A Federated and Differentially Private Incentive–Marketing Framework for Privacy-Preserving Cross-Channel Measurement in AI-Powered Digital Commerce

1. Introduction

The rapid transformation of digital commerce in the United States has placed unprecedented pressure on small and medium-sized businesses (SMBs) and creators, especially those located in remote or economically disadvantaged regions. While large platforms benefit from advanced data infrastructure and integrated advertising–incentive systems, SMBs continue to encounter structural limitations in audience targeting, attribution accuracy, and return-on-investment optimization. These disparities have been amplified by tightening privacy regulations, the deprecation of third-party cookies, and the proliferation of heterogeneous data governance frameworks across advertising ecosystems. As a consequence, SMBs increasingly operate within data-constrained environments where compliant data usage is prioritized but actionable signals for marketing optimization are significantly diminished.

At the technical level, digital advertising has entered a transition period marked by a shift from identity-based targeting toward privacy-preserving interest signals such as Topics and Protected Audience, as well as platform-controlled attribution frameworks including Attribution Reporting for the web and SKAdNetwork for mobile applications. Although these mechanisms enhance privacy guarantees, they also introduce fragmented reporting pipelines, increased latency, coarse-grained measurement granularity, and inconsistencies between web and app environments. Cross-channel data silos—historically alleviated by third-party cookies now reemerge as major bottlenecks for accurate cross-device and cross-platform marketing measurement.

To address these challenges, research attention has shifted toward federated learning (FL) and differential privacy (DP) as foundational technologies enabling compliant, high-fidelity measurement without exposing raw user-level data. FL enables collaborative model training across devices or enterprise boundaries, mitigating the privacy risks associated with centralized data aggregation. DP injects mathematically bounded noise into the training or reporting pipeline, offering quantifiable privacy guarantees that align with modern regulatory requirements. However, deploying FL + DP in real marketing environments presents significant complexities, including handling attribution delays, ensuring cross-channel consistency, reconciling event-level and aggregated reporting, and accommodating the operational constraints of SMB advertisers.

This study proposes a unified privacy-preserving incentive and marketing measurement framework that integrates Topics, Protected Audience, Attribution Reporting, and SKAdNetwork under a federated and differential privacy paradigm. The framework places compliant data usage at the core while providing an end-to-end solution for cross-channel measurement, incentive allocation, uplift estimation, and multi-touch attribution under strict privacy constraints. On the web side, the model leverages interest-based signals and site-defined protected audience cohorts, while on the mobile side it incorporates SKAdNetwork event-level reporting and privacy thresholds. A federated learning architecture harmonizes these heterogeneous signals, supported by DP-based noise calibration to ensure both privacy protection and measurement accuracy.

Furthermore, this work contributes a comparative evaluation pipeline that contrasts the proposed federated-DP framework with simpler, non-federated privacy-preserving baselines across three dimensions: (1) attribution accuracy and reporting delay, (2) uplift and optimization effectiveness, and (3) cross-channel consistency. Given the industry-wide deprecation of third-party cookies, our evaluation focuses on performance differentials within the privacy-preserving paradigm.Overall, this research advances the state of privacy-preserving marketing measurement, offering a technically feasible, regulatory-aligned, and SMB oriented solution for the emerging post-cookie era. It provides both theoretical and practical foundations for marketing ecosystems seeking to balance privacy protection with measurable advertising effectiveness in AI-powered digital commerce.

2. Related Work

The rapid evolution of privacy-preserving machine learning and privacy-compliant marketing technologies has reshaped how digital platforms measure conversions, attribute ad performance, and optimize cross-channel campaigns. Existing research can be broadly grouped into three threads: differential privacy for advertising measurement, secure and cryptographic mechanisms for attribution, and federated learning for ad targeting and delivery.

