Privacy preserving data processing for content distribution

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for distributing digital content to client devices are described. For each of a plurality of client devices, the system receives a digital component request, identifies one or more user attributes of a user based on the digital component request, and sends the identified user attributes to the client devices. The system obtains accumulated user attribute data from the shared storage of each client device and generates an aggregated user attribute report for a set of aggregation keys using the obtained accumulated user attribute data. The system distributes the digital components to the client devices based on distribution parameters adjusted according to the aggregated user attribute reports.

Description

Technical Field

[0001] This specification relates generally to data processing, data privacy, and data security. Background Art

[0002] In systems and devices connected to public networks such as the Internet, data security and user privacy are of paramount importance. The enhancement of user privacy has led many developers to change the way they handle user data. For example, some browsers are planning to stop using third-party cookies. Summary of the invention

[0003] This specification describes methods, computer systems, and apparatus, including computer programs encoded on computer storage media, for generating and processing non-identifying user data in a privacy-preserving manner to select and provide digital content to client devices.

[0004] In one innovative aspect, the present specification describes a method for distributing a digital component to a client device. The method can be implemented by a system including one or more computers.

[0005] For each of a plurality of client devices, a system receives a digital component request from an application running on a client device of a user. The system identifies one or more user attributes of the user based on the digital component request. The system sends a digital component response to the application, the digital component response including (i) one or more digital components and (ii) attribute data including the one or more user attributes of the user, wherein the application is configured to update accumulated user attribute data stored in a shared storage area of ​​the client device based on the one or more user attributes in response to receiving the attribute data. The system obtains the accumulated user attribute data stored in the shared storage area of ​​each of the plurality of client devices from the shared storage area of ​​each of the plurality of client devices. The system generates an aggregated user attribute report for one or more aggregation keys using the obtained accumulated user attribute data, including obtaining an aggregated data profile for each of the one or more aggregation keys, the aggregated data profile being generated by aggregating accumulated user attribute data from a subset of client devices that have accessed an electronic resource or digital component identified by the aggregation key. The system adjusts one or more distribution parameters for distributing the digital component to the client device in response to the digital component request based on the aggregated data profile. The system distributes the digital component to the client device based on the distribution parameters. Other implementations of this aspect include corresponding apparatus, systems, and computer programs configured to perform aspects of the method, encoded on computer storage devices.

[0006] These and other implementations may each optionally include one or more of the following features. In some implementations, to generate an aggregated user attribute report, the system sends an aggregation request to a secure aggregation system, the aggregation request including the accumulated user attribute data obtained from each of the client devices and one or more aggregation keys; and receives from the secure aggregation system an aggregated data profile generated in response to the aggregation request. The accumulated user attribute data received from each client device may be encrypted by the client device using an encryption key of the secure aggregation system.

[0007] In some implementations, the digital component request includes contextual data related to an environment in which the one or more digital components are to be displayed at the client device. The environment may include an electronic resource and the contextual data may include: a resource locator of the electronic resource in which the one or more digital components are to be displayed at the client device; and / or a subject matter of the content of the electronic resource.

[0008] In some implementations, one or more user attributes are identified using a predictive model that is configured to predict attributes of a user who has accessed an electronic resource or a subject of content of an electronic resource. The application may be configured to: in response to receiving the user attributes identified using the predictive model, determine whether the accumulated user attribute data stored in a shared storage area of ​​the client device includes a key entry for the one or more user attributes; in response to the accumulated user attribute data not including the key entry, generate a new key entry in the accumulated user attribute data, and assign an entry value to the new key entry based on the one or more user attributes identified using the predictive model; and in response to the accumulated user attribute data including the key entry, update a current entry value of the key entry in the accumulated user attribute data based on the one or more user attributes identified using the predictive model. To update the current entry value of the key entry, the application may be configured to increase or decrease the current entry value of the key entry in response to the accumulated user attribute data including the key entry.

[0009] In some implementations, a user subscribes to an electronic resource using a user identifier, and one or more user attributes are identified using a user profile associated with the user identifier. The application may be configured to: in response to receiving the user attributes identified using the user profile, determine whether the accumulated user attribute data stored in the shared storage area of ​​the client device includes a key entry for the one or more user attributes; in response to the aggregated user attribute data not including the key entry, generate a new key entry in the accumulated user attribute data, and assign an entry value to the new key entry based on the one or more user attributes identified using the user profile; and in response to the accumulated user attribute data including the key entry, update the entry value of the key entry in the accumulated user attribute data based on the one or more user attributes identified using the user profile. The user interface of the electronic resource may include code for causing the application to update the accumulated user attribute data based on the user attributes in response to receiving the one or more user attributes.

[0010] In some implementations, the aggregated profile of the aggregation key includes one or more metrics of the electronic resource or digital component identified by the aggregation key. The one or more metrics may include a reach metric that measures the number of individual users in a subset of client devices that have accessed the electronic resource or digital component identified by the aggregation key.

[0011] In some implementations, to aggregate user attribute data from a subset of client devices, the system adds random noise to the user attribute data of each client device in the subset of client devices prior to aggregation.

[0012] Particular embodiments of the subject matter described in this specification can be implemented to achieve one or more of the following advantages: A content distribution system can utilize user attribute data of a group of users (e.g., users who have visited a particular electronic resource (e.g., a website) or digital component (e.g., a video / audio clip, image, or text)) to guide the selection and distribution of content to other users, for example, to distribute content that best suits the interests or needs of the users.

