Privacy preserving data collection and analysis

Abstract

A method includes receiving, by a data processing apparatus from a content distribution system, a message including a probabilistic data structure representing a set of content items that should not be provided to a user device, content item data for content items that can be provided, and a request to determine whether any content item data is invalid, determining that content item data for a given content item is invalid because the given content item is likely in the set of content items represented by the probabilistic data structure, including removing the content item data for the given content item determined to be invalid; and preventing distribution of content items including the given content item.

Description

Technical Field

[0001] This specification relates to data processing and the protection of user privacy when collecting and analyzing user data for the purpose of improving user experience. Background Technology

[0002] Through the exchange of information and transactions between users and providers, providers can receive a large amount of user data, such as the types of content users access, the time when users last visited the provider's website, and other information related to user interactions with the provider and / or the provider's website. Summary of the Invention

[0003] Generally, an innovative aspect of the subject matter described in this specification can be embodied in a method comprising receiving a message from a content distribution system by a data processing device, the message including a probabilistic data structure representing a set of content items that should not be provided to a user device, content item data of available content items to be provided to the user device, and a request to determine, based on the probabilistic data structure, whether any content item data is invalid; for a given content item among the content items, the data processing device uses the probabilistic data structure to determine that the content item data of the given content item is invalid because the given content item may be in the set of content items that should not be provided to the user device as represented by the probabilistic data structure; the method comprising: removing the content item data of the given content item determined to be invalid from the content item data by the data processing device, and blocking the distribution of a set including one or more content items, including the given content item, by the data processing device in response to the request to provide content to the user device.

[0004] In some implementations, determining that the content item data of a given content item is invalid because the given content item may be in a set of content items that should not be provided to the user device, represented by a probabilistic data structure, further includes: the data processing device querying a set of content items that should not be presented to the user device and a probabilistic data structure of content items that can be presented to the user device, and the data processing device is a server independent of the content distribution system and the content provider, which provide (i) the set of content items that should not be provided to the user device and (ii) the content items that can be provided to the user device.

[0005] In some implementations, the method further includes decrypting the probability data structure by the data processing device using a private key held only by the data processing device, wherein the probability data structure is encrypted using a public key corresponding to the private key.

[0006] In some implementations, the probabilistic data structure is a Bloom filter, which is specific to one of the following: a user device, a webpage, a publisher's website, or a request to provide content to a user device.

[0007] In some implementations, the set of content items that should not be provided to the user device, represented by a probabilistic data structure, includes the union of a first set of content items that should not be provided to the user device and a randomly selected second set of content items.

[0008] In some implementations, preventing the distribution of a collection of content items includes avoiding providing users with content items of a specified type.

[0009] In some implementations, the content item data for each of the content items includes a globally unique identifier generated using a hash function based on at least one of the following: the content provider's domain, a content item identifier unique within each content provider, the content provider's secret key, or the browser's public key generated from a trust token.

[0010] Other embodiments of this aspect include corresponding systems, apparatuses, and computer programs configured to perform the actions of the method and encoded on a computer storage device.

[0011] In the context of improving user experience, collecting and analyzing user data can be beneficial for content providers and distribution systems. However, providers may often be unable to retain data in a form sufficient to perform their analytics while providing adequate privacy protection. The following description discusses various technologies and systems used to maintain data in a form that allows providers to perform analytics to determine whether and how to adjust content distribution to users or modify content to provide a customized user experience, while protecting user privacy relative to data collected from users.

[0012] Specific embodiments of the subject matter described in this specification can be implemented to achieve one or more of the following advantages. For example, a system can send a probabilistic data structure that masks user data, providing only minimal information to content providers and distributors requested to distribute content. The solutions described in this specification also reduce the privacy risks associated with storing raw user data (e.g., data breaches or unauthorized access to user data). Traditionally, providers may store user data in its raw form, but such raw data storage is vulnerable to unauthorized access. For example, if a malicious party gains access to a provider's system, the raw user data stored in such a system may be easily accessible. The solutions described herein mitigate this risk by inserting a privacy-enhancing representation of the user data (such as a hash representation of the user data) into a probabilistic data structure that further masks the user data. More specifically, the combination of using a hash representation of the user data with the probabilistic data structure not only masks the data itself (e.g., using a hash representation instead of the actual user data) but also masks the number of users with a particular user dataset, thus providing enhanced data privacy protection. This is because the probabilistic data structure, when queried, can identify multiple entries that actually match the query (i.e., true positives) and entries that do not match the query (i.e., false positives). Therefore, even if a malicious party gains access to a probabilistic data structure, they cannot confidently identify the user data stored within the data structure, or even the actual number of users with a specific combination of user attributes. This is because the probabilistic data structure reveals the likelihood or probability that certain user data exists within it.

[0013] On the other hand, the system can accurately perform its analysis using the data without directly accessing the data of specific users. In some implementations, the independent server may be a server of a content provider or part of a content distribution system. For example, for a probabilistic data structure storing the number of times content items have been shown to users, the independent server does not know which entries correspond to specific users. Furthermore, because the probabilistic data structure allows the independent server to analyze content distribution data, the independent server does not need to access or store user data in its original format, thereby further reducing the likelihood of data breaches that reveal identifiable user data. Relatedly, the innovations described in this specification allow significant resource savings (e.g., reduced bandwidth usage and reduced memory resource usage) by allowing providers to discard the original user data (which may consume significant resources) and instead store a privacy-enhanced representation of that data in a probabilistic data structure (which requires far fewer resources). The probabilistic structure requires fewer resources because it stores a data representation that is much smaller than the original data itself. Therefore, using a probabilistic data structure reduces not only the resources required for storage but also the resources required for data transmission. For example, the probabilistic structure requires less data to be transmitted or stored compared to transmitting or storing the original data, allowing for faster and more efficient transmission and storage of data represented by the probabilistic structure.

[0014] Beyond the probabilistic structure of the stored data, the solution described herein applies an additional layer of protection to user data, including public and private key encryption at the individual browser or operating system (OS) level. By using a specific key for each browser, this invention prevents malicious actors from attempting to recreate user data, as malicious actors infer the scale of operations required to encrypt the data—each browser would need to be targeted at a separate level to collect encrypted probabilistic data, which would then need to be decrypted and analyzed. Furthermore, because the data is associated with a specific browser or OS, attempts to hijack multiple browsers using copied browser-specific keys can be easily detected and blocked through traffic analysis.

[0015] The privacy-preserving technologies described below help provide a consistent user experience across platforms maintained by independent entities with access to different types of data and / or directed to different categories of content. By allowing providers to access only the minimum amount of data necessary for a consistent browsing experience, these technologies protect user privacy while maintaining the content delivery experience users expect.

[0016] By reducing or eliminating the distribution of content to entities that have already viewed the content or have indicated no interest in the presented content, this method reduces the amount of resources spent distributing content to entities unlikely to engage with it, and delivers content more efficiently over the network—it prevents the distribution of content to entities that are not actually viewing it. In other words, computational resources such as network bandwidth, processor cycles, and / or allocated memory are not wasted by using these resources to distribute content to entities that are not actually interested in viewing it.

