Privacy Sandbox detection: which APIs are still in the code

Google largely wound down the Privacy Sandbox in 2025, several ad APIs are being retired. This check is an inventory signal, not a recommendation.

What we check

Detects Privacy Sandbox APIs: Topics, FedCM, Attribution Reporting, Protected Audience.

Why it matters

In October 2025 Google announced plans to retire technologies including Topics, Attribution Reporting and Protected Audience. FedCM and CHIPS remain supported. Interpret each finding by API. Source: Google.

Common causes

An ad-tech or CMP script brought the API calls along, nobody added them deliberately.
A 2024 pilot project (Topics, Attribution Reporting) keeps running unobserved.
FedCM is in use for login, the part of the Sandbox that persists, then the finding is uncritical.

The fix

Identify the script and its owner. For each API announced for retirement, check which features depend on it and what status the provider currently documents. FedCM and CHIPS can remain. A replacement must serve the same purpose: server-side tagging does not automatically handle login or attribution.

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

The scan found Attribution Reporting. What does that mean for us?

That a script on your page calls an API whose retirement Google announced in October 2025. Usually it is an ad-tech or CMP script bringing the call along, not your own code. Clarify which vendor is behind it and what they document as a replacement. As long as the API still answers, nothing happens; afterwards that part of the measurement silently drops away.

FedCM was detected. Do we have to do anything?

No. FedCM is the login part of the Sandbox and stays, according to Google, as does CHIPS for partitioned cookies. The scan lists both because it shows the inventory; the classification is in the line.

Why does the scan check a technology that is being retired?

Exactly because of that. Whoever built on Topics or Protected Audience in 2024 needs to know now where that code lives. A match is a note, not a point deduction, and the question behind it is always the same: what job did the API have, and what takes it over.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint