" > Privacy Sandbox Analysis Tool </a> </li> <li class="devsite-footer-linkbox-item"> <a href="https://privacy-sandbox-demos.dev/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" > Privacy Sandbox demos </a> </li> </ul> </li> </ul> </nav> </devsite-footer-linkboxes> <devsite-footer-utility class="devsite-footer"> <div class="devsite-footer-utility nocontent"> <nav class="devsite-footer-sites" aria-label="Other Google Developers websites"> <a href="https://developers.google.com/" class="devsite-footer-sites-logo-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Google Developers Link"> <picture> <img class="devsite-footer-sites-logo" src="https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625/developers/images/lockup-google-for-developers.svg" loading="lazy" alt="Google Developers"> </picture> </a> <ul class="devsite-footer-sites-list"> <li class="devsite-footer-sites-item"> <a href="//developer.android.com" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Android Link" > Android </a> </li> <li class="devsite-footer-sites-item"> <a href="//developer.chrome.com/home" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Chrome Link" > Chrome </a> </li> <li class="devsite-footer-sites-item"> <a href="//firebase.google.com" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Firebase Link" > Firebase </a> </li> <li class="devsite-footer-sites-item"> <a href="//cloud.google.com" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Google Cloud Platform Link" > Google Cloud Platform </a> </li> <li class="devsite-footer-sites-item"> <a href="//ai.google.dev/" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Google AI Link" > Google AI </a> </li> <li class="devsite-footer-sites-item"> <a href="/products" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer All products Link" > All products </a> </li> </ul> </nav> <nav class="devsite-footer-utility-links" aria-label="Utility links"> <ul class="devsite-footer-utility-list"> <li class="devsite-footer-utility-item "> <a class="devsite-footer-utility-link gc-analytics-event" href="/terms/site-terms" data-category="Site-Wide Custom Events" data-label="Footer Terms link" > Terms </a> </li> <li class="devsite-footer-utility-item "> <a class="devsite-footer-utility-link gc-analytics-event" href="//policies.google.com/privacy" data-category="Site-Wide Custom Events" data-label="Footer Privacy link" > Privacy </a> </li> <li class="devsite-footer-utility-item glue-cookie-notification-bar-control"> <a class="devsite-footer-utility-link gc-analytics-event" href="#" data-category="Site-Wide Custom Events" data-label="Footer Manage cookies link" aria-hidden="true" > Manage cookies </a> </li> <li class="devsite-footer-utility-item devsite-footer-utility-button"> <span class="devsite-footer-utility-description">Sign up for the Google for Developers newsletter</span> <a class="devsite-footer-utility-link gc-analytics-event" href="/newsletter/subscribe" data-category="Site-Wide Custom Events" data-label="Footer Subscribe link" > Subscribe </a> </li> </ul> <devsite-language-selector> <ul role="presentation"> <li role="presentation"> <a role="menuitem" lang="en" >English</a> </li> <li role="presentation"> <a role="menuitem" lang="de" >Deutsch</a> </li> <li role="presentation"> <a role="menuitem" lang="es" >Español</a> </li> <li role="presentation"> <a role="menuitem" lang="es_419" >Español – América Latina</a> </li> <li role="presentation"> <a role="menuitem" lang="fr" >Français</a> </li> <li role="presentation"> <a role="menuitem" lang="id" >Indonesia</a> </li> <li role="presentation"> <a role="menuitem" lang="it" >Italiano</a> </li> <li role="presentation"> <a role="menuitem" lang="pl" >Polski</a> </li> <li role="presentation"> <a role="menuitem" lang="pt_br" >Português – Brasil</a> </li> <li role="presentation"> <a role="menuitem" lang="vi" >Tiếng Việt</a> </li> <li role="presentation"> <a role="menuitem" lang="tr" >Türkçe</a> </li> <li role="presentation"> <a role="menuitem" lang="ru" >Русский</a> </li> <li role="presentation"> <a role="menuitem" lang="he" >עברית</a> </li> <li role="presentation"> <a role="menuitem" lang="ar" >العربيّة</a> </li> <li role="presentation"> <a