[0017] Details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the following description. Other features, aspects, and advantages of this subject matter will become apparent from the specification, drawings, and claims. Attached Figure Description

[0018] Figure 1 This is a block diagram of an example environment for privacy-preserving data collection and analysis.

[0019] Figure 2 This is a swimlane flowchart of privacy-preserving methods for data collection and analysis.

[0020] Figure 3 The data flow is described as a privacy-preserving approach to data collection and analysis.

[0021] Figure 4 This is a flowchart of an example process for privacy-preserving data collection and analysis using space-efficient probabilistic data structures.

[0022] Figure 5 This is a block diagram of an example computer system.

[0023] The same reference numerals and names in different figures denote the same elements. Detailed Implementation

[0024] This disclosure relates to methods and systems for computer implementations that protect user privacy when collecting and analyzing user data.

[0025] Through the exchange of information and transactions between users and providers, providers can receive a wealth of user data, such as the types of content users access, the time when a user last visited the provider's website, and other information related to user interactions with the provider and / or the provider's website. If users permit providers to collect such user data, providers can analyze this data to improve their operations and / or enhance the user experience. For example, providers can use user data to identify the types of content users view most frequently and provide additional information related to these content types, while preventing the distribution of information about other content types that users have not yet shown interest in. For the purposes described herein, "content" refers to digital content, including third-party content provided by content providers. A content item refers to a specific segment of content and includes digital components used to present it along with other content requested by the user.

[0026] A growing number of users who want to protect their privacy are withdrawing providers' access to such activity data (e.g., by refusing to accept third-party cookies), but expect a similar level of control (or personalization) over their user experience. For example, when users navigate across multiple different websites, they generally prefer not to be shown the same third-party content consecutively. Distributing the same third-party content repeatedly to the same user across multiple websites wastes computational resources that are used to distribute content that users don't want to see and might ignore. One way to limit the number of times a particular user is exposed to the same third-party content is to use frequency control techniques that prevent the same user from being exposed to the same third-party content more than a specified number of times.

[0027] Existing methods for giving users control over the frequency with which certain content items are presented to them rely on: users providing access to their information to determine whether they have indicated they are not interested in a particular content item or category, thus allowing them to indicate they do not wish to see that content or category again; or whether a specific content item has been presented to the user a threshold number of times, allowing them to indicate they have viewed that content too many times, or too many times within a given period. For example, existing methods of frequency capping rely on, for instance, users accepting cookies, consenting to accessing their device ID, or logging into their accounts. Some frequency control methods may be ineffective if this user data is not accessible, or may fail across different platforms. The innovations described in this specification overcome the problems of existing methods for implementing frequency control, improve the user experience, protect user privacy, and reduce the waste of computational resources (e.g., for distributing unwanted content to users).

[0028] As detailed in this specification, these innovative technologies can protect user privacy from data collected from users while maintaining the data in a form that allows the system to perform analysis on the user data. Upon receiving user data specifying one or more attributes, the browser, operating system, or other software on the user's device uses, for example, one or more hash functions to generate a privacy-enhanced representation of the user data. For example, a server such as a content provider server or an independent server receives the privacy-enhanced representation of the user data and stores it in a probabilistic data structure that receives it. In some implementations, the independent server may never receive the original data but instead receive the probabilistic data structure, or receive the original data, construct the probabilistic data structure, and then discard the original user data, thereby preventing direct access to the data even if an unauthorized third party gains access to the system, and maintaining information from the original user data in a more compact and efficient form.

[0029] As used throughout this article, the phrase "false positive rate" refers to the expected rate or number of false positives associated with a probabilistic data structure. For example, the false positive rate can be a function of the number of items inserted into the probabilistic data structure and the size of the probabilistic data structure.

[0030] In addition to the descriptions throughout this document, users may be given control over whether and when the systems, programs, or features described herein can collect user information (e.g., information about a user's social networks, social actions or activities, occupation, user preferences, or current location), and whether content or communications are sent to the user from a server. Furthermore, some data may be processed in one or more ways before being stored or used to remove personally identifiable information. For example, a user's identity may be processed so that personally identifiable information about the user cannot be determined, or the user's geographic location may be generalized where location information is obtained (such as generalizing to the city, zip code, or state level), thus making it impossible to determine the user's specific location. Therefore, users have control over what information about themselves is collected, how that information is used, and what information is provided to them.

[0031] Figure 1 This is a block diagram of an example environment 100 for privacy-preserving data collection and analysis. Example environment 100 includes a network 102, such as a local area network (LAN), a wide area network (WAN), the Internet, or a combination thereof. Network 102 connects an electronic document server 104 (“Electronic Document Server”), user equipment 106, a digital component distribution system 110 (also known as DCDS 110), and a privacy server 120. Example environment 100 may include many different electronic document servers 104 and user equipment 106.

[0032] User equipment 106 is an electronic device capable of requesting and receiving resources (e.g., electronic documents) via network 102. Example user equipment 106 includes personal computers, wearable devices, smart speakers, tablet devices, mobile communication devices (e.g., smartphones), smart appliances, and other devices that can send and receive data via network 102. In some embodiments, the user equipment may include a speaker that outputs auditory information to a user, and a microphone that receives auditory input (e.g., spoken word input) from the user. The user equipment may also include a digital assistant that provides an interactive voice interface for submitting input and / or receiving output in response to input. The user equipment may also include a display that presents visual information (e.g., text, images, and / or video). User equipment 106 typically includes user applications, such as web browsers, to facilitate sending and receiving data via network 102; however, native applications executed by user equipment 106 may also facilitate sending and receiving data via network 102.

[0033] User equipment 106 includes software 107. Software 107 may be, for example, a browser or operating system. In some embodiments, software 107 allows a user to access information via a network such as network 102, retrieve information from a server, and display information on the display of user equipment 106. In some embodiments, software 107 manages the hardware and software resources of user equipment 106 and provides public services to other programs on user equipment 106. Software 107 may act as an intermediary between programs and the hardware of user equipment 106.

[0034] Software 107 is specific to each user device 106. As described in detail below, privacy-preserving data analytics and collection innovations provide a resource-efficient and secure device-specific solution.

[0035] An electronic document is data that presents a collection of content at user device 106. Examples of electronic documents include web pages, word processing documents, portable document format (PDF) documents, images, videos, search results pages, and feed sources. Local applications (e.g., “applications”), such as those installed on mobile, tablet, or desktop computing devices, are also examples of electronic documents. Electronic document 105 (“electronic document”) may be provided to user device 106 by electronic document server 104. For example, electronic document server 104 may include a server hosting a publisher’s website. In this example, user device 106 may initiate a request for a given publisher’s web page, and electronic document server 104 hosting the given publisher’s web page may respond to the request by sending machine hypertext markup language (HTML) code that initiates the rendering of the given web page at user device 106.