Early studies introduced differentially private (DP) mechanisms for online advertising, demonstrating that conversion events and user-level engagement can be reported with mathematically bounded leakage while maintaining competitive utility. Xiao et al. formulated one of the first online DP measurement frameworks capable of supporting per-user attribution and incremental lift estimation under strict privacy budgets [1]. Similar advances were reported in the Privacy Enhancing Technologies community, where Delaney et al. designed end-to-end pipelines for DP conversion measurement that achieve accurate aggregate statistics while resisting reconstruction attacks [2]. Complementary engineering work further demonstrated how DP can be systematically embedded into large-scale commercial ad-measurement systems, emphasizing noise calibration, event aggregation, and cross-device consistency [3]. This stream of research crystallizes into more advanced multidimensional reporting designs such as PrivacyGo, which enable private intersection, frequency estimation, and multi-touch attribution under differential privacy guarantees [4]. Beyond these industrial frameworks, prior work in security and applied cryptography explored DP in personalized advertising and demonstrated its compatibility with real-time bidding and behavioral targeting [5,6].

A parallel line of work focuses on cryptographic and privacy-enhancing mechanisms that facilitate privacy-safe reporting without direct identifier exchange. Recent developments in delegated private matching [7] and malicious-resilient aggregated statistics protocols [8] provide efficient primitives for multi-party computation (MPC) and privacy sandbox-style reporting. Earlier technical disclosures also proposed MPC-based lift measurement, demonstrating that cross-platform conversion lift can be computed without sharing raw identifiers [9]. Academic efforts such as Ibex further explored cryptographic protocols for conversion tracking and bidding, offering end-to-end encrypted pipelines suitable for high-volume ad exchanges [10]. These studies directly influenced modern browser-level attribution systems. For instance, the Attribution Reporting API incorporates summary-report optimization [11] and novel analyses of interactivity and DP parameters [12], providing a standardized interface for privacy preserving measurement across publishers and advertisers. Together, this body of literature establishes the cryptographic foundations required for secure, compliant, and utility-preserving marketing analytics.

The third major thread concerns federated learning (FL) for ad targeting, personalization, and cross-channel optimization. FL enables decentralized model training across user devices or organizational silos without raw data exchange, making it a natural match for privacy-sensitive advertising ecosystems. Su et al. developed an FL architecture combining transfer learning and knowledge distillation to improve targeted advertising performance under heterogeneous client data [13]. This was followed by comprehensive architectural proposals for FL-based smart advertising systems [14], as well as optimized data pipelines designed for latency-sensitive ad-delivery environments [15]. In parallel, commercial engineering studies explored using FL to enhance ad-delivery platforms without exposing personally identifiable information (PII), demonstrating improvements in click-through rates and bidding efficiency [16]. More recent work further examined multi-scenario optimization, investment-return modeling, and cross-regional ad-performance prediction under federated settings [17]. Other empirical studies provided evidence that FL can support privacy-preserving measurement tasks, including lift estimation and attribution [18], reinforcing its role in modern privacy-aligned advertising infrastructures.

Finally, recent surveys and conceptual analyses highlight the broader trend toward privacy centric advertising. Kraft emphasized the role of DP in modern targeting ecosystems and identified future policy-driven constraints that may make privacy-preserving optimization a mandatory baseline [19]. Complementary domain analyses such as Ullah et al.’s mobile-privacy survey [20] underscored the growing regulatory and technical pressure on platforms to adopt secure, decentralized, and privacy-preserving mechanisms for ad delivery and measurement.

Overall, the existing literature provides strong foundations but also reveals several persistent limitations: (1) DP mechanisms often degrade utility in high-dimensional multi-touch attribution settings; (2) cryptographic protocols incur computational overhead and lack economic-incentive integration; and (3) existing FL-based advertising architectures do not unify attribution measurement, incentive design, and cross-channel optimization within a single trustworthy framework. These gaps motivate the unified trusted-AI commercialization infrastructure proposed in this paper, aiming to reconcile privacy, utility, incentive alignment, and operational scalability across diverse marketing scenarios.