[0013] Historically, third-party cookies (e.g., cookies from a domain different from the resource rendered by the client device) have been used to collect data from the client device across the Internet. For example, a third-party cookie can be a script file from a website other than the website currently visited by the client device, which is often used to track user behavior and / or provide digital content to the user. Due to increasing concerns about user privacy and data protection, some browsers and device platforms block the use of third-party cookies, and third-party cookies are increasingly being discontinued, thereby preventing the use of third-party cookies to collect data. This poses a challenge when trying to use the collected data to enhance the online browsing experience (e.g., by selecting content related to the user based on data collected using third-party cookies). In other words, if third-party cookies are not used, much of the data previously collected will no longer be available, which makes it impossible for the computing system to use the data to predict the user's interests or attributes based on the activities performed by the user at a particular web page or other resource, thereby failing to enhance the user's online experience and / or present relevant content to the user.

[0014] The technology described herein can solve the obstacles that may arise from eliminating third-party cookies. Specifically, this specification describes a technology for obtaining privacy-preserving user attribute data from a shared storage area of ​​a client device. The shared storage area of ​​the client device maintains accumulated user attribute data that characterizes the attributes and / or interests of the user of the client device, and updates the accumulated user attribute data based on user attribute signals received from a content distribution system or a content providing system. A computer system (e.g., a secure server) can collect accumulated user attribute data from a client device without using third-party cookies. The computer system can generate an aggregated user attribute report based on the user attribute data, and the content distribution system can use the aggregated user attribute report to guide the distribution of digital components.

[0015] By using these technologies, a content distribution system can effectively utilize user attribute data of a group of users to guide the selection of content and distribute the content to specific users without the use of third-party cookies. Instead of using third-party cookies, the described technology uses a shared storage area of ​​a client device to maintain and utilize privacy-protected user attribute data. The shared storage area provides a framework that enables sharing of data across multiple sessions and / or multiple instances of accessing electronic resources (e.g., websites) and / or sharing of data across different electronic resources. The shared storage area can also implement measures to protect the security and privacy of the stored data. These technologies also provide user privacy protection for the process of collecting user attribute data by preventing the collection and use of sensitive information (e.g., personally identifiable information) of the user without the user's consent.

[0016] The details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the following description. Other features, aspects, and advantages of the subject matter will become apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a block diagram of an example environment in which a digital component distribution system distributes digital components to client devices.

[0018] Figure 2 is a swim lane diagram of an example process for distributing a digital component for display at a client device.

[0019] Figure 3 is a flow diagram of an example process for distributing a digital component for display at a client device.

[0020] Figure 4 is a block diagram of an example computer system.

[0021] Like reference numbers and designations refer to like elements throughout the various drawings. DETAILED DESCRIPTION

[0022] In general, the present specification describes systems and techniques for providing digital content (e.g., digital components) to client devices in a manner that protects user privacy. A server can be configured to obtain accumulated user attribute data from client devices and use the obtained user attribute data to generate an aggregated user attribute report. A digital component distribution system can use the aggregated user attribute report to adjust distribution parameters for distributing digital components to client devices in response to digital component requests.

[0023] In addition to the description throughout this document, controls (e.g., user interface elements with which the user can interact) may be provided to the user to allow the user to make choices about whether and when the systems, programs, or features described herein may allow the collection of user information (e.g., information about the user's social network, social actions or activities, occupation, the user's preferences, or the user's current location) and whether to send content or communications from a server to the user. In addition, certain data may be processed in one or more ways before it is stored or used so that personally identifiable information is removed. For example, the user's identity may be processed so that personally identifiable information of the user cannot be determined, or the user's geographic location from which location information is obtained may be generalized (such as to a city, zip code, or state level) so that the user's specific location cannot be determined. Thus, the user can control what information is collected about the user, how the information is used, and what information is provided to the user.

[0024] Figure 11 is a block diagram of an example environment 100 in which a digital component distribution system 150 distributes digital components to client devices 110. Environment 100 includes a data communication network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. Data communication network 105 connects client devices 110 to digital component distribution system 150. Network 105 can also connect digital component distribution system 150 digital component providers, such as 160-1, 160-2, and 160-3.

[0025] A website 140 is one or more electronic resources associated with a domain name and hosted by one or more servers. An example website is a collection of web pages formatted in HTML that may contain text, images, multimedia content, and programming elements such as scripts. Each website 140 is maintained by a publisher 130, which is an entity that controls, manages, and / or owns the website 140.

[0026] Electronic resources are also referred to herein as resources. In this specification, resources may include HTML pages, word processing documents and portable document format (PDF) documents, images, videos, and feed sources, to name a few. Resources may include content, such as words, phrases, images, and sounds, which may include embedded information (such as meta information in hyperlinks) and / or embedded instructions (such as scripts). Resources may be identified by a resource address (e.g., a uniform resource locator (URL)) associated with the resource.

[0027] The client device 110 is an electronic device capable of communicating over the network 105. Example client devices 110 include personal computers, server computers, mobile communication devices (e.g., mobile phones and / or tablet computers), and other devices that can send and receive data over the network 105. The client device may also include a digital assistant device that accepts audio input through a microphone and outputs audio output through a speaker. When the digital assistant detects a "hot word" or "hot phrase" that activates the microphone to accept audio input, the digital assistant may be placed in a listening mode (e.g., ready to accept audio input). The digital assistant device may also include a camera and / or a display to capture images and present information visually. The digital assistant may be implemented in different forms of hardware devices, including a wearable device (e.g., a watch or a pair of glasses), a smart phone, a speaker device, a tablet device, or another hardware device. The client device may also include a digital media device, such as a streaming device that is plugged into a television or other display to stream video to a television, a gaming device, or a virtual reality system.