role="menuitem" lang="fa" >فارسی</a> </li> <li role="presentation"> <a role="menuitem" lang="hi" >हिंदी</a> </li> <li role="presentation"> <a role="menuitem" lang="bn" >বাংলা</a> </li> <li role="presentation"> <a role="menuitem" lang="th" >ภาษาไทย</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_cn" >中文 – 简体</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_tw" >中文 – 繁體</a> </li> <li role="presentation"> <a role="menuitem" lang="ja" >日本語</a> </li> <li role="presentation"> <a role="menuitem" lang="ko" >한국어</a> </li> </ul> </devsite-language-selector> </nav> </div> </devsite-footer-utility> <devsite-panel></devsite-panel> <devsite-concierge data-info-panel data-ai-panel data-api-explorer-panel > </devsite-concierge> </section></section> <devsite-sitemask></devsite-sitemask> <devsite-snackbar></devsite-snackbar> <devsite-tooltip ></devsite-tooltip> <devsite-heading-link></devsite-heading-link> <devsite-analytics> <script type="application/json" analytics>[{"dimensions": {"dimension4": "Privacy Sandbox", "dimension5": "en", "dimension3": false, "dimension1": "Signed out", "dimension6": "en", "dimension11": false}, "gaid": "UA-24532603-1", "metrics": {"ratings_count": "metric2", "ratings_value": "metric1"}, "purpose": 1}]</script> <script type="application/json" tag-management>{"at": "True", "ga4": [{"id": "G-272J68FCRF", "purpose": 1}], "ga4p": [{"id": "G-272J68FCRF", "purpose": 1}], "gtm": [{"id": "GTM-WPJH8HP6", "purpose": 0}], "parameters": {"internalUser": "False", "language": {"machineTranslated": "False", "requested": "en", "served": "en"}, "pageType": "article", "projectName": "Privacy Sandbox", "signedIn": "False", "tenant": "developers", "recommendations": {"sourcePage": "", "sourceType": 0, "sourceRank": 0, "sourceIdenticalDescriptions": 0, "sourceTitleWords": 0, "sourceDescriptionWords": 0, "experiment": ""}, "experiment": {"ids": ""}}}</script> </devsite-analytics> <devsite-badger></devsite-badger> <script nonce="AF13KbnhhMT+PUrEAeEaWafwQrpHDm"> (function(d,e,v,s,i,t,E){d['GoogleDevelopersObject']=i; t=e.createElement(v);t.async=1;t.src=s;E=e.getElementsByTagName(v)[0]; E.parentNode.insertBefore(t,E);})(window, document, 'script', 'https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625/developers/js/app_loader.js', '[1,"en",null,"/js/devsite_app_module.js","https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625","https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625/developers","https://developers-dot-devsite-v2-prod.appspot.com",1,null,["/_pwa/developers/manifest.json","https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625/images/video-placeholder.svg","https://www.gstatic.com/devrel-devsite/prod/v870e399c64f7c43c99a3043db4b3a74327bb93d0914e84a0c3dba90bbfd67625/developers/images/favicon-new.png","https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:400,400italic,500,500italic,700,700italic|Roboto+Mono:400,500,700&display=swap"],1,null,[1,6,8,12,14,17,21,25,50,52,63,70,75,76,80,87,91,92,93,97,98,100,101,102,103,104,105,107,108,109,110,112,113,117,118,120,122,124,125,126,127,129,130,131,132,133,134,135,136,138,140,141,147,148,149,151,152,156,157,158,159,161,163,164,168,169,170,179,180,182,183,186,191,193,196],"AIzaSyAP-jjEJBzmIyKR4F-3XITp8yM9T1gEEI8","AIzaSyB6xiKGDR5O3Ak2okS4rLkauxGUG7XP0hg","developers.google.com","AIzaSyAQk0fBONSGUqCNznf6Krs82Ap1-NV6J4o","AIzaSyCCxcqdrZ_7QMeLCRY20bh_SXdAYqy70KY",null,null,null,["MiscFeatureFlags__enable_firebase_utm","Cloud__enable_cloudx_experiment_ids","Cloud__enable_cloud_facet_chat","CloudShell__cloud_shell_button","DevPro__enable_cloud_innovators_plus","Concierge__enable_concierge","Cloud__enable_llm_concierge_chat","Cloud__enable_legacy_calculator_redirect","Cloud__enable_cloud_shell","Cloud__enable_cloud_shell_fte_user_flow","DevPro__enable_developer_subscriptions","Analytics__enable_clearcut_logging","Cloud__enable_cloud_dlp_service","Search__enable_suggestions_from_borg","Search__enable_page_map","Concierge__enable_pushui","Significatio__enable_by_tenant","Profiles__enable_page_saving","Profiles__enable_release_notes_notifications","Cloud__enable_free_trial_server_call","Search__enable_ai_search_summaries","MiscFeatureFlags__enable_view_transitions","