3. Method

This section formalizes the proposed federated and differentially private incentive marketing framework for cross-channel measurement in AI-powered digital commerce. As illustrated in Figure 1, the end-to-end system integrates client-side web and app privacy signals, unified channel encoders, a federated learning backbone trained under differential privacy, a multi-touch attribution and uplift module, and an incentive optimization layer for SMB advertisers. We first introduce the core entities and notation, then present the federated learning architecture that harmonizes web- and app-side measurement streams. Next, we describe the differentially private reporting mechanisms that ensure consistency between event-level modeling and privacy-preserving aggregation. Finally, we detail the uplift-based incentive allocation module that translates privacy-compliant measurement into economically meaningful optimization tools for SMB participants.

3.1. System Model and Notation

We consider a digital advertising ecosystem with users, advertisers, publishers, and a central orchestrator:

Users: the set of users is denoted by $\mathrm{U}$.

Advertisers: the set of advertisers is denoted by $\mathrm{A}$.

Publishers (web or app inventory owners): the set of publishers is denoted by $\mathrm{P}$.

Channels: we denote channels by $\mathrm{K}$, typically including web channels using Topics / Protected Audience and mobile channels using SKAdNetwork.

The central orchestrator (platform) is denoted by $\mathrm{C}$.

For each user $\mathrm{u}\in \mathrm{U}$, we observe a sequence of ad-related interaction events across web and app channels,

Where:

${\mathrm{x}}_{\mathrm{u},\mathrm{t}}\in {\mathbb{R}}^{\mathrm{d}}$ is the context feature vector at time $\mathrm{t}$ (including device, placement, local engagement and coarse-grained metadata).

${\mathrm{a}}_{\mathrm{u},\mathrm{t}}\in \mathrm{A}\cup \mathrm{\varnothing }$ is the action (which advertiser or campaign was shown; $\mathrm{\varnothing }$ denotes no ad).

${\mathrm{y}}_{\mathrm{u},\mathrm{t}}\in \mathrm{0,1}$ is the binary outcome (e.g., conversion within a relevant time window).

${\mathrm{k}}_{\mathrm{u},\mathrm{t}}\in \mathrm{K}$ indicates the channel (e.g., web–Topics, web–Protected Audience, app–SKAdNetwork).

To integrate privacy-preserving web and app signals, we define channel-specific encoders:

For web events with Topics and Protected Audience (PA) signals,

$${\mathrm{z}}^{\mathrm{web}}\mathrm{*}\mathrm{u},\mathrm{t}=\mathsf{\psi }\mathrm{*}\mathrm{web}({\mathrm{x}}_{\mathrm{u},\mathrm{t}},\mathrm{Topics}\mathrm{*}\mathrm{u},\mathrm{t},\mathrm{PA}\mathrm{*}\mathrm{u},\mathrm{t}),$$

Where ${\mathsf{\psi }}_{\mathrm{web}}(\cdot )$ is a deterministic feature mapping that transforms event-level context and interest signals into a representation suitable for federated modeling.

For app events with SKAdNetwork reporting,

$${\mathrm{z}}^{\mathrm{app}}\mathrm{*}\mathrm{u},\mathrm{t}=\mathsf{\psi }\mathrm{*}\mathrm{app}({\mathrm{x}}_{\mathrm{u},\mathrm{t}},\mathrm{SKAN}\mathrm{*}\mathrm{u},\mathrm{t})$$

where $\mathrm{SKAN}\mathrm{*}\mathrm{u},\mathrm{t}$ captures SKAdNetwork postbacks and coarse-grained conversion values.