[0028] A game device is a device that enables a user to participate in a game application, for example, in which a user controls one or more characters, avatars, or other rendered contents presented in a game application. A game device typically includes a computer processor, a memory device, and a controller interface (physical or visually rendered) that enables a user to control the contents rendered by the game application. The game device can store and execute game applications locally, or execute game applications (e.g., online game applications) that are at least partially stored and / or provided by a cloud server. Similarly, the game device can be docked with a game server that executes the game application and "streams" the game application to the game device. The game device can be a tablet device, a mobile telecommunications device, a computer, or another device that performs other functions in addition to executing the game application.

[0029] The client device 110 may include applications 112, such as a web browser and / or native applications, to facilitate sending and receiving data over the network 105. Native applications are applications developed for a specific platform or a specific device (e.g., a mobile device with a specific operating system). Although operations may be described as being performed by the client device 110, such operations may be performed by the application 112 running on the client device 110.

[0030] Application 112 can present electronic resources, such as web pages, application pages, or other application content, to a user of client device 110. The electronic resource may include a digital component slot for presenting a digital component with the content of the electronic resource. A digital component slot is an area of ​​an electronic resource (e.g., a web page or application page) for displaying a digital component. A digital component slot may also refer to a portion of an audio and / or video stream (which is another example of an electronic resource) for playing a digital component.

[0031] As used throughout this specification, a "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, an audio clip, a multimedia clip, an image, text, or another unit of content). A digital component may be electronically stored in a physical memory device as a single file or in a collection of files, and a digital component may take the form of a video file, an audio file, a multimedia file, an image file, or a text file and include advertising information, such that an advertisement is a type of digital component. For example, a digital component may be content that is intended to supplement the content of a web page or other resource presented by application 112. More specifically, a digital component may include digital content that is related to resource content (e.g., a digital component may relate to the same subject as the web page content, or to a related subject). The provision of a digital component may therefore supplement and generally enhance the web page or application content.

[0032] When application 112 loads a resource including a digital component slot, application 112 may generate a digital component request that requests a digital component to be displayed in the digital component slot. In some implementations, the digital component slot and / or the resource may include code (e.g., a script) that causes application 112 to request a digital component from digital component distribution system 150.

[0033] The digital component request may include contextual data that is generally considered non-sensitive. The contextual data may describe the environment in which the selected digital component will be presented. The contextual data may include, for example, coarse location information indicating the approximate location of the client device 110 sending the digital component request, the resource (e.g., a website or local application) that will be presented with the selected digital component (e.g., by including a resource locator of the resource, such as a URI or URL), the spoken language setting of the application 112 or client device 110, the number of digital component slots in which the digital component will be presented with the resource, the type of digital component slot, and / or other appropriate contextual information.

[0034] As described in more detail below, digital component distribution system 150 may identify (e.g., predict) user attributes of a user of client device 110 from which the digital component request was received based on data (e.g., contextual data) included in the digital component request. In response to the digital component response, digital component distribution system 150 may send to client device 110 attribute data specifying the user attributes identified from the digital component request.

[0035] The application 112 maintains a shared memory area 114 that stores a set of data that can be accessed and updated by the application 112. The data stored in the shared memory area 114 can have any suitable data format depending on the specific application, preferences, and / or protocols. The data stored in the shared memory area 114 can be shared across multiple sessions and / or multiple instances of the application 112. For example, the stored data can be shared by all instances of an electronic resource (e.g., a website) running in different tabs or windows of the application 112. In some implementations, the data stored in the shared memory area 114 can be shared across multiple electronic resources (e.g., multiple websites that the application has visited).

[0036] Several measures can be taken to protect the security and privacy of data stored in the shared memory area 114. For example, in some implementations, the shared memory area 114 can be in a separate portion of the storage space of the application 112. In some implementations, a separate thread of the application 112 manages the shared memory area 114 and provides access to the shared memory area 114. The separate thread can isolate the shared memory area 114 from access by other components of the application 112 and / or from access by unauthorized websites (e.g., websites that the user has not interacted with). In some implementations, the application can encrypt the data stored in the shared memory area 114 before transmitting the data to another system over the network 105.

[0037] In order to provide data to guide the selection and distribution of content for users, the data stored in shared storage area 114 may include accumulated user attribute data characterizing users of client device 110. The accumulated user attribute data may include data characterizing the interests of the user (e.g., topics of interest or hobbies) and / or data characterizing non-identifying demographic attributes of the user. As described in more detail below, application 112 (e.g., a separate thread of application 112) is configured to update the accumulated user attribute data based on the attribute data received from digital component distribution system 150.

[0038] The secure aggregation and reporting system 120 is configured to receive accumulated user attribute data from a shared storage area 114 of a plurality of client devices 110, and to generate an aggregated user attribute report for a set of aggregate keys using the accumulated user attribute data. The system 120 may be a secure server implemented using one or more computers (or other appropriate computing devices), which may be distributed across a plurality of locations. The secure system 120 may be operated and maintained by the digital component distribution system 150 or an independent trusted party (e.g., a party distinct from the user of the client device, the parties operating the digital component distribution system 150, and the digital component provider 160). For example, the secure system 120 may be operated by an industry group or a government group.

[0039] In some implementations, the security system 120 implements a secure environment, namely a shared storage worklet 122, which is configured to access the shared storage area 114 of the client device 110 to receive the accumulated user attribute data and process the accumulated user attribute data to generate an aggregated report. To provide additional security and privacy protection for user data, the shared storage worklet 122 can be a dedicated process or thread running on the security system 120 that is separate from other processes or threads of the security system 120.

[0040] The shared storage workset 122 includes an aggregation key selection engine 124 and a data aggregation engine 126. The aggregation key selection engine 124 is configured to select an aggregation key from an aggregation key list, and the data aggregation engine 126 is configured to generate an aggregated data profile by aggregating accumulated user attribute data from a subset of multiple client devices that have accessed the electronic resource or digital component identified by the aggregation key.