Search__enable_dynamic_content_confidential_banner","Profiles__enable_developer_profiles_callout","MiscFeatureFlags__developers_footer_dark_image","Profiles__enable_awarding_url","EngEduTelemetry__enable_engedu_telemetry","TpcFeatures__enable_mirror_tenant_redirects","CloudShell__cloud_code_overflow_menu","Profiles__enable_recognition_badges","MiscFeatureFlags__enable_project_variables","Profiles__enable_dashboard_curated_recommendations","MiscFeatureFlags__enable_explain_this_code","Profiles__enable_public_developer_profiles","Profiles__enable_profile_collections","TpcFeatures__enable_required_headers","Experiments__reqs_query_experiments","Search__enable_ai_search_summaries_restricted","Concierge__enable_concierge_restricted","Cloud__enable_cloudx_ping","MiscFeatureFlags__enable_variable_operator","MiscFeatureFlags__emergency_css","Profiles__enable_completecodelab_endpoint","Profiles__require_profile_eligibility_for_signin","MiscFeatureFlags__developers_footer_image","Search__enable_ai_eligibility_checks","Profiles__enable_complete_playlist_endpoint","BookNav__enable_tenant_cache_key"],null,null,"AIzaSyBLEMok-5suZ67qRPzx0qUtbnLmyT_kCVE","https://developerscontentserving-pa.clients6.google.com","AIzaSyCM4QpTRSqP5qI4Dvjt4OAScIN8sOUlO-k","https://developerscontentsearch-pa.clients6.google.com",1,4,null,"https://developerprofiles-pa.clients6.google.com",[1,"developers","Google for Developers","developers.google.com",null,"developers-dot-devsite-v2-prod.appspot.com",null,null,[1,1,[1],null,null,null,null,null,null,null,null,[1],null,null,null,null,null,null,[1],[1,null,null,[1,20],"/recommendations/information"],null,null,null,[1,1,1],[1,1,null,1,1]],null,[null,null,null,null,null,null,"/images/lockup-new.svg","/images/touchicon-180-new.png",null,null,null,null,1,null,null,null,null,null,null,null,null,1,null,null,null,"/images/lockup-dark-theme-new.svg",[]],[],null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,[6,1,14,15,20,22,23,29,32,36],null,[[null,null,null,[3,7,10,2,39,17,4,32,24,11,12,13,34,15,25],null,null,[1,[["docType","Choose a content type",[["Tutorial",null,null,null,null,null,null,null,null,"Tutorial"],["Guide",null,null,null,null,null,null,null,null,"Guide"],["Sample",null,null,null,null,null,null,null,null,"Sample"]]],["product","Choose a product",[["Android",null,null,null,null,null,null,null,null,"Android"],["ARCore",null,null,null,null,null,null,null,null,"ARCore"],["ChromeOS",null,null,null,null,null,null,null,null,"ChromeOS"],["Firebase",null,null,null,null,null,null,null,null,"Firebase"],["Flutter",null,null,null,null,null,null,null,null,"Flutter"],["Assistant",null,null,null,null,null,null,null,null,"Google Assistant"],["GoogleCloud",null,null,null,null,null,null,null,null,"Google Cloud"],["GoogleMapsPlatform",null,null,null,null,null,null,null,null,"Google Maps Platform"],["GooglePay",null,null,null,null,null,null,null,null,"Google Pay & Google Wallet"],["GooglePlay",null,null,null,null,null,null,null,null,"Google Play"],["Tensorflow",null,null,null,null,null,null,null,null,"TensorFlow"]]],["category","Choose a topic",[["AiAndMachineLearning",null,null,null,null,null,null,null,null,"AI and Machine Learning"],["Data",null,null,null,null,null,null,null,null,"Data"],["Enterprise",null,null,null,null,null,null,null,null,"Enterprise"],["Gaming",null,null,null,null,null,null,null,null,"Gaming"],["Mobile",null,null,null,null,null,null,null,null,"Mobile"],["Web",null,null,null,null,null,null,null,null,"Web"]]]]]],[1,1],null,1],[[["UA-24532603-1"],["UA-22084204-5"],null,null,["UA-24532603-5"],null,null,[["G-272J68FCRF"],null,null,[["G-272J68FCRF",2]]],[["UA-24532603-1",2]],null,[["UA-24532603-5",2]],null,1],[[12,9],[6,5],[16,13],[13,10],[14,11],[3,2],[11,8],[5,4],[1,1],[15,12],[4,3]],[[1,1],[2,2]]],null,4,null,null,null,null,null,null,null,null,null,null,null,null,null,"developers.devsite.google"],null,"pk_live_5170syrHvgGVmSx9sBrnWtA5luvk9BwnVcvIi7HizpwauFG96WedXsuXh790rtij9AmGllqPtMLfhe2RSwD6Pn38V00uBCydV4m"]') </script> <devsite-a11y-announce></devsite-a11y-announce> </body> </html>

CINXE.COM

On-Device Personalization - personalization with enhanced privacy protection | Privacy Sandbox | Google for Developers