[0036] Electronic documents can include a variety of content. For example, electronic document 105 can include static content (e.g., text or other specified content) that is inherent to the electronic document itself and / or does not change over time. Electronic documents can also include dynamic content that can change over time or based on each request. For example, the publisher of a given electronic document may maintain a data source for populating portions of the electronic document. In this example, a given electronic document may include tags or scripts that, when user device 106 processes (e.g., renders or executes) the given electronic document, cause user device 106 to request content from the data source. User device 106 integrates the content obtained from the data source into the rendering of the given electronic document to create a composite electronic document that includes content obtained from the data source.

[0037] In some cases, a given electronic document may include a digital content tag or digital content script referencing DCDS 110. In these cases, when user equipment 106 processes the given electronic document, user equipment 106 executes the digital content tag or digital content script. Execution of the digital content tag or digital content script configures user equipment 106 to generate a request 108 for digital content, which is sent to DCDS 110 via network 102. For example, the digital content tag or digital content script enables user equipment 106 to generate a packetized data request that includes header and payload data. Request 108 may include data such as the name (or network location) of the server requesting digital content, the name (or network location) of the requesting device (e.g., user equipment 106), and / or information that DCDS 110 can use to select the digital content provided in response to the request. User equipment 106 sends request 108 to the server of DCDS 110 via network 102 (e.g., a telecommunications network).

[0038] Request 108 may include data specifying the characteristics of an electronic document and a location where digital content can be presented. For example, data specifying a reference (e.g., a URL) to an electronic document (e.g., a webpage) in which digital content will be presented, an available location on the electronic document for presenting digital content (e.g., a digital content slot), the size of the available location, the position of the available location within the presentation of the electronic document, and / or the media type eligible for presentation in the location may be provided to DCDS 110. Similarly, data specifying keywords (“document keywords”) selected for selecting an electronic document or entities (e.g., people, places, or things) referenced by the electronic document may also be included in Request 108 (e.g., as payload data) and provided to DCDS 110 to identify digital content items eligible for presentation with the electronic document.

[0039] Request 108 may also include data related to other information, such as information already provided by the user, geographic information indicating the state or region where the request was submitted, or other information that provides context for the environment in which the digital content will be displayed (e.g., the type of device that will display the digital content, such as a mobile device or a tablet). The information provided by the user may include demographic data of the user of user device 106. For example, demographic information may include characteristics such as age, gender, geographic location, education level, marital status, household income, occupation, hobbies, social media data, and whether the user owns specific items.

[0040] Data specifying characteristics of user equipment 106 may also be provided in request 108, such as the model of user equipment 106, the configuration of user equipment 106, or the size (e.g., physical size or resolution) of the electronic display (e.g., a touchscreen or desktop monitor) displaying the electronic document. Request 108 may be sent, for example, over a packet network, and request 108 itself may be formatted as packet data with a header and payload data. The header may specify the destination of the packet, and the payload data may include any of the information discussed above.

[0041] In response to receiving request 108 and / or using the information included in request 108, DCDS 110 selects digital content to be presented with a given electronic document. In some implementations, DCDS 110 is implemented in a distributed computing system (or environment) including, for example, a collection of servers and multiple computing devices interconnected and responding to request 108 to identify and distribute digital content. This collection of computing devices operates together to identify a set of digital content eligible for presentation in an electronic document from a corpus of millions or more available digital content. For example, millions or more of available digital content may be indexed in a digital component database 112. Each digital content index entry may reference the corresponding digital content and / or include distribution parameters (e.g., selection criteria) that regulate the distribution of the corresponding digital content.

[0042] The identification of eligible digital content can be segmented into multiple tasks, and then these tasks can be distributed among computing devices within a set of multiple computing devices. For example, different computing devices can each analyze different portions of the digital component database 112 to identify various digital content with distribution parameters that match the information included in request 108.

[0043] DCDS 110 aggregates results received from a collection of multiple computing devices and uses information associated with the aggregated results to select one or more instances of digital content to be provided in response to request 108. In turn, DCDS 110 can generate and send response data 114 (e.g., digital data representing a response) via network 102, enabling user equipment 106 to integrate the selected set of digital content into a given electronic document, such that the selected set of digital content and the content of the electronic document are presented together on the display of user equipment 106.

[0044] Privacy server 120 is an optional component of system 100. Privacy server 120 is a server independent of electronic document server 104 and / or DCDS 110. Privacy server 120 provides users with control over their browsing experience while protecting user privacy. Privacy server 120 applies frequency control to the content distribution process. In some embodiments, privacy server 120 is part of digital component distribution system 110. In this document, the term "frequency control" refers to one or more features that control the frequency at which content is presented to a particular user.

[0045] For example, frequency control can refer to a frequency cap, a feature that allows content providers to limit the number of times a content item can be displayed. The frequency cap can be implemented partly by DCDS 110 and / or privacy server 120, and partly by browser 107 on user device 106. For example, DCDS 110 and / or privacy server 120 can maintain records of the maximum threshold number of times each content item can be displayed and / or the time period during which content items can be displayed, and browser 107 on user device 106 can maintain records of the number of times a specific content item has been displayed. If browser 107 determines that the maximum threshold number of times a specific content item has been displayed has been reached, the content item can be added to a list of content items that should not be offered again or should not be offered for a period of time. Frequency caps are important for the user's browsing experience and improving system efficiency because seeing too much of the same content can be unpleasant or annoying for users, reducing their experience, and wasting the content provider's resources in sending and presenting duplicate content items to users.

[0046] In another example, frequency control can refer to collecting features from user input that signals to content providers that they are not interested in specific content items or categories and / or do not want to see them again. For example, users may be presented with options to stop showing content items to them at a given moment and to prevent them from being shown content items in the future. Users can interact with user interface elements such as buttons, checkboxes, or other elements. For example, a user can select a button to eliminate content. Furthermore, when content is stopped from being shown to the user, the user can provide subjective feedback about the content. For example, a user can input feedback such as "I've seen this suggestion before," "I don't like this," "Don't show me this again," and other types of input. In some implementations, this user input can be referred to as "mute" content items. In some implementations, muting is associated with a time period. For example, a user can select a time period during which they do not want to see content items. In some implementations, a default time period can be applied when a user mutes content items or time periods selected based on the type of content item and / or the type of feedback provided by the user, as well as other factors.

[0047] In some implementations, the privacy server 120 is implemented in a distributed computing system (or environment) including, for example, a server and an interconnected set of multiple computing devices that apply frequency control in response to requests. The set of multiple computing devices operates together to identify a set of digital content eligible for presentation in electronic documents from a corpus of millions or more of available digital content. The millions or more of available digital content can be indexed, for example, in the privacy server database 122, based on how many times the content has been presented to a particular user and / or whether the user has requested that the content item not be presented.

[0048] As an initial step, each content item distribution activity can be represented by a unique activity ID in each content distribution system. A “globally” unique activity ID allows content item distribution activities to be uniquely identified across the entire Internet and is generated using a combination of the eTLD+1 of the content distribution system’s domain (one level above the effective top-level domain) and the activity ID of the activity within that domain. For example, a globally unique activity ID can be generated as a cryptographic hash of the content distribution system’s domain’s eTLD+1 and the activity ID. Such a cryptographic hash could be a hash-based message authentication code (HMAC) implemented using a secure hash algorithm such as SHA-256 to create a 32-byte word. An example function for calculating a globally unique activity ID is represented by equation (1):

[0049] S i=HMAC(campaign_ID,content_distribution_system_domain) Equation (1).

[0050] The finite discrete set of content items is represented by, for example, the set represented by equation (2):

[0051] S = {S1,S2,…,S} z Equation (2)

[0052] One advantage of using HMAC to define each globally unique activity ID is that, without additional information, it is impossible to determine the identity of a content delivery system or activity ID solely by examining the globally unique activity ID. Therefore, the globally unique activity ID protects confidential information such as the number of currently running content item delivery activities, the number of stopped content item delivery activities, and the number of started content item delivery activities, as well as other information.

[0053] These globally unique activity IDs are provided to the software running on each user device when the user navigates and browses the Internet. For example, software 107 may store data associated with the globally unique activity IDs. In some implementations, the globally unique activity IDs are stored locally on the user device. Software 107 may comprise various software on the user device; for ease of explanation, the following description is provided with respect to browser program 107 on the user device.

[0054] To provide further protection, each content delivery system can generate a secret key. For example, DCDS 110 can generate a secret key DCDS_key. For each browser, the content delivery system can create a browser-specific secret key using its own secret key and a public key generated via the trust token API for the browser. For example, DCDS 110 can generate a browser-specific secret key for browser 107 by hashing the browser's public key browser_public_key and DCDS 110's secret key DCDS_key according to equation (3):

[0055] browser_specific_key=HMAC(browser_public_key,DCDS_key) Equation (3).

[0056] The content delivery system can then generate a globally unique activity ID for the content items presented to the browser. In some implementations, the content delivery system can use a deterministic encryption algorithm. For example, DCDS 110 can use a deterministic symmetric encryption algorithm to generate a globally unique activity ID for the content items presented to browser 107 according to equation (4):

[0057] S i =Encrypt(campaign_ID,browser_specific_key) Equation (4).

[0058] Next, the content distribution system will... i Encryption is performed, and the ciphertext is sent as a parameter along with the request for application frequency control. In some implementations, the content distribution system may use a probabilistic encryption algorithm. For example, when invoking frequency control, DCDS 110 may encrypt Si according to equation (5) and send the result to browser 107:

[0059] S i =PubKeyEncrypt(S i Equation (5) is given by ,browser_public_key).

[0060] Upon receiving a request to invoke frequency control, the browser can use a browser-specific private key generated via the Trust Token API to decrypt the request and S. i As long as the content delivery system's secret key is kept secret, a malicious party cannot determine the browser-specific key calculated by equation (3), even using intercepted traffic. Furthermore, the browser-specific nature of the browser-specific secret key deters malicious parties because there is no scalable or economical way for them to collect the globally unique activity ID S. i To access content provider information.

[0061] To implement frequency control techniques, scripts within a content item can notify, for example, a browser on a user's device displaying the content item of (1) the activity ID associated with the content item, and (2) any frequency control rules already defined for the activity. For example, a frequency cap rule could be that the content item is rendered no more than twice per minute and no more than five times per hour. The browser can maintain a data structure for each globally unique activity ID that indicates (1) the frequency cap rule and (2) a list of timestamps indicating when the content item has been rendered. In some implementations, the browser can remove timestamps that occurred more than an hour ago to reduce the memory resources required to store and maintain the data. For example, if the frequency cap stipulates that there should not be more than five renderings per hour, the browser can remove timestamps that occurred more than an hour ago. The browser can determine the time frame between two events by finding the difference between the timestamp of the most recent event and the timestamp of the event in question. This data allows the browser to determine, or facilitates, whether an activity has reached its frequency cap on the browser.

[0062] In addition, each browser maintains a set D of content items that should not be rendered on the browser. Set D is a subset of a finite, discrete set of content items that should not be rendered due to frequency control rules or explicit user requests. For example, content items in set D should not be served because the user on the user's device running the browser has provided input indicating that they are not interested in that content item or do not wish to see it again, or because the content item is being presented to the user too frequently according to frequency control rules.

[0063] The browser may update set D when various conditions occur. For example, when a user provides feedback indicating they do not want to see a content item or are not interested in content similar to that item; when the content item being presented to the user has reached its frequency limit specified by frequency control rules; and when the time period specified by user feedback and / or frequency control rules expires. Generally, the number of items in set D is much smaller than the number of items in set S, such that the number of content items ineligible to be presented to the user due to user preferences or frequency control rules is less than the total number of available content items.

[0064] When selecting content items or digital components to present to a specific user on a user's device running a browser, the content delivery system uses a browser-specific set D. For example, the content delivery system can select items from set S that meet certain conditions. Content item S i This ensures that the selected content items conform to the frequency control rules and user preferences represented by the set D.

[0065] Set D is advantageous because it allows content delivery systems to comply with frequency control rules and deliver user experiences based on user expectations. However, if direct access to set D is provided to content providers or content delivery systems, set D can become a convenient signal for tracking users. To limit any incremental tracking that can be performed using set D while complying with frequency control rules across various platforms and domains, each browser can extend set D with randomly selected noise. For example, a browser can generate a random set D' representing random content items that are also identified as ineligible for presentation, regardless of whether these items are eligible according to frequency control rules or user preferences. The browser can then compute the union of sets D and D' (D∪D′) and randomly rearrange the elements before serving the result along with the content item request. Set D' provides random noise that obscures the true set of ineligible content items, making it difficult or impossible to associate set (D∪D′) with a specific user. Browsers choose D' to provide a specific level of privacy protection while maintaining efficiency, ensuring that the computational complexity and adoption costs are not prohibitively high.

[0066] Browsers can adapt set D' based on various factors. They can choose set D' based on the lifetime of a specific identifier for each web page, each web page visit, each content item request, and each application or platform. For example, if a site can associate set D' with every content item request from the same web page visit, the browser can determine that generating only one set D' for multiple content item requests originating from the same web page visit is most efficient. To prevent web pages from continuously tracking set D', the browser can insert (D∪D′) into the header of the content item request, or encrypt (D∪D′) using a specific server's public key, ensuring that only that server can decrypt the message.

[0067] In addition to randomly generated noise, browsers can add a probabilistic layer of protection to user data. For example, a browser can select and construct a Bloom filter and send it along with content item requests to further obfuscate the set D that can be used to track users. A Bloom filter is a space-efficient probabilistic data structure that can quickly check whether an element belongs to a certain set. The result is either "likely in the set" or "definitely not in the set".

[0068] Compared to the 32 bytes of a hash set, a Bloom filter can use, for example, less than 10 bits per element, providing a false positive rate independent of the size or number of elements in the set, offering significant savings in storage and bandwidth requirements. This probabilistic data structure can significantly reduce the use of data processing and / or memory resources by storing a privacy-enhancing representation of the data within the probabilistic data structure (requiring far fewer resources than the original data) and allowing the original data to be discarded. Therefore, using a probabilistic data structure also reduces the amount of resources required to process the data. Compared to transmitting or storing the original data, probabilistic structures require less data to transmit and / or store, thus allowing for faster and more efficient transmission and storage of data represented by probabilistic structures.

[0069] Furthermore, if the content distribution system is restricted to rendering content items only if the Bloom filter result indicates that the item is "definitely not in the set" of ineligible content items (D∪D′), then the process guarantees compliance with frequency control constraints. Browsers can use variations of Bloom filters or other probabilistic data structures similar to Bloom filters. For example, browsers can use a cuckoo filter. In some implementations, browsers can evaluate many probabilistic structures similar to Bloom filters and select the most suitable one.

[0070] The probability of false positives essentially creates a set D″ representing an additional set of content items that are also identified as ineligible for presentation, regardless of whether these content items are eligible according to frequency control rules or user preferences. Because in S iWhen ∈D∪D′∪D″, the Bloom filter replies "possibly in the set", so the Bloom filter further reduces the likelihood of associating the set (D∪D′∪D″) with a specific user. The set of content items that are not eligible to be presented has been efficiently and randomly expanded twice.

[0071] Figure 2 This is a swimlane flowchart of a privacy-preserving method 200 for data collection and analysis. The operation of method 200 is performed by various components of system 100. For example, the operation of method 200 may be performed by a privacy server 120 and a DCDS 110 that communicate with user equipment 106.

[0072] Method 200 encapsulates each of the aforementioned privacy and security features and enables the content distribution system to query Bloom filters and access only the minimum amount of information necessary to perform the final selection of content items for display. Furthermore, Method 200 allows users accessing different platforms with access to different types of data or datasets to have a consistent experience regarding the supply of content items. For example, Method 200 allows for compliance with users' privacy expectations, whether the user is visiting a website owned and operated by a first entity for browsing user-created items for sale, or a social networking platform owned and operated by a completely different second entity.

[0073] The method begins with steps 1-3 performed by the software on the user device. In step 1, the software on the user device selects a Bloom filter and constructs the selected Bloom filter. For example, browser 107 on user device 106 may determine an appropriate Bloom filter and Bloom filter parameters based on interaction data received from user device 106 to implement frequency control rules associated with a specific user. Browser 107 may select, for example, the false positive rate of the Bloom filter. In some implementations, to amortize the cost of constructing the Bloom filter, the browser may optionally cache the constructed Bloom filter for later applicable requests. Browser 107 selects the parameters of the Bloom filter and constructs the Bloom filter without input from parties such as DCDS 110 or content providers.

[0074] The method continues to step 2, where the browser encrypts the message containing the Bloom filter using an asymmetric encryption algorithm. Browser 107 composes a message including at least (1) the constructed and / or cached Bloom filter, and (2) a content item request timestamp identifying the time when the content item was requested by user device 106. The browser may encrypt the Bloom filter and include the encrypted Bloom filter in the message. In some implementations, browser 107 encrypts the Bloom filter using the public key of privacy server 120, such that only privacy server 120 can decrypt the result.

[0075] The method continues to step 3, where the browser generates a request for a digital component to be displayed on the user device. For example, browser 107 may generate a request 108 for a content item to be displayed on user device 106.

[0076] The method continues with steps 4-6 performed by DCDS 110. In some implementations, steps 4 and 5 occur in parallel for each content provider participating in DCDS 110.

[0077] In step 4, the content delivery system receives a request for a digital component from the browser and generates a bid request to solicit bids from content providers to deliver content to the user device. For example, DCDS 110 receives a request 108 for a content item to be displayed on user device 106. DCDS 110 can then generate a bid request to solicit bids from content providers. In some implementations, DCDS 110 performs an auction process to solicit bid responses. For example, DCDS 110 can perform a standard auction process typically used in content delivery systems.

[0078] In step 5, the content distribution system receives a bid response from the content provider. For example, in response to a request for a bid to provide content to user equipment 106, DCDS 110 receives a response from the content provider indicating a specific content item and an associated bid price. In some implementations, bids may be provided, for example, including a globally unique activity ID as described above.

[0079] In some implementations, a content provider may return multiple bids in response to a bid request to avoid missing a purchase opportunity, since the content provider is unaware of the Bloom filter and cannot pre-filter candidate content items based on frequency control parameters, and may return content items that will be blocked later (e.g., the content item may be determined to be ineligible in step 10).

[0080] In step 6, the content distribution system selects multiple highest bids from the received bid responses. For example, the DCDS 110 can select the first three highest bids from a standard auction process. In some implementations, the DCDS 110 can adjust the number of selected highest bids based on factors such as the number of received responses, frequency control parameters, and / or Bloom filter parameters.

[0081] In step 7, the content distribution system can apply a content frequency cap by querying a separate privacy server. For example, DCDS 110 can request privacy server 120 to apply a Bloom filter to the auction results by sending a message that includes at least (1) an ordered list of the selected highest bids and (2) an encrypted Bloom filter with content item request timestamps.

[0082] The method continues with steps 8-10, performed by the content distribution system and / or a separate privacy server communicating with its privacy server database. In some implementations, the separate privacy server 120 is part of the content distribution system and restricts the activities of the content distribution system so that the content distribution system does not repeatedly query the same Bloom filter to collect more information than is needed to perform content distribution.

[0083] In step 8, the content delivery system and / or privacy server decrypt the received Bloom filter. For example, DCDS 110 and / or privacy server 120 can use their private keys to decrypt the Bloom filter encrypted by browser 107 using the public keys of DCDS 110 / privacy server 120.

[0084] In an optional step 9, if the privacy server operates independently of the content distribution system, it enforces frequency control rules by consulting its privacy server storage using Bloom filters and content request timestamps. The timestamps can be used to detect potential abuse by the content distribution system. For example, privacy server 120 can determine that a particular Bloom filter has been queried by the content distribution system more than a threshold number of times, and determine that the content distribution is engaging in suspicious or fraudulent activity.

[0085] In step 9, the content delivery system or privacy server enforces frequency control rules by querying a Bloom filter. For example, DCDS 110 and / or privacy server 120 may use a Bloom filter to determine whether a content item is eligible to be displayed on user device 106. In one example, the frequency control rule includes limiting a specific content item from being served more than N times in the past M minutes. DCDS 110 and / or privacy server 120 may determine, for example, that a specific content item indicated by a bid from a list provided by DCDS 110 has been served less than 2 times in the past 25 minutes, and therefore that specific content item is eligible.

[0086] In step 10, the content delivery system and / or the privacy server selects the highest-ranking bid that remains eligible after consulting its database using a Bloom filter. For example, privacy server 120 can select the highest-ranking bid that remains eligible from the list received in step 7, based on a Bloom filter applied to privacy server database 122.

[0087] The method continues with an optional step 11 performed by the privacy server. In step 11, the privacy server sends the selected highest-ranking bid, which is still eligible to be displayed on the user device, to the content distribution system. For example, privacy server 120 may send the selected highest-ranking bid, which is still eligible to be displayed on user device 106, to DCDS 110.

[0088] The method continues with step 12, performed by the content distribution system. In step 12, the content distribution system sends data to the user device that facilitates the display on the user device of content items associated with the selected highest-ranking bid provided by the privacy server. For example, DCDS 110 sends data to user device 106 that helps display on user device 106, in browser 107, content items associated with the selected highest-ranking bid provided by the privacy server 120.

[0089] In some implementations, tiered frequency caps can be applied, where different levels of the content delivery system can apply frequency caps. For example, frequency control can be applied at the group level, activity level, and activity group level. In some implementations, when a specific content item is displayed on a user's device, the content item script instructs the browser to update the frequency counts for all applicable levels. In some implementations, a content item request Bloom filter can include all groups, activities, and activity groups that have reached their frequency caps as ineligible.

[0090] In some implementations, there may be a range of categories for frequency control rules. There could be an industry-wide taxonomy whose natural gradations match the expectations of users in a particular industry. When a user indicates disinterest in a content item from a content provider, the browser can encode the user's frequency control feedback in a Bloom filter embedded in the content item request provided to the content distribution system. For example, if a user indicates they no longer want to see any bird-related content items, all content providers could be blocked from serving albatross-related content items to that particular user's browser. Therefore, the innovative process described herein reduces the resources used to serve content to users who are less likely to engage or whose user experience may be compromised.

[0091] Innovative technologies for user data collection and analysis offer a variety of options to achieve desired levels of privacy protection while minimizing the impact on content providers and content distribution systems. Furthermore, the efficiency of this process results in reasonable adoption costs for the industry. These technologies are tailored to both user privacy preferences and content provider distribution preferences. For example, in one particular implementation, a browser can (1) determine when and how to randomly expand the set of content items that are ineligible to be provided and / or the size of that set, (2) select an appropriate Bloom filter algorithm and false positive rate for the Bloom filter, further randomly expand the set of content items that are ineligible to be provided, and (3) choose whether to employ a separate privacy server, such as Privacy Server 120, to further obfuscate the set of content items that are ineligible to be provided, thereby further protecting user privacy.

[0092] Figure 3 Depicting Figure 1The example environment shows a privacy-preserving method for data collection and analysis, with data stream 300. The operation of data stream 300 is performed by various components of system 100. For example, the operation of data stream 200 may be performed by DCDS 110 and privacy server 120, which communicate with user equipment 106.

[0093] The process begins in step A, where user device 106 receives interaction data indicating an interaction performed by the user of user device 106 and triggering a request for content items. For example, user device 106 may receive an interaction notification from browser 107 indicating that the user has clicked on a webpage providing content related to small animals.

[0094] The process continues to step B, where browser 107 generates a request for content and provides that request to DCDS 110. For example, browser 107 can generate a request 108 for content to be displayed on user device 106. As described above, browser 107 can also generate a Bloom filter based on the frequency control rules for users and web pages on user device 106, and encrypt the Bloom filter using the private key of privacy server 120. For example, browser 107 can select the type of Bloom filter, select the false positive rate of the Bloom filter, and construct the Bloom filter. Browser 107 also records a timestamp indicating the time when the content item request was generated. Browser 107 can send a message including the encrypted Bloom filter and the timestamp, along with the content request 108, to DCDS 110.

[0095] The process continues to step C, in which DCDS 110, in response to a request for a content item, performs a content item auction process to solicit and receive bids for the content to be provided at user equipment 106. For example, DCDS 110 can perform the process described in the reference above. Figure 2 Steps 4-6 are described above.

[0096] The process continues to step D, where DCDS 110 requests that frequency control rules be applied to the highest bid response selected from the auction process. For example, DCDS 110 may send a request to privacy server 120 to apply frequency control. This request includes a list of the highest-ranked bids, an encrypted Bloom filter, and a timestamp. For example, the list may include the top 3 bids.

[0097] The process continues to step E, in which DCDS 110 applies frequency control rules to the list of highest-ranking bids. For example, DCDS 110 can use its private key to decrypt an encrypted Bloom filter encrypted by browser 107 using DCDS 110's public key. DCDS 110 can then apply frequency control to the list of highest-ranking bids. In some implementations, privacy server 120 performs step E. Privacy server 120 may be separate from DCDS 110. In some implementations, privacy server 120 is part of DCDS 110 and ensures that DCDS 110 does not repeatedly query the same Bloom filter to collect more information than is needed to perform content distribution.

[0098] The process continues to step F, in which privacy server 120 selects the highest bid from the remaining bids that were never determined to be ineligible and returns that bid to DCDS 110. For example, privacy server 120 can identify the highest bid from two bids that were not determined to be ineligible in a Bloom filter-based query and return that bid to DCDS 110.

[0099] The process concludes with step G, in which DCDS 110 sends data that facilitates the display of content items associated with the bid identified by privacy server 120 at user device 106. For example, DCDS 110 may send a response 114 to request 108 from user device 106. Response 114 includes data that facilitates the display of content items associated with the bid identified by privacy server 120 at user device 106. For example, the content item could be a digital component, such as a video of a cute puppy to be displayed in browser 107, in the case of a user on user device 106 viewing a webpage related to small animals.

[0100] Figure 4 This is a flowchart illustrating an example privacy-preserving process for data collection and analysis using space-efficient probabilistic data structures. In some implementations, process 400 may be performed by one or more systems. For example, process 400 may be performed by... Figure 1-3 The process 400 may be implemented using a DCDS 110, a privacy server 120, and / or (multiple) user equipment 106. In some implementations, the process 400 may be implemented as instructions stored on a non-transitory computer-readable medium, and when these instructions are executed by one or more servers, they may cause one or more servers to perform the operations of the process 400.

[0101] Process 400 begins with the data processing device receiving a message from the content distribution system, the message including (i) an encrypted probabilistic data structure representing a set of content items that should not be provided to the user device, (ii) content item data of content items that can be provided to the user device, and (iii) a request (402) to determine whether any content item data is invalid based on the probabilistic data structure. For example, privacy server 120 may receive a message from DCDS 110 including an encrypted Bloom filter, a set of bids, and a request to apply frequency control to the content distribution process by determining whether the bids in the set correspond to content items that have exceeded frequency limits or have been muted by the user.

[0102] In some implementations, the message includes a timestamp of when the content request was made. For example, the message may include a timestamp of when browser 107 generated a request for content 108.

[0103] In some implementations, the set of content items that should not be provided to the user device, as represented by the Bloom filter, includes the union of (1) a first set of content items that should not be provided to the user device and (2) a randomly selected second set of content items. For example, the set D of content items that should not be provided to the user device 106 may include (1) content items whose frequency exceeds the limit or have been muted by the user, and (2) content items randomly selected to add noise.

[0104] In some implementations, as described above, the Bloom filter is specific to the user device, the webpage, or the request to provide content to the user device. In other implementations, the Bloom filter is specific to the user device's browser or operating system.

[0105] Each content item bid in the content item set can be identified using a globally unique identifier. This globally unique identifier is generated using a cryptographic hash function based on the content provider's domain, a content item identifier unique to each content provider, the content provider's secret key, the browser's public key generated via a trust token, or a subset of the above information. For example, each content item bid may include a globally unique activity ID associated with that bid, generated using HMAC SHA-256 based on the content provider's domain and a content item identifier unique to the content provider.

[0106] Process 400 continues, whereby the data processing device uses a private key held only by the data processing device to decrypt the encrypted probability data structure encrypted with the public key corresponding to the private key (404). For example, if the encrypted Bloom filter is encrypted using the public key of privacy server 120, then privacy server 120 can decrypt the encrypted Bloom filter using its private key.

[0107] Process 400 continues, and for a given content item in the content items, the data processing device uses the decrypted probabilistic data structure to determine that the content item data of the given content item is invalid (406) because the given content item may be in the set of content items that should not be provided to the user device, as represented by the decrypted probabilistic data structure. For example, privacy server 120 may determine, based on a Bloom filter and by querying privacy server database 122, that a content item bid in the list of highest-ranking bids is associated with a content item that is not eligible to be displayed at user device 106 because the content item may be in the set represented by the Bloom filter.

[0108] In some implementations, determining that the content item data of a given content item is invalid because the given content item may be in a set of content items that should not be provided to the user device, represented by a decrypted probabilistic data structure, further includes the data processing device using a Bloom filter or other probabilities to query an encrypted database that is exclusively accessible to the data processing device, and the data processing device is a server independent of the content distribution system and the content provider, which provides (i) a set of content items that should not be provided to the user device and (ii) content items that can be provided to the user device.

[0109] In some implementations, determining that a content item bid is invalid includes determining that the Bloom filter is outdated based on a timestamp. For example, privacy server 120 may determine that the Bloom filter is outdated based on a timestamp, or it may determine that the content distribution system has over-queried the same Bloom filter based on previous query records in privacy server database 122. Privacy server 120 can then determine that the content item is not eligible to be offered to the user.

[0110] Process 400 continues, with the data processing device removing content item data (408) from the content item data for a given content item that has been determined to be invalid. For example, privacy server 120 may remove bids for content items that have been determined to be ineligible to be provided to user device 106.

[0111] Process 400 ends in response to a request to provide content to a user device, whereby the data processing device blocks the distribution of a set of one or more content items, including a given content item (410). For example, privacy server 120 selects a content item bid as the winning bid only if the content item associated with the bid is not determined to be ineligible. Therefore, privacy server 120 blocks the distribution of any content item determined to be ineligible due to frequency caps, user muting, random noise, or Bloom filter false positives. In some embodiments, blocking the distribution of a content set includes avoiding providing the user with content of a specified type. In some embodiments, blocking the distribution of a content item set includes avoiding providing the user with content items of a specified type, and each content item in the set is provided by a different content provider, such that content items of a common type from different content providers can each be blocked from being distributed to the user. For example, if privacy server 120 determines that content items related to fast food are not eligible to be provided to the user due to frequency limits, privacy server 120 can prevent other content items related to fast food from being provided to the user device 106, because more content items related to fast food may be annoying to the user, and the user may not interact with or even view the content.

[0112] Figure 5 This is a block diagram of an example computer system 500 that can be used to perform the operations described above. System 500 includes a processor 510, memory 520, storage device 530, and input / output device 540. Each of components 510, 520, 530, and 540 can be interconnected, for example, using a system bus 550. Processor 510 is capable of processing instructions that execute within system 500. In one embodiment, processor 510 is a single-threaded processor. In another embodiment, processor 510 is a multi-threaded processor. Processor 510 is capable of processing instructions stored in memory 520 or storage device 530.

[0113] Memory 520 stores information within system 500. In one embodiment, memory 520 is a computer-readable medium. In one embodiment, memory 520 is a volatile memory cell. In another embodiment, memory 520 is a non-volatile memory cell.

[0114] Storage device 530 provides high-capacity storage for system 500. In one embodiment, storage device 530 is a computer-readable medium. In various other embodiments, storage device 530 may include, for example, a hard disk drive, an optical disk drive, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other high-capacity storage device.

[0115] Input / output device 540 provides input / output operations for system 500. In one embodiment, input / output device 540 may include one or more network interface devices, such as Ethernet cards, serial communication devices, such as RS-232 ports, and / or wireless interface devices, such as 802.11 cards. In another embodiment, input / output device may include a driver device configured to receive input data and send output data to other input / output devices (e.g., keyboards, printers, and display device 560). However, other embodiments may also be used, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc.

[0116] Despite Figure 5 An example processing system is described herein, but implementations of the subjects and functional operations described herein may be carried out in other types of digital electronic circuits, or in computer software, firmware, or hardware (including the structures disclosed herein and their equivalents), or in a combination of one or more of them.

[0117] Media does not necessarily correspond to a file. Media can be stored in a section of a file that contains other documents, in a single file dedicated to the document in question, or in multiple collaborative files.

[0118] Embodiments of the subject matter and operations described in this specification may be implemented in digital electronic circuits, or in computer software, firmware, or hardware (including the structures disclosed in this specification and their equivalents), or in a combination of one or more of these. Embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more computer program instruction modules encoded on a computer storage medium (or medium) for execution by or control of the operation of a data processing apparatus. Alternatively or additionally, program instructions may be encoded on artificially generated propagated signals, such as machine-generated electrical, optical, or electromagnetic signals, generated to encode information for transmission to a suitable receiver device for execution by the data processing apparatus. The computer storage medium may be or be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these. Furthermore, while the computer storage medium is not a propagated signal, it may be a source or destination of computer program instructions encoded in artificially generated propagated signals. The computer storage medium may also be or be included in one or more separate physical components or media (e.g., multiple CDs, discs, or other storage devices).

[0119] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0120] The term "data processing apparatus" encompasses all kinds of devices, apparatuses, and machines for processing data, including, for example, programmable processors, computers, systems-on-a-chip, or a combination thereof. The apparatus may include special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. The apparatus and execution environment can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0121] Computer programs (also known as programs, software, software applications, scripts, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as standalone programs or as modules, components, subroutines, objects, or other units suitable for use in a computing environment. A computer program may, but does not need to, correspond to a file in a file system. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple collaborative files (e.g., a file storing one or more modules, subroutines, or code portions). A computer program can be deployed to execute on a single computer or on multiple computers located in one location or distributed across multiple locations and interconnected through a communication network.

[0122] The processes and logic flows described in this specification can be executed by one or more programmable processors that execute one or more computer programs to perform actions by manipulating input data and generating outputs. The processes and logic flows can also be executed by special-purpose logic circuitry, and the apparatus can be implemented as special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits).

[0123] For example, processors suitable for executing computer programs include general-purpose and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include, or be operatively coupled to, one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, to receive data from or transfer data to, or both. However, a computer does not need to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), and so on. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; disks such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM discs. The processor and memory can be supplemented or incorporated by dedicated logic circuitry.

[0124] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and pointing device (e.g., a mouse or trackball) that the user can use to provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.

[0125] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes back-end components (e.g., as a data server), or middleware components (e.g., an application server), or front-end components (e.g., a client computer having a graphical user interface or web browser through which a user can interact with embodiments of the subject matter described in this specification), or any combination of one or more such back-end, middleware, or front-end components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., self-organizing peer-to-peer networks).

[0126] A computing system may include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship arises from computer programs running on their respective computers and involves a client-server relationship. In some embodiments, the server sends data (e.g., HTML pages) to a client device (e.g., to display data to a user interacting with the client device and to receive user input from that user). Data generated at the client device (e.g., the result of user interaction) can be received from the client device at the server.

[0127] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope that may be claimed, but rather as descriptions of features specific to particular embodiments of a particular invention. Certain features described in this specification within the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations, and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation of a sub-combination.

[0128] Similarly, although operations are described in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order or sequence shown, or requiring all illustrated operations to be performed to obtain the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0129] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions described in the claims can be performed in a different order and the desired result can still be obtained. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing may be advantageous.

Claims

1. A computer-implemented method, comprising: A data processing device receives a message from a content distribution system, the message including (i) a probabilistic data structure representing a set of content items that should not be provided to a user device, (ii) content item data of content items that can be provided to the user device, and (iii) a request to determine whether any content item data is invalid based on the probabilistic data structure, wherein the content item data of each of the content items includes a globally unique activity identifier, and the globally unique activity identifier is encrypted using a browser-specific private key of the user device, wherein the set of content items that should not be provided to the user device represented by the probabilistic data structure contains randomly selected noise; For a given content item, the data processing device uses the probabilistic data structure to determine that the content item data for the given content item is invalid because the given content item may be in the set of content items that should not be provided to the user device, as represented by the probabilistic data structure. This includes: The data processing device removes the content item data of the given content item that is determined to be invalid from the content item data; and In response to a request to provide content to the user equipment, the data processing device blocks the distribution of a set of one or more content items, including the given content item.

2. The method of claim 1, wherein determining that the content item data of the given content item is invalid because the given content item may be in the set of content items that should not be provided to the user device, as represented by the probability data structure, further comprises: The data processing device queries (i) the probability data structure, which provides a set of content items that should not be presented to the user device, and (ii) the content items that can be presented to the user device; and The data processing device is a server independent of the content distribution system and the content provider, which provides (i) a set of content items that should not be provided to the user device and (ii) content items that can be provided to the user device.

3. The method according to claim 1 or 2, further comprising: The data processing device decrypts the probability data structure using a private key held only by the data processing device. The probability data structure is encrypted using a public key corresponding to the private key.

4. The method of claim 1 or 2, wherein the probability data structure is a Bloom filter, the Bloom filter being specific to one of the following: the user device, a webpage, a publisher's website, or a request to provide content to the user device.

5. The method of claim 1 or 2, wherein preventing the distribution of the content item set includes avoiding providing users with content items of a specified type.

6. The method of claim 1 or 2, wherein the content item data of each of the content items includes a globally unique identifier generated using a hash function based on at least one of the following: the domain of the content provider, a content item identifier unique within each content provider, the secret key of the content provider, and the public key of the browser generated via a trust token.

7. A distributed computing system, comprising: One or more processors; and One or more memory elements, including instructions that, when executed, cause the one or more processors to perform operations, said operations including: The one or more processors receive a message from a content delivery system, the message including (i) a probabilistic data structure representing a set of content items that should not be provided to a user device, (ii) content item data of content items that can be provided to the user device, and (iii) a request to determine whether any content item data is invalid based on the probabilistic data structure, wherein the content item data of each of the content items includes a globally unique activity identifier, and the globally unique activity identifier is encrypted using a browser-specific private key of the user device, wherein the set of content items that should not be provided to the user device represented by the probabilistic data structure contains randomly selected noise; For a given content item, the one or more processors determine using the probabilistic data structure that the content item data for the given content item is invalid because the given content item may be in the set of content items that should not be provided to the user device, as represented by the probabilistic data structure. This includes: The one or more processors remove content item data from the content item data that has been determined to be invalid for the given content item; and In response to a request to provide content to the user equipment, the one or more processors may block the distribution of a set of one or more content items, including the given content item.

8. The distributed computing system of claim 7, wherein determining that the content item data of the given content item is invalid because the given content item may be in the set of content items that should not be provided to the user device, as represented by the probabilistic data structure, further comprises: The one or more processors query an encrypted database that can be exclusively accessed by the data processing device; and The one or more processors therein are servers independent of the content distribution system and the content provider, which provides (i) a set of content items that should not be provided to the user device, and (ii) content items that can be provided to the user device.

9. The distributed computing system according to claim 7 or 8, further comprising: The probability data structure is decrypted by the one or more processors using a private key held solely by the one or more processors. The probability data structure is encrypted using a public key corresponding to the private key.

10. The distributed computing system of claim 7 or 8, wherein the probabilistic data structure is a Bloom filter, the Bloom filter being specific to one of the following: the user device, a webpage, a publisher's website, or a request to provide content to the user device.

11. The distributed computing system of claim 7 or 8, wherein preventing the distribution of a set of content items includes avoiding providing users with content items of a specified type.

12. The distributed computing system of claim 7 or 8, wherein the content item data of each of the content items includes a globally unique identifier generated using a hash function based on at least one of the following: the domain of the content provider, a content item identifier unique within each content provider, the secret key of the content provider, and the public key of the browser generated by a trust token.

13. A non-transitory computer storage medium encoded with instructions, which, when executed by a distributed computing system, cause the distributed computing system to perform operations, the operations including: One or more processors receive a message from a content delivery system, the message including (i) a probabilistic data structure representing a set of content items that should not be provided to a user device, (ii) content item data of content items that can be provided to the user device, and (iii) a request to determine whether any content item data is invalid based on the probabilistic data structure, wherein the content item data of each of the content items includes a globally unique activity identifier, and the globally unique activity identifier is encrypted using a browser-specific private key of the user device, wherein the set of content items that should not be provided to the user device represented by the probabilistic data structure contains randomly selected noise; For a given content item, the one or more processors determine using the probabilistic data structure that the content item data for the given content item is invalid because the given content item may be in the set of content items that should not be provided to the user device, as represented by the probabilistic data structure. This includes: The one or more processors remove content item data from the content item data that has been determined to be invalid for the given content item; and In response to a request to provide content to the user equipment, the one or more processors may block the distribution of a set of one or more content items, including the given content item.

14. The non-transitory computer storage medium of claim 13, wherein determining that the content item data of the given content item is invalid because the given content item may be in a set of content items that should not be provided to the user device, as represented by the probabilistic data structure, further comprises: The one or more processors query an encrypted database that can be exclusively accessed by the data processing device; and The one or more processors therein are servers independent of the content distribution system and the content provider, which provides (i) a set of content items that should not be provided to the user device, and (ii) content items that can be provided to the user device.

15. The non-transitory computer storage medium according to claim 13 or 14, further comprising: The probability data structure is decrypted by the one or more processors using a private key held solely by the one or more processors. The probability data structure is encrypted using a public key corresponding to the private key.

16. The non-transitory computer storage medium according to claim 13 or 14, wherein, The probabilistic data structure is a Bloom filter, which is specific to one of the following: the user device, a webpage, a publisher's website, or a request to provide content to the user device.

17. The non-transitory computer storage medium of claim 13 or 14, wherein preventing the distribution of the content item set includes avoiding providing the user with content items of a specified type.

Images