We write the unified representation as

${\mathrm{z}}_{\mathrm{u},\mathrm{t}}=\left\{\begin{array}{lll}{\mathrm{z}}^{\mathrm{web}}\mathrm{*}\mathrm{u},\mathrm{t},& \mathrm{if}\mathrm{k}\mathrm{*}\mathrm{u},\mathrm{t}\mathrm{is}\mathrm{a}\mathrm{web}\mathrm{channel},{\mathrm{z}}^{\mathrm{app}}\mathrm{*}\mathrm{u},\mathrm{t},& \mathrm{if}\mathrm{k}\mathrm{*}\mathrm{u},\mathrm{t}\mathrm{is}\mathrm{an}\mathrm{app}\mathrm{channel}.\end{array}\right.$For brevity, we denote the per-event tuple as

$${\mathrm{e}}_{\mathrm{u},\mathrm{t}}=({\mathrm{z}}_{\mathrm{u},\mathrm{t}},{\mathrm{a}}_{\mathrm{u},\mathrm{t}},{\mathrm{y}}_{\mathrm{u},\mathrm{t}},{\mathrm{k}}_{\mathrm{u},\mathrm{t}}),\mathcal{E}=\bigcup _{\mathrm{u}\in \mathrm{U}} {\mathcal{E}}_{\mathrm{u}}.$$

Our goal is to learn a global model ${\mathrm{f}}_{\mathsf{\theta }}$ with parameters $\mathsf{\theta }$ that supports:

Outcome prediction: estimate the probability of conversion under different ad actions,$\stackrel{\mathrm{ˆ}}{\mathrm{p}}({\mathrm{y}}_{\mathrm{u},\mathrm{t}}=1\mid {\mathrm{z}}_{\mathrm{u},\mathrm{t}},{\mathrm{a}}_{\mathrm{u},\mathrm{t}})={\mathrm{f}}_{\mathsf{\theta }}({\mathrm{z}}_{\mathrm{u},\mathrm{t}},{\mathrm{a}}_{\mathrm{u},\mathrm{t}}).$Uplift estimation: estimate the incremental effect of showing an ad versus not showing an ad.

Multi-touch attribution (MTA): compute credit weights over the sequence of user touches.

Incentive allocation: translate uplift and attribution metrics into incentive scores and budget allocation while respecting privacy guarantees.

All of the above are implemented in a fully federated and differentially private fashion, mediated by the orchestrator $\mathrm{C}$.

Federated Outcome and Uplift Modeling

Users (or small publisher/SMB clusters) act as federated clients. Let $\mathcal{I}$ denote the index set of clients, where each client $\mathrm{i}\in \mathcal{I}$ holds a local dataset

$$\mathrm{D}\mathrm{*}\mathrm{i}={(\mathrm{z}\mathrm{*}\mathrm{j},{\mathrm{a}}_{\mathrm{j}},{\mathrm{y}}_{\mathrm{j}})}_{\mathrm{j}=1}^{{\mathrm{n}}_{\mathrm{i}}}$$

derived from ${\mathcal{E}}_{\mathrm{u}}:\mathrm{u}\in {\mathrm{U}}_{\mathrm{i}}$ and never leaves the device or local enclave.

We define the global empirical risk minimization (ERM) objective as

$$\underset{\mathsf{\theta }}{\mathrm{m}\mathrm{i}\mathrm{n}} ;\mathcal{L}\left(\mathsf{\theta }\right)=\sum _{\mathrm{i}\in \mathcal{I}} {\displaystyle \frac{{\mathrm{n}}_{\mathrm{i}}}{\mathrm{n}}},\mathcal{L}\mathcal{*}\mathrm{i}\left(\mathsf{\theta }\right),\mathcal{L}\mathcal{*}\mathrm{i}\left(\mathsf{\theta }\right)={\displaystyle \frac{1}{{\mathrm{n}}_{\mathrm{i}}}}\sum \mathrm{*}{\mathrm{j}=1}^{{\mathrm{n}}_{\mathrm{i}}}\mathcal{l}\left(\mathrm{f}\mathrm{*}\mathsf{\theta }\right({\mathrm{z}}_{\mathrm{j}},{\mathrm{a}}_{\mathrm{j}}),{\mathrm{y}}_{\mathrm{j}})$$

where $\mathrm{n}=\sum _{\mathrm{i}\in \mathcal{I}} {\mathrm{n}}_{\mathrm{i}}$ and $\mathcal{l}(\cdot ,\cdot )$ is a prediction loss, typically the logistic loss

$$\mathcal{l}(\stackrel{\mathrm{ˆ}}{\mathrm{y}},\mathrm{y})=-(\mathrm{y}\mathrm{l}\mathrm{o}\mathrm{g}\stackrel{\mathrm{ˆ}}{\mathrm{y}}+(1-\mathrm{y}\left)\mathrm{l}\mathrm{o}\mathrm{g}\right(1-\stackrel{\mathrm{ˆ}}{\mathrm{y}}\left)\right)$$