[0041] Digital component distribution system 150 may identify a set of digital components that are eligible to be presented to client device 110 from the full set of digital components available in content platform 150. For example, digital component distribution system 150 may select one or more digital components from digital components stored in a digital component repository and / or a set of digital components received from digital component provider 160.

[0042] The digital component repository may store the digital components received from the digital component providers and additional data (e.g., metadata) for each digital component in a database. The metadata for the digital component may include, for example, distribution criteria defining the circumstances under which the digital component is eligible to be provided to the client device 110 in response to a digital component request received from the client device 110 and / or selection parameters indicating the amount to be provided to the publisher if the digital component is displayed with the publisher's resources and / or a user interacts with it when presented. The distribution criteria and selection parameters may be characterized by one or more distribution parameters.

[0043] For example, the distribution parameters for a particular digital component may include a distribution keyword that must be matched, for example, by a term specified in a request, in order for the digital component to be eligible for presentation. In another example, the distribution criteria for a digital component may include: location information indicating in which geographic locations the digital component is eligible for presentation, user group membership data identifying a user group to which the digital component is eligible for presentation, resource data identifying resources with which the electronic resource is eligible for presentation, and / or other appropriate distribution criteria. The distribution criteria may also include negative criteria, for example, criteria indicating situations in which the digital component is not eligible (e.g., with a particular resource or in a particular location). The distribution parameters may also specify selection parameters and / or a budget for distributing particular third-party content.

[0044] As described in more detail below, distribution parameters of the digital component may be adjusted based on the aggregated user attribute report of the digital component. Digital component distribution system 150 may identify eligible digital components based on the distribution parameters and the data included in the digital component request. Digital component distribution system 150 may then select a digital component from the eligible digital components and provide the selected digital component to client device 110 for display to a user of client device 110.

[0045] Figure 2 is a swim lane flow chart of an example process 200 for distributing digital components for display at a client device. The operations of process 200 may be implemented, for example, by client device 110, security aggregation and reporting system 120 and digital component distribution system 150, one or more publishers 130, and one or more websites 140. The operations of process 200 may also be implemented as instructions stored on a computer-readable medium that may be non-transitory, and execution of the instructions by a data processing device may cause the data processing device to perform the operations of process 200.

[0046] At 212, client device 110 sends a request for an electronic resource, such as a request for a web page, to website 140. The request may include a URL for the electronic resource. At 232, website 140 sends the requested electronic resource to client device 110.

[0047] After receiving the requested electronic resource and while loading the electronic resource, the client device 110 generates a digital component request that requests the digital component to be displayed in the digital component slot of the electronic resource. The digital component request includes context data that describes the environment in which the selected digital component will be presented. For example, the context data can identify the electronic resource (e.g., a website) with which the selected digital component will be presented. In a specific example, the context data can include the URL or URI of the electronic resource. The context data can include, for example, rough location information indicating the approximate location of the client device 110, the spoken language setting of the client device 110, the number of digital component slots in which the digital component will be presented with the resource, the type of digital component slot, and / or other appropriate context information.

[0048] At 214, client device 110 sends the digital component request to digital component distribution system 150. Digital component distribution system 150 selects a digital component based on the digital component request at 251a and identifies one or more user attributes of the user based on the digital component request at 251b.

[0049] In some implementations, the digital component distribution system 150 uses a predictive model (e.g., a trained machine learning model) to identify user attributes based on contextual data in the digital component request. For example, the predictive model can be configured to predict attributes of users who have visited the electronic resource or the subject of the content of the electronic resource. The digital component distribution system 150 can use the predictive model to process inputs specifying the subject of the electronic resource and / or the content of the electronic resource, and generate outputs including predictions of user attributes of the user, such as the user interests of the user (e.g., topics of interest), demographic attributes of the user, and / or other characteristics of the user who have visited the electronic resource or the subject of the content of the electronic resource. The user attributes and / or other characteristics predicted by the predictive model can be used to indicate attributes of the user of the client device 110. In some implementations, the predictive model can also output a numerical value of the likelihood that the user has the predicted user attributes.

[0050] In some other implementations, when a user logs into an electronic resource using a user identifier, digital component distribution system 150 may, with the user's permission, obtain user attribute data associated with a user profile identified by the user identifier. For example, the user profile may specify or indicate user interests, demographic attributes, and / or other characteristics of the user. Digital component distribution system 150 may identify such information from the user profile.

[0051] At 252, digital component distribution system 150 sends a response to client device 110. The response includes the selected digital component and attribute data specifying user attributes of the user (eg, user attributes identified based on output of a predictive model and / or user attributes identified based on a user profile).

[0052] In response to receiving the attribute data, at 216 , client device 110 updates accumulated user attribute data stored in a shared memory area of ​​client device 110 based on the user attributes specified by the attribute data.

[0053] In some implementations, when a user attribute has been identified based on contextual data using a predictive model, the client device 110 may determine whether the accumulated user attribute data stored in the shared storage area includes a key entry for the identified user attribute. If the accumulated user attribute data does not include the key entry, the client device 110 may generate a new key entry for the identified user attribute and assign an entry value to the new key entry. On the other hand, if the accumulated user attribute data does include the key entry, the client device 110 may update the current entry value of the key entry based on the user attribute identified using the predictive model. For example, when updating the current entry value of a key entry, the client device 110 may increase or decrease the current entry value of the key entry.

[0054] In an illustrative example, a first digital component request received from client device 110 may include context data identifying a first electronic resource as "example.com / / vegetablefertilizer / ". The predictive model may output a prediction that a user visiting this webpage has a 60% chance of being interested in gardening. Client device 110 may generate a key entry for "interested in gardening" and assign a value of 0.6 to the entry. A second digital component request received from client device 110 may include context data identifying a second electronic resource as "example.com / gardendesign / ". The predictive model may output a prediction that a user visiting this webpage has an 80% chance of being interested in gardening. Client device 110 may update the value of the key entry "interested in gardening" by increasing the value of the entry by 0.8. The value of a key entry may be cumulatively updated based on predicted user attributes related to the key entry.

