obsidian-vault/work/projects/cpm-extension-health-pixels-privacy-triage.md

Privacy Triage: Apple - CPM Extension Health Pixels

Status: DRAFT

Name: Alex M
Email: amartemyanov@duckduckgo.com
Objective: O-E
PR: [Add PR link]
Project: https://app.asana.com/1/137249556945/project/1163321984198618/task/1216761517055116?focus=true

Pixels

Pixel	Trigger	Frequency
debug_web_extension_cpm_initialization_failed_after_session_restoration	CPM fails after a restored-page navigation.	Daily
debug_web_extension_cpm_initialization_failed_after_tab_crash	CPM fails on the first eligible navigation after a tab crash.	Daily
debug_web_extension_cpm_initialization_failed_after_extension_reload	CPM fails on the first eligible navigation after an extension reload.	Daily
debug_web_extension_cpm_initialization_failed_after_other	CPM fails after another eligible navigation.	Daily
debug_web_extension_cpm_messaging_stuck_session_restoration	Messaging remains stuck after a restoration-originated failure.	Daily + count, once/episode
debug_web_extension_cpm_messaging_stuck_tab_crash	Messaging remains stuck across attempts associated with a tab crash.	Daily + count, once/episode
debug_web_extension_cpm_messaging_stuck_other	Messaging remains stuck across other independent navigations.	Daily + count, once/episode
debug_web_extension_cpm_messaging_recovered_without_extension_reload	A failed tab or stuck episode recovers without an extension reload.	Daily + count, once/episode
debug_web_extension_cpm_messaging_recovered_after_extension_reload	A failed tab or stuck episode recovers after an extension reload.	Daily + count, once/episode
debug_web_extension_cpm_messaging_extension_reload_failed	CPM still fails after a successful extension reload.	Daily + count, once/episode

iOS and macOS send the exact same pixel names. Parameters distinguish platform=ios|macos and form_factor=phone|tablet|desktop. appVersion is included; macOS also includes pixelSource and channel.

Detection Rules

• Check only finished, current, main-frame HTTP(S) document navigations after a grace period. A failure means the extension is loaded and the dashboard remains .waiting; cpmStage is diagnostic data, not part of detection.
• A redirected restored-page navigation remains classified as session restoration.
• After restoration, any independent eligible document navigation can be the next attempt: reload, typed URL, link, new-tab navigation, or a real back/forward load.
• Redirects do not count separately. Same-document, failed, non-HTTP(S), and BFCache navigations do not count when CPM is not expected to initialize again.
• A tab crash marks only the next eligible navigation in that tab.
• A successful extension reload marks only the next eligible CPM attempt.
• stuck keeps the reason of the first initialization failure; a later failure does not replace it.
• Any successful CPM initialization breaks the failure sequence. Recovery is reported when that success belongs to a previously failed tab or follows a stuck state.

Privacy Questions

Do the pixels use transparent names?
Yes.

Do they share parameters with other pixels?
Yes. They use platform and form_factor to combine both apps under the same pixel names.

Could the parameters link pixels to the same user?
No. Both parameters are coarse enums and contain no identifier.

Do the pixels include a URL or search query?
No. They also exclude hostnames, page titles, tab IDs, document IDs, navigation types, errors, and CPM rules.

Are the pixels temporary?
The session-restoration and post-crash/reload pixels are diagnostics. The stuck-state and recovery pixels are permanent health monitoring.

Why are the permanent pixels needed?
To measure how often CPM messaging becomes stuck and whether extension reload recovers it.

Do any parameters or suffixes fall outside the standard criteria?
platform and form_factor are explicit enum parameters used instead of platform-specific pixel names.

Do the pixels fire on sensitive user events?
No. They report only CPM extension health states.

Can occurrences be tied to the same user or a small group?
No. There is no correlation identifier or browsing data.

Does this meet the self-service criteria?
Yes.