The model ${\mathrm{f}}_{\mathsf{\theta }}$ can be factorized into a feature encoder and task heads,

$${\mathrm{f}}_{\mathsf{\theta }}(\mathrm{z},\mathrm{a})=\mathsf{\sigma }\left({\mathrm{g}}_{{\mathsf{\theta }}_{\mathrm{head}}}\right({\mathrm{h}}_{{\mathsf{\theta }}_{\mathrm{enc}}}\left(\mathrm{z}\right),\mathrm{a}\left)\right)$$

where ${\mathrm{h}}_{{\mathsf{\theta }}_{\mathrm{enc}}}$ is a shared representation network, ${\mathrm{g}}_{{\mathsf{\theta }}_{\mathrm{head}}}$ is a task-specific head, and $\mathsf{\sigma }(\cdot )$ is the logistic sigmoid.

To support incremental lift estimation, we employ a two-head structure with potential-outcome predictions,The individual-level uplift estimate is then

$$\mathsf{\tau }\left(\mathrm{z}\right)={\mathsf{\mu }}_1\left(\mathrm{z}\right)-{\mathsf{\mu }}_0\left(\mathrm{z}\right).$$

The orchestrator $\mathrm{C}$ runs a variant of FedAvg over discrete communication rounds $\mathrm{t}=\mathrm{0,1},2,\dots$.

At round $\mathrm{t}$:

$\mathrm{C}$ maintains the current model ${\mathsf{\theta }}^{\left(\mathrm{t}\right)}$ and selects a subset of clients ${\mathrm{S}}_{\mathrm{t}}\subseteq \mathcal{I}$.

Each client $\mathrm{i}\in {\mathrm{S}}_{\mathrm{t}}$ initializes its local model with ${\mathsf{\theta }}^{\left(\mathrm{t}\right)}$ and performs $\mathrm{E}$ steps of local stochastic gradient descent (SGD),

$${\mathsf{\theta }}_{\mathrm{i}}^{(\mathrm{t},0)}={\mathsf{\theta }}^{\left(\mathrm{t}\right)},{\mathsf{\theta }}_{\mathrm{i}}^{(\mathrm{t},\mathrm{e}+1)}={\mathsf{\theta }}_{\mathrm{i}}^{(\mathrm{t},\mathrm{e})}-\mathsf{\eta },{\mathrm{g}}_{\mathrm{i}}^{(\mathrm{t},\mathrm{e})},$$

where ${\mathrm{g}}_{\mathrm{i}}^{(\mathrm{t},\mathrm{e})}$ is the gradient on a mini-batch and $\mathsf{\eta }$ is the learning rate.

After $\mathrm{E}$ steps we denote the final local parameters as ${\mathsf{\theta }}_{\mathrm{i}}^{(\mathrm{t}+1)}$.

The orchestrator aggregates the local updates to obtain the new global parameters,

$${\mathsf{\theta }}^{(\mathrm{t}+1)}=\sum _{\mathrm{i}\in \mathrm{S}\mathrm{*}\mathrm{t}} {\displaystyle \frac{{\mathrm{n}}_{\mathrm{i}}}{\sum \mathrm{*}\mathrm{j}\in {\mathrm{S}}_{\mathrm{t}}{\mathrm{n}}_{\mathrm{j}}}},{\mathsf{\theta }}_{\mathrm{i}}^{(\mathrm{t}+1)}.$$

This procedure is integrated with differential privacy in the next subsection.

3.2. Differentially Private Measurement and Attribution

The central requirement of the proposed framework is that all model training, attribution statistics, and reporting are $(\mathsf{ϵ},\mathsf{\delta })$-differentially private with respect to individual users or SMBs.

