# Privacy Triage: Apple - CPM Extension Health Pixels

Status: **DRAFT**

**Name:** Alex M  
**Email:** amartemyanov@duckduckgo.com  
**Objective:** O-E  
**PR:** [Add PR link]  
**Project:** https://app.asana.com/1/137249556945/project/1163321984198618/task/1216761517055116?focus=true

## Pixels

| iOS pixel | Trigger | Frequency |
|---|---|---|
| `m_debug_web_extension_cpm_initialization_missed_after_session_restore` | CPM does not initialize during a restored-session navigation batch. | Daily |
| `m_debug_web_extension_cpm_initialization_recovered_after_session_restore` | CPM initializes on the next independent navigation after the restored-session batch failed. | Daily |
| `m_debug_web_extension_cpm_messaging_stuck` | CPM also fails on a later independent navigation, with no CPM success between attempts. | Daily + count, once per episode |
| `m_debug_web_extension_cpm_messaging_recovered_without_extension_reload` | A stuck episode recovers before the extension is reloaded. | Daily + count, once per episode |
| `m_debug_web_extension_cpm_messaging_recovered_after_extension_reload` | A stuck episode recovers after the app reloads the extension. | Daily + count, once per episode |
| `m_debug_web_extension_cpm_messaging_extension_reload_failed` | CPM still fails after the app reloads the extension. | Daily + count, once per episode |

macOS uses the same names with the `m_mac_debug_` prefix. iOS adds the standard platform and form-factor suffixes.

Only standard parameters are sent: `appVersion`, plus `pixelSource` and `channel` on macOS.

## Detection Rules

- Check only finished, current, main-frame HTTP(S) document navigations after a grace period.
- Treat all `.sessionRestoration` navigations from one app launch as one batch, not one failure per restored tab.
- A redirected restoration still belongs to the restoration batch when `.sessionRestoration` appears in its navigation history.
- After restoration, any independent eligible document navigation can be the next attempt: reload, typed URL, link, new-tab navigation, or a real back/forward load.
- Redirects do not count separately. Same-document, failed, non-HTTP(S), and BFCache navigations do not count when CPM is not expected to initialize again.
- Any successful CPM initialization closes the episode. Pixels are fired for episode transitions, never for every failed tab.

## Privacy Questions

**Do the pixels use transparent names?**  
Yes.

**Do they share parameters with other pixels?**  
Yes. They use only existing standard parameters.

**Could the parameters link pixels to the same user?**  
No. No identifier is added.

**Do the pixels include a URL or search query?**  
No. They also exclude hostnames, page titles, tab IDs, document IDs, navigation types, errors, and CPM rules.

**Are the pixels temporary?**  
The two session-restoration pixels are temporary diagnostics. The stuck-state and recovery pixels are permanent health monitoring.

**Why are the permanent pixels needed?**  
To measure how often CPM messaging becomes stuck and whether extension reload recovers it.

**Do any parameters or suffixes fall outside the standard criteria?**  
No.

**Do the pixels fire on sensitive user events?**  
No. They report only CPM extension health states.

**Can occurrences be tied to the same user or a small group?**  
No. There is no correlation identifier or browsing data.

**Does this meet the self-service criteria?**  
Yes.