[0055] In some other implementations, when user attributes have been identified using user profile data associated with the user identifier, the client device 110 may generate or update a key entry for one or more of the identified user attributes. For example, if the user profile data specifies or indicates that the user is interested in gardening, the client device 110 may generate a key entry for "interested in gardening" and assign the entry a value of 1. If the user profile data specifies or indicates that the user is not interested in gardening, the client device 110 may assign the entry for "interested in gardening" a value of 0.

[0056] In some implementations, when the electronic resource is presented at the client device 110, the user interface for presenting the electronic resource includes script code that causes an application of the client device 110 to update the accumulated user attribute data based on the user attributes identified using the user profile.

[0057] At 221, the security aggregation and reporting system 120 obtains the accumulated user attribute data from the shared storage area of ​​the client device 110. The above process, including 212, 232, 214, 251a, 251b, 252 and 216, may be repeatedly performed for multiple client devices 110, and the security aggregation and reporting system 120 obtains the accumulated user attribute data from each of the multiple client devices 110.

[0058] At 222 , the security aggregation and reporting system 120 uses the obtained accumulated user attribute data to generate an aggregated user attribute report that includes a corresponding aggregated data profile for each of a set of selected aggregation keys.

[0059] System 120 can select an aggregation key based on context signals such as a specific resource locator, a specific digital component, a specific geographic region, and / or a specific device type. For example, the aggregation key can be in the form of <URL, region, device type>. In another example, the aggregation key can be in the form of <digital component identifier, region, device type>. Other suitable signals can also be used. The aggregation key can include a combination of context signals, topics, and / or other suitable signals. In a specific example, the aggregation key can be <example.com / flowers, Canada, smartphone>. The aggregated profile for this key will include data related to a subset of users who have accessed example.com / flowers from a smartphone located in Canada.

[0060] System 120 can select an aggregation key from a list of candidate aggregation keys. The list of candidate aggregation keys can be configured by various entities such as the digital component distribution system 150 and / or the publisher 130 of digital content. The digital component distribution system 150 and / or the publisher 130 can provide configuration data to System 120 that defines the list of candidate aggregation keys. The configuration data can also define, for each candidate aggregation key, the type of data to be included in the aggregated profile of the aggregation key. For example, the configuration data can specify that the aggregated profile of a candidate aggregation key will include, for each of a plurality of user attributes, a count of the number of users or a percentage of users having that user attribute whose data was aggregated for the aggregation key. Many combinations of data types can be included in the aggregated profile.

[0061] Once an aggregation key is selected, System 120 can identify a subset of client devices, and the cumulative user attributes from the subset of client devices will be used to generate the aggregated profile of the selected aggregation key. For example, the subset of client devices can be the client devices that have accessed the electronic resource or digital component identified by the aggregation key. The selection of the subset of client devices can also be based on user permission settings. As described above, for each client device, a user can be provided with controls (e.g., user interface elements with which the user can interact) that allow the user to make choices regarding whether and when the system, program, or feature can be allowed to collect user information and how such information can be used.

[0062] In some implementations, before and / or during generating the aggregated profile using the cumulative user attribute data from the subset of client devices, System 120 can apply privacy protection techniques to the cumulative user attribute data. These techniques can include anonymizing the data for each user, e.g., by removing any user identifiers from the data, applying k-anonymity techniques, and / or applying differential privacy techniques to the aggregated data.

[0063] For each selected aggregation key, system 120 generates an aggregated profile by aggregating the cumulative user attribute data obtained from the identified subset of client devices. As described above, the aggregated profile of an aggregation key can include various types of aggregated user data about the users whose data is aggregated for the aggregation key. For example, the aggregated profile of an aggregation key can include a count or percentage of users in a subset of client devices that have a particular attribute. In a specific example, the aggregated profile of the aggregation key <example.com / flowers, Canada, smartphone> can specify the percentage of users in the identified subset of client devices who are female, the percentage of users who are interested in gardening themes, and / or the percentage of users who are English speakers.

[0064] In some implementations, the aggregated profile of an aggregation key can include metrics calculated by system 120. For example, the aggregated profile can include a coverage metric that characterizes the total number of individual users in a group of users who have accessed a particular electronic resource, or the total number of individual users who have been provided a particular digital component. In another example, the aggregated profile can include a frequency metric that characterizes the number of times a particular digital component has been provided to the same user. In another example, the aggregated profile can include an attribution metric that quantifies, for a subset of client devices that have been provided a particular digital component, the number of digital component impressions that have led to a particular behavior (e.g., conversion) such as user interaction with the provided digital component, user registration, purchase, etc.

[0065] At 224a, system 120 sends the aggregated user attribute report to digital component distribution system 150. System 120 can also send at least a portion of the aggregated user attribute report to publisher 130 or website 140 (at 224b). For example, system 120 can send the aggregated profile generated for a particular resource locator (e.g., URL) to the corresponding website 140 or publisher 130 of the resource.

[0066] At 254, digital component distribution system 150 can use the aggregated data profile in the report to adjust the distribution parameters for distributing digital components.

[0067] In an illustrative example, for an aggregate key specifying a particular resource locator (e.g., example.com / flowers), the aggregated profile may include a percentage of users that belong to a particular interest group (e.g., a group having an interest in the topic "gardening"). Distribution system 150 may determine whether the percentage of users exceeds a predefined value, and if the percentage does exceed the predefined value, distribution system 150 may add the relevant interest group to a list of groups so that the particular digital component or related digital components are eligible for presentation.

