related-website-sets

Does Google expect other browsers to just copy their list[0]? Or are developers supposed to submit their related domains to each browser and they all have their own list to maintain? This sounds like HSTS. [0]: https://github.com/GoogleChrome/related-website-sets/blob/ma...

I don't think so? It looks to me like you also need to follow https://github.com/GoogleChrome/first-party-sets/blob/main/F... and get your sites onto https://github.com/GoogleChrome/first-party-sets/blob/main/f...

https://github.com/WICG/first-party-sets#non-goals has: Non-goals: ... Information exchange between unrelated sites for ad targeting or conversion measurement. To get something onto the list (https://github.com/GoogleChrome/first-party-sets/blob/main/f..., currently empty) you need to make a public PR with rationale (https://github.com/GoogleChrome/first-party-sets/blob/main/F...). It doesn't look to me like DoubleClick would qualify?

[I work at Google, not on chrome, I don't have any particular insight into this feature]. From poking at https://github.com/GoogleChrome/first-party-sets/blob/main/F..., it looks like at a minimum, a given domain can only belong to one FPS, and needs to be preregistered publicly. That makes the opportunities for abuse much more limited. And the "service-domains" (intended for things like auth or CDN that want to be isolated) have some reasonably strict automated checks (github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md#subset-level-technical-validation), while you're limited to 3 "associated" domains.

First party sets are a centralized list of sites that act as one logical site. The list is gated by the browser vendor. Details here (https://github.com/GoogleChrome/first-party-sets/blob/main/F...). This is intended to deal with several technical challenges (https://github.com/WICG/first-party-sets#use-cases), such as the technical challenge that when company A buys company B, the process of fusing the auth rules so that being logged into A implies a login to B is a colossal nightmare project under first-party-only rules. So, for example, this lets Facebook declare that instagram.com is in the same FPS as facebook.com to simplify the auth story. What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them.