obsidian-vault/work/projects/cpm-extension-health-pixels-privacy-triage.md

Privacy Triage: Apple - CPM Extension Health Pixels

Status: DRAFT

Name: Alex M
Email: amartemyanov@duckduckgo.com
Objective: O-E
PR: [Add PR link]
Project: https://app.asana.com/1/137249556945/project/1163321984198618/task/1216761517055116?focus=true

Pixels

iOS pixel	Trigger	Frequency
m_debug_web_extension_cpm_initialization_failed_after_session_restore	CPM does not initialize during a restored-session navigation batch.	Daily
m_debug_web_extension_cpm_initialization_recovered_after_session_restore	CPM initializes on the next independent navigation after the restored-session batch failed.	Daily
m_debug_web_extension_cpm_messaging_stuck	CPM also fails on a later independent navigation, with no CPM success between attempts.	Daily + count, once per episode
m_debug_web_extension_cpm_messaging_recovered_without_extension_reload	A stuck episode recovers before the extension is reloaded.	Daily + count, once per episode
m_debug_web_extension_cpm_messaging_recovered_after_extension_reload	A stuck episode recovers after the app reloads the extension.	Daily + count, once per episode
m_debug_web_extension_cpm_messaging_extension_reload_failed	CPM still fails after the app reloads the extension.	Daily + count, once per episode

macOS uses the same names with the m_mac_debug_ prefix. iOS adds the standard platform and form-factor suffixes.

Only standard parameters are sent: appVersion, plus pixelSource and channel on macOS.

Detection Rules

• Check only finished, current, main-frame HTTP(S) document navigations after a grace period.
• Treat all .sessionRestoration navigations from one app launch as one batch, not one failure per restored tab.
• A redirected restoration still belongs to the restoration batch when .sessionRestoration appears in its navigation history.
• After restoration, any independent eligible document navigation can be the next attempt: reload, typed URL, link, new-tab navigation, or a real back/forward load.
• Redirects do not count separately. Same-document, failed, non-HTTP(S), and BFCache navigations do not count when CPM is not expected to initialize again.
• Any successful CPM initialization closes the episode. Pixels are fired for episode transitions, never for every failed tab.

Privacy Questions

Do the pixels use transparent names?
Yes.

Do they share parameters with other pixels?
Yes. They use only existing standard parameters.

Could the parameters link pixels to the same user?
No. No identifier is added.

Do the pixels include a URL or search query?
No. They also exclude hostnames, page titles, tab IDs, document IDs, navigation types, errors, and CPM rules.

Are the pixels temporary?
The two session-restoration pixels are temporary diagnostics. The stuck-state and recovery pixels are permanent health monitoring.

Why are the permanent pixels needed?
To measure how often CPM messaging becomes stuck and whether extension reload recovers it.

Do any parameters or suffixes fall outside the standard criteria?
No.

Do the pixels fire on sensitive user events?
No. They report only CPM extension health states.

Can occurrences be tied to the same user or a small group?
No. There is no correlation identifier or browsing data.

Does this meet the self-service criteria?
Yes.