[0068] In some other examples, the distribution system 150 may adjust the distribution parameters based on the indicators included in the aggregated profile in the report. In an illustrative example, when the aggregated data profile includes a coverage indicator for a specific digital component in a specific geographic area, the distribution system 150 may determine whether the coverage indicator exceeds a predefined threshold, and if the coverage indicator exceeds the predefined threshold, the distribution system 150 may determine to remove the specific geographic area from the list of geographic areas where the specific digital component or related digital components will be provided. In another illustrative example, when the coverage indicator of the specific digital component exceeds a certain threshold and / or the frequency indicator of the specific digital exceeds a certain threshold for users in a specific interest group, the distribution system 150 may determine to add the related interest group to the group list so that the specific digital component or related digital component is eligible for presentation. In another illustrative example, when the coverage indicator of the specific digital component exceeds a certain threshold and / or the frequency indicator of the specific digital component exceeds a certain threshold, the distribution system 150 may determine to increase or decrease the selection parameters and / or budget for distributing the specific digital component or related digital components.

[0069] At 256, digital component distribution system 150 distributes the digital component to client device 110 based on the distribution parameters. Specifically, distribution system 150 may select a digital component for distribution to client device 110 in response to receiving a digital component request from a client device according to the distribution parameters that have been adjusted at 254. System 150 may then provide the digital component selected according to the updated distribution parameters to client device 110. At 216, client device 110 may then present the provided digital component, for example, through an application of client device 110.

[0070] Figure 3 is a flow chart of an example process 300 for distributing digital components for display at a client device. The operations of process 300 may be performed by a system of one or more computers, such as a server, located at one or more locations, for example, referring to Figure 1The described digital component distribution system 150 and / or security aggregation and reporting system 120, when appropriately programmed according to the present specification, may perform the process 300. The operations of the process 300 may also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of the process 300. For convenience and without loss of generality, the process 300 will be described as being performed by a data processing device (e.g., a computer system).

[0071] At 310, a data processing device receives a digital component request from an application running on a user's client device for each of a plurality of client devices. The digital component request may include contextual data related to an environment in which the digital component is to be displayed at the client device. For example, the environment may include an electronic resource and the contextual data. The contextual data may include: a resource locator (e.g., a URL) of an electronic resource in which one or more digital components are to be displayed at the client device; and / or a subject matter of the content of the electronic resource.

[0072] At 320 , the data processing apparatus identifies, for each client device, user attributes of the user based on the digital component request.

[0073] In some implementations, a predictive model is used to identify user attributes based on contextual data in a digital component request.For example, a predictive model can be configured to predict attributes of a user who has accessed an electronic resource or a subject of content of an electronic resource.

[0074] In some implementations, a user subscribes to an electronic resource using a user identifier, and user attributes are identified using a user profile associated with the user identifier.

[0075] At 330, the data processing device sends a digital component response to the application of each client device. The digital component response includes (i) one or more digital components and (ii) attribute data specifying user attributes of the user. In response to receiving the attribute data, each client device is configured to update the accumulated user attribute data stored in the shared storage area of ​​the client device based on the user attributes in the attribute data.

[0076] In some implementations, when a user attribute is identified based on contextual data using a predictive model, the application may determine whether the accumulated user attribute data stored in a shared storage area of ​​the client device includes a key entry for the user attribute. If the accumulated user attribute data does not include the key entry, the application may generate a new key entry in the accumulated user attribute data and assign an entry value to the new key entry based on the user attribute identified using the predictive model. If the accumulated user attribute data does include the key entry, the application may update the current entry value of the key entry in the accumulated user attribute data based on the user attribute identified using the predictive model. For example, to update the current entry value of the key entry, the application may increase or decrease the current entry value of the key entry.

[0077] In some implementations, when a user attribute is identified using a user profile associated with a user identifier, the application may determine whether the accumulated user attribute data stored in a shared storage area of ​​the client device includes a key entry for the user attribute. If the aggregated user attribute data does not include the key entry, the application may generate a new key entry in the accumulated user attribute data and assign an entry value to the new key entry based on the user attribute identified using the user profile. If the accumulated user attribute data does include the key entry, the application may update (e.g., replace) the entry value of the key entry in the accumulated user attribute data based on the user attribute identified using the user profile. In one example, the user interface of the electronic resource includes script code for causing the application to update the accumulated user attribute data based on the user attribute in response to receiving the user attribute.

[0078] At 340 , the data processing apparatus obtains the accumulated user attribute data from the shared storage area of ​​each client device.

[0079] At 350, the data processing device uses the obtained accumulated user attribute data to generate an aggregated user attribute report for a set of aggregate keys. Specifically, for each aggregate key, the data processing device generates an aggregated data profile by aggregating the accumulated user attribute data from a subset of client devices that have accessed the electronic resource or digital component identified by the aggregate key.

[0080] In some implementations, the aggregated profile of the aggregate key includes one or more metrics of the electronic resource or digital component identified by the aggregate key. For example, the metric may include a coverage metric that measures the number of individual users in a subset of client devices that have accessed the electronic resource or digital component identified by the aggregate key.

[0081] In some implementations, to enhance data security and privacy, before and / or during the generation of an aggregated profile using the accumulated user attribute data from a subset of client devices, the data processing device may apply privacy protection techniques to the accumulated user attribute data. These techniques may include anonymizing the data of each user, for example, by removing any user identifiers from the data, applying k-anonymity techniques, and / or applying differential privacy techniques to the aggregated data. For example, to apply a differential privacy process, the data processing device may add random noise to the user attribute data of each client device in the subset of client devices before aggregation.

