Deprecate and remove: Private Aggregation API

at a glance

why it was removed

The Intent to Deprecate and Remove gives three reasons, verbatim in substance:

• Third-party cookies are staying. The API “was originally designed for a future without third-party cookies”; after Chrome announced the current approach to third-party cookies will be maintained, adoption was expected to decrease since cross-site measurement remains possible with cookies.
• No other engine ever adopted it. “Other browser engines have not signaled interest in launching the API” — Mozilla’s standards-position record was closed as “proposal appears stale” and WebKit’s as “proposal withdrawn”, neither recording an implementation.
• Focus. Removing this and certain other Privacy Sandbox APIs “will help focus efforts on the proposed interoperable Attribution standard” (see Privacy Sandbox feature status).

Because the API surface is only reachable from inside Shared Storage and Protected Audience worklets — both on their own removal paths (Shared Storage deprecation record, Protected Audience deprecation record) — the intent states “no additional work will be required for Private Aggregation”: its functionality is removed transitively when those host APIs go.

removal timeline

the removed surface

The whole developer-facing surface was one interface exposed on two worklet global scopes, plus the reporting pipeline it fed. The normative IDL from the final published draft (§ the exposed interface), verbatim:

[Exposed=(InterestGroupScriptRunnerGlobalScope,SharedStorageWorklet),
 SecureContext]
interface PrivateAggregation {
  undefined contributeToHistogram(PAHistogramContribution contribution);
  undefined contributeToHistogramOnEvent(DOMString event,
                                         record<DOMString, any> contribution);
  undefined enableDebugMode(optional PADebugModeOptions options = {});
};

dictionary PAHistogramContribution {
  required bigint bucket;
  required long value;
  bigint filteringId = 0;
};

dictionary PADebugModeOptions {
  required bigint debugKey;
};

what calling code sees now

Because privateAggregation was only ever exposed inside Shared Storage and Protected Audience worklets, ordinary page JavaScript cannot touch it directly — and the intent states the contexts that expose it “would still no longer be created” even in the stub-retention contingency. Inside a worklet, the removal sequence is:

1. Disablement (current staged step): with the Finch-controlled feature off, the worklet global no longer exposes privateAggregation — reading it yields undefined, and calling privateAggregation.contributeToHistogram(...) throws a TypeError (Cannot read properties of undefined). Contributions silently stop flowing; no reports are generated.
2. Host-API removal (end state): when Shared Storage and Protected Audience are themselves removed, the worklets never run at all, so the question becomes moot — see the host deprecations (Shared Storage, Protected Audience).

Defensive guard for worklet code that must survive the transition (the pattern the spec’s own callers were advised to use):

// Inside a Shared Storage or Protected Audience worklet:
if (typeof privateAggregation !== "undefined") {
  privateAggregation.contributeToHistogram({ bucket: 1n, value: 128 });
}
// After disablement/removal this is a silent no-op instead of a TypeError.

migration paths

reporting pipeline sunset

Contributions made in a worklet were encrypted into an aggregatable report and sent by the browser to a fixed endpoint on the reporting origin — .well-known/private-aggregation/report-<api>, with the aggregation service’s public keys fetched from .well-known/aggregation-service/v1/public-keys (draft — report scheduling). The full pipeline is documented on the aggregatable-reports/ child page, including which stage ended when:

• Worklet contribution — ends with the API disablement/removal described above.
• Report delivery to the origin’s .well-known endpoint — stops when no further contributions are made.
• Server-side aggregation into summary reports — already ended (late December 2025), ahead of the client-side surface (feature notes).

examples

Historical usage (from the pre-removal developer flow): a Shared Storage worklet recording a conversion bucket after reading cross-site data:

// Inside a Shared Storage worklet operation (REMOVED API — do not use):
class MeasureConversion {
  async run(data) {
    // bucket: a 128-bit id; value: a contribution amount
    privateAggregation.contributeToHistogram({ bucket: 543n, value: 1 });
  }
}
register("measure-conversion", MeasureConversion);

browser compatibility

Interim table. There is no BCD entry for PrivateAggregation (BCD api/ directory has no PrivateAggregation.json, checked 2026-07-29) and a webstatus.dev query returns zero features. Rows below are compiled from the linked primary sources, not from BCD.

security and privacy

• What the API protected: contributions were encrypted so only the trusted aggregation service could read them; individual worklet inputs were never exposed to the reporting origin in the clear, and summary reports added noise to limit cross-site identity leakage (the API’s stated purpose per the draft).
• Removal direction is privacy-positive or neutral: no new data flow is created by removal; the measurement flows that remain (third-party cookies, first-party analytics) pre-date the API. Sites that depended on the privacy properties of aggregate measurement lose that option and must re-evaluate their measurement design (see migration paths).
• Residual data: previously collected encrypted reports held by an origin’s aggregation-service deployment can no longer be processed into new summary reports once server-side computation has ended (late December 2025) — retained ciphertext has no supported decryption path (feature notes).
• Debug reports caveat: the interim debug-report path bypasses the aggregation service’s privacy protections by design (unencrypted, per-event) — acceptable only as a short migration bridge, and it ends with the API surface itself.

specifications

see also

• Chrome Platform Status — Deprecate and remove: Private Aggregation API (API record)
• blink-dev — Intent to Deprecate and Remove: Private Aggregation API
• ChromeStatus — Deprecate and Remove: Shared Storage API (host API #1)
• ChromeStatus — Deprecate and Remove Protected Audience (host API #2)
• ChromeStatus — Deprecate and remove: Attribution Reporting API (sibling consolidation removal)
• gendn — PrivateAggregation interface reference (removed surface) · gendn — aggregatable reports pipeline
• Chrome Platform Showcase — demo for this feature