obsidian-vault/work/projects/cpm-extension-health-pixels-privacy-triage.md

Privacy Triage: Apple - CPM Extension Health Pixels

Status: DRAFT

Name: Alex M
Email: amartemyanov@duckduckgo.com
Objective: O-E
PR: [Add PR link]
Project: https://app.asana.com/1/137249556945/project/1163321984198618/task/1216761517055116?focus=true

Pixels

Pixel	Trigger	Frequency
m_debug_web_extension_cpm_initialization_missed_after_session_restore	Restored tabs do not receive the initial CPM response.	Daily
m_debug_web_extension_cpm_initialization_recovered_after_session_restore	CPM later responds after the restoration miss.	Daily
m_debug_web_extension_cpm_initialization_failed_after_tab_crash	CPM fails on the first eligible navigation after a tab crash.	Daily + count
m_debug_web_extension_cpm_initialization_failed_after_extension_reload	CPM fails on the first eligible navigation after an extension reload.	Daily + count
m_debug_web_extension_cpm_messaging_stuck_session_restoration	Messaging remains stuck after a restoration-originated failure.	Daily + count, once/episode
m_debug_web_extension_cpm_messaging_stuck_tab_crash	Messaging remains stuck across attempts associated with a tab crash.	Daily + count, once/episode
m_debug_web_extension_cpm_messaging_stuck_other	Messaging remains stuck across other independent navigations.	Daily + count, once/episode
m_debug_web_extension_cpm_messaging_recovered_without_extension_reload	A stuck episode recovers without an extension reload.	Daily + count, once/episode
m_debug_web_extension_cpm_messaging_recovered_after_extension_reload	A stuck episode recovers after an extension reload.	Daily + count, once/episode
m_debug_web_extension_cpm_messaging_extension_reload_failed	Reload fails or CPM remains stuck after reload.	Daily + count, once/episode

iOS and macOS send the exact same pixel names. Parameters distinguish platform=ios|macos and form_factor=phone|tablet|desktop. appVersion is included; macOS also includes pixelSource and channel.

Detection Rules

• Check only finished, current, main-frame HTTP(S) document navigations after a grace period.
• Treat all .sessionRestoration navigations from one app launch as one batch, not one failure per restored tab.
• A redirected restoration still belongs to the restoration batch when .sessionRestoration appears in its navigation history.
• After restoration, any independent eligible document navigation can be the next attempt: reload, typed URL, link, new-tab navigation, or a real back/forward load.
• Redirects do not count separately. Same-document, failed, non-HTTP(S), and BFCache navigations do not count when CPM is not expected to initialize again.
• A tab crash marks only the next eligible navigation in that tab.
• A successful extension reload marks only the next eligible CPM attempt.
• stuck retains the strongest contributing reason: tab crash, then session restoration, then other.
• Any successful CPM initialization closes the episode. Pixels are fired for episode transitions, never for every failed tab.

Privacy Questions

Do the pixels use transparent names?
Yes.

Do they share parameters with other pixels?
Yes. They use platform and form_factor to combine both apps under the same pixel names.

Could the parameters link pixels to the same user?
No. Both parameters are coarse enums and contain no identifier.

Do the pixels include a URL or search query?
No. They also exclude hostnames, page titles, tab IDs, document IDs, navigation types, errors, and CPM rules.

Are the pixels temporary?
The session-restoration and post-crash/reload pixels are diagnostics. The stuck-state and recovery pixels are permanent health monitoring.

Why are the permanent pixels needed?
To measure how often CPM messaging becomes stuck and whether extension reload recovers it.

Do any parameters or suffixes fall outside the standard criteria?
platform and form_factor are explicit enum parameters used instead of platform-specific pixel names.

Do the pixels fire on sensitive user events?
No. They report only CPM extension health states.

Can occurrences be tied to the same user or a small group?
No. There is no correlation identifier or browsing data.

Does this meet the self-service criteria?
Yes.