[0082] In some implementations, to enhance data security and data privacy, an aggregated user attribute report may be generated by a secure aggregation system. The secure aggregation and reporting system may be a computing system separate from the digital component distribution system or a computing system that is part of the digital component distribution system. If the secure aggregation and reporting system is a computing system separate from the digital component distribution system, the digital component distribution system may send an aggregation request to the secure aggregation and reporting system. The aggregation request includes the accumulated user attribute data received from each client device and the set of aggregation keys. The accumulated user attribute data received from the client device may be encrypted by the client device using an encryption key of the secure aggregation system. After the secure aggregation and reporting system has generated the aggregated user attribute report, the digital component distribution system may receive an aggregated data profile from the secure aggregation system.

[0083] At 360, the data processing device adjusts one or more distribution parameters for distributing the digital component to the client device in response to the digital component request based on the estimated metric. For example, the data processing device can adjust keywords that must be matched, a list of geographic locations where the digital component is eligible to be provided, a list of user groups to which the digital component is eligible to be provided, parameters characterizing resources with which the digital component is eligible to be presented, and / or other appropriate distribution parameters based on the estimated metric.

[0084] At 370 , the data processing apparatus distributes the digital component to the client device based on the distribution parameters.

[0085] Figure 44 is a block diagram of an example computer system 400 that can be used to perform the operations described above. System 400 includes a processor 410, a memory 420, a storage device 430, and an input / output device 440. Each of components 410, 420, 430, and 440 can be interconnected, for example, using a system bus 450. Processor 410 is capable of processing instructions for execution within system 400. In some implementations, processor 410 is a single-threaded processor. In another implementation, processor 410 is a multi-threaded processor. Processor 410 is capable of processing instructions stored in memory 420 or on storage device 430.

[0086] Memory 420 stores information within system 400. In one implementation, memory 420 is a computer readable medium. In some implementations, memory 420 is a volatile memory unit. In another implementation, memory 420 is a non-volatile memory unit.

[0087] The storage device 430 can provide mass storage for the system 400. In some implementations, the storage device 430 is a computer-readable medium. In various implementations, the storage device 430 may include, for example, a hard disk device, an optical disk device, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other mass storage device.

[0088] The input / output device 440 provides input / output operations for the system 400. In some implementations, the input / output device 440 may include one or more of a network interface device (e.g., an Ethernet card), a serial communication device (e.g., an RS-232 port), and / or a wireless interface device (e.g., an 802.11 card). In another implementation, the input / output device may include a driver device configured to receive input data and send output data to an external device 460 (e.g., a keyboard, a printer, and a display device). However, other implementations may also be used, such as a mobile computing device, a mobile communication device, a set-top TV client device, etc.

[0089] Although in Figure 4 An example processing system is described in the specification, but the subject matter and implementation of the functional operations described in this specification may be implemented in other types of digital electronic circuit systems or in computer software, firmware or hardware (including the structures disclosed in this specification and their structural equivalents), or in a combination of one or more of them.

[0090] The subject matter and the embodiments of the operation described in this specification may be implemented in a digital electronic circuit system or in computer software, firmware or hardware (including the structures disclosed in this specification and their structural equivalents), or in a combination of one or more of them. The embodiments of the subject matter described in this specification may be implemented as one or more computer programs, that is, one or more modules of computer program instructions, which are encoded on a computer storage medium (or multiple computer storage media) for data processing equipment to execute or control the operation of data processing equipment. Alternatively or additionally, program instructions may be encoded on an artificially generated propagation signal (e.g., a machine-generated electrical, optical or electromagnetic signal), which is generated to encode information for transmission to a suitable receiver device for data processing equipment to execute. The computer storage medium may be a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of them, or be included in them. In addition, although the computer storage medium is not a propagation signal, the computer storage medium may be the source or destination of the computer program instructions encoded in the artificially generated propagation signal. The computer storage medium can also be, or be included in, one or more separate physical components or media (eg, multiple CDs, disks, or other storage devices).

[0091] The operations described in this specification may be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0092] The term "data processing device" covers all kinds of equipment, devices and machines for processing data, including, for example, a programmable processor, a computer, a system on a chip, or multiple or combinations of the foregoing. The device may include a dedicated logic circuit system, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In addition to hardware, the device may also include code that creates an execution environment for the computer program in question, for example, code that constitutes processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination of one or more of them. The device and the execution environment can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0093] A computer program (also referred to as a program, software, software application, script, or code) may be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and it may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but does not necessarily, correspond to a file in a file system. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or portions of code). A computer program may be deployed to execute on one computer or on multiple computers located at one site or distributed over multiple sites and interconnected by a communications network.

[0094] The processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform actions by operating on input data and generating output. The processes and logic flows can also be performed by special-purpose logic circuit systems, and the device can also be implemented as a special-purpose logic circuit system, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit).

[0095] Processors suitable for executing computer programs include, for example, both general-purpose and special-purpose microprocessors. Typically, the processor will receive instructions and data from a read-only memory or a random access memory or both. The basic elements of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more large-capacity storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or be operatively coupled to receive data from it or transmit data to it or both. However, a computer does not have to have such devices. In addition, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name a few. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, for example, semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices); magnetic disks (e.g., internal hard disks or removable disks); magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0096] To provide interaction with a user, embodiments of the subject matter described in this specification may be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user, and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices may also be used to provide interaction with the user; for example, feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user may be received in any form, including sound, voice, or tactile input. In addition, the computer may interact with the user by sending documents to and receiving documents from a device used by the user; for example, by sending a web page to a web browser on a user's client device in response to a request received from the web browser.

[0097] Embodiments of the subject matter described in this specification may be implemented in a computing system that includes a back-end component (e.g., as a data server), or includes a middleware component (e.g., an application server), or includes a front-end component (e.g., a client computer having a graphical user interface or a web browser through which a user can interact with an implementation of the subject matter described in this specification), or any combination of one or more such back-end, middleware, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LANs") and wide area networks ("WANs"), interconnected networks (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks).

[0098] A computing system may include a client and a server. The client and server are usually remote from each other and typically interact through a communication network. The relationship of client and server is due to computer programs running on respective computers and having a client-server relationship with each other. In some embodiments, the server transmits data (e.g., an HTML page) to a client device (e.g., for the purpose of displaying data to a user interacting with the client device and receiving user input from the user). Data generated at the client device (e.g., the result of the user interaction) can be received from the client device at the server.

[0099] Although this specification contains many specific implementation details, these details should not be interpreted as limitations on the scope of any invention or the scope that may be claimed, but should be interpreted as descriptions of features that are peculiar to a particular embodiment of a particular invention. Certain features described in the context of a separate embodiment in this specification may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. In addition, although features may be described above as working in certain combinations and even initially claimed as such, one or more features from the claimed combination may be deleted from the combination in some cases, and the claimed combination may involve changes in sub-combinations or sub-combinations.

[0100] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order, or that all of the operations shown be performed, to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0101] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions set forth in the claims can be performed in different orders and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

Claims

1. A computer-implemented method comprising: For each of the plurality of client devices, receiving a digital component request from an application running on said client device of a user; identifying one or more user attributes of the user based on the digital component request; as well as sending a digital component response to the application, the digital component response comprising (i) one or more digital components and (ii) attribute data comprising the one or more user attributes of the user, wherein the application is configured to update accumulated user attribute data stored in a shared memory area of ​​the client device based on the one or more user attributes in response to receiving the attribute data; obtaining, from the shared storage area of ​​each of the plurality of client devices, the accumulated user attribute data stored in the shared storage area of ​​each client device; generating an aggregated user attribute report for one or more aggregation keys using the obtained accumulated user attribute data, including obtaining an aggregated data profile for each of the one or more aggregation keys, the aggregated data profile being generated by aggregating the accumulated user attribute data from a subset of the plurality of client devices that have accessed the electronic resource or digital component identified by the aggregation key; adjusting one or more distribution parameters for distributing the digital component to the client device in response to the digital component request based on the aggregated data profile; as well as A digital component is distributed to the client device based on the distribution parameters.

2. The method of claim 1, wherein generating the aggregated user attribute report comprises: sending an aggregation request to a secure aggregation system, the aggregation request including the accumulated user attribute data obtained from each of the plurality of client devices and the one or more aggregation keys; and The aggregated data profile generated in response to the aggregation request is received from the secure aggregation system.

3. The method of claim 2, wherein the accumulated user attribute data received from each client device is encrypted by the client device using an encryption key of the security aggregation system.

4. A method as claimed in any preceding claim, wherein the digital component request comprises contextual data relating to the environment in which the one or more digital components are to be displayed at the client device.

5. A method as claimed in claim 4, wherein the environment includes an electronic resource and the context data, the context data including one or more of the following: a resource locator of the electronic resource, the one or more digital components to be displayed in the electronic resource at the client device; or the subject matter of the content of the electronic resource.

6. A method as claimed in any preceding claim, wherein the one or more user attributes are identified using a predictive model, the predictive model being configured to predict attributes of users who have accessed the electronic resource or the subject of the content of the electronic resource.

7. The method of claim 6, wherein the application is configured to, in response to receiving the user attribute identified using the predictive model: determining whether the accumulated user attribute data stored in the shared memory area of ​​the client device includes a key entry for the one or more user attributes; In response to the accumulated user attribute data not including the key entry, generating a new key entry in the accumulated user attribute data and assigning an entry value to the new key entry based on the one or more user attributes identified using the predictive model; and In response to the accumulated user attribute data including the key entry, a current entry value of the key entry in the accumulated user attribute data is updated based on the one or more user attributes identified using the predictive model.

8. The method of claim 7, wherein updating the current entry value of the key entry comprises: In response to the accumulated user attribute data including the key entry, the current entry value of the key entry is increased or decreased.

9. The method of any one of claims 1 to 5, wherein the user subscribes to the electronic resource using a user identifier, and the one or more user attributes are identified using a user profile associated with the user identifier.

10. The method of claim 9, wherein the application is configured to, in response to receiving the user attribute identified using the user profile: determining whether the accumulated user attribute data stored in the shared memory area of ​​the client device includes a key entry for the one or more user attributes; In response to the aggregated user attribute data not including the key entry, generating a new key entry in the accumulated user attribute data and assigning an entry value to the new key entry based on the one or more user attributes identified using the user profile; and In response to the accumulated user attribute data including the key entry, the entry value of the key entry in the accumulated user attribute data is updated based on the one or more user attributes identified using the user profile.

11. The method of claim 10, wherein the user interface of the electronic resource includes code to cause the application to update the accumulated user attribute data based on the user attributes in response to receiving the one or more user attributes.

12. The method of any preceding claim, wherein the aggregated profile of an aggregate key comprises one or more indicators of the electronic resource or the digital component identified by the aggregate key.

13. The method of claim 12, wherein the one or more metrics include a coverage metric that measures the number of individual users in the subset of client devices that have accessed the electronic resource or the digital component identified by the aggregation key.

14. The method of any preceding claim, wherein aggregating the user attribute data from the subset of client devices comprises adding random noise to the user attribute data of each client device in the subset of client devices prior to aggregation.

15. A system comprising: one or more computers; as well as One or more storage devices storing instructions which, when executed by the one or more computers, cause the one or more computers to perform the operations of the corresponding method of any one of claims 1 to 14.

16. One or more computer-readable storage media storing instructions that, when executed by one or more computers, cause the one or more computers to perform the operations of the corresponding method of any one of claims 1 to 14.

Images