3.3. Differential Privacy Preliminaries

A randomized mechanism $\mathcal{M}$ that maps datasets to outputs satisfies $(\mathsf{ϵ},\mathsf{\delta })$-differential privacy if for any pair of neighboring datasets $\mathrm{D}$ and ${\mathrm{D}}^{\mathrm{\text{'}}}$ differing in a single user’s data and for any measurable set $\mathrm{S}$,

$$\mathrm{P}\mathrm{r}\left[\mathcal{M}\right(\mathrm{D})\in \mathrm{S}]\le {\mathrm{e}}^{\mathsf{ϵ}}\mathrm{P}\mathrm{r}\left[\mathcal{M}\right({\mathrm{D}}^{\mathrm{\text{'}}})\in \mathrm{S}]+\mathsf{\delta }.$$

In our setting, mechanisms include:

The federated learning update mechanism (via DP-SGD).

The aggregate attribution and conversion reporting mechanisms (for web Attribution Reporting and SKAdNetwork-like summaries).

3.4. DP-SGD for Federated Learning

ATo guarantee differential privacy in training, we employ DP-FedAvg with Gaussian mechanism. At each round t, for each client $\mathrm{i}\in {\mathrm{S}}_{\mathrm{t}}:$For each example j in the local mini-batch${\mathrm{B}}_{\mathrm{i}}^{\left(\mathrm{t}\right)}$, compute the gradient ${\mathrm{g}}_{\mathrm{i},\mathrm{j}}^{\left(\mathrm{t}\right)}={\nabla }_{\mathsf{\theta }}{\mathcal{l}}_{\mathrm{i},\mathrm{j}}\left({\mathsf{\theta }}^{\left(\mathrm{t}\right)}\right)$ and clip its L2 norm:

$$\mathrm{g}{\mathrm{ˉ}}_{\mathrm{i},\mathrm{j}}^{\left(\mathrm{t}\right)}={\mathrm{g}}_{\mathrm{i},\mathrm{j}}^{\left(\mathrm{t}\right)}/\mathrm{m}\mathrm{a}\mathrm{x}(1,{\displaystyle \frac{\parallel {\mathrm{g}}_{\mathrm{i},\mathrm{j}}^{\left(\mathrm{t}\right)}{\parallel }_2}{\mathrm{C}}})$$

The server collects the clipped gradient sums from clients, adds Gaussian noise, and performs the update:

$${\mathrm{g}-}^{\left(\mathrm{t}\right)}={\displaystyle \frac{1}{\mid \mathrm{S}\mathrm{t}\mid }}(\sum _{\mathrm{i}\in \mathrm{S}\mathrm{t}}\sum _{\mathrm{j}\in {\mathrm{B}}_{\mathrm{i}}^{\left(\mathrm{t}\right)}}\mathrm{g}{\mathrm{ˉ}}_{\mathrm{i},\mathrm{j}}^{\left(\mathrm{t}\right)}+\mathrm{N}(0,{\mathsf{\sigma }}^2{\mathrm{C}}^2\mathrm{I}\left)\right)$$

$${\mathsf{\theta }}^{(\mathrm{t}+1)}={\mathsf{\theta }}^{\left(\mathrm{t}\right)}-\mathsf{\eta }\cdot \mathrm{g}\left(\mathrm{t}\right)$$

where C is the clipping norm, σ is the noise multiplier calibrated to the target (ϵtrain, δtrain) budget using the Moments Accountant, and I is the identity matrix.

3.5. DP Aggregation for Cross-Channel Attribution

Let ${\mathrm{N}}_{\mathrm{a},\mathrm{k}}$ denote the true number of conversions attributed to advertiser $\mathrm{a}\in \mathrm{A}$ on channel $\mathrm{k}\in \mathrm{K}$ over a given reporting window. We model the DP reporting mechanism for the summary reports of Attribution Reporting and SKAdNetwork as a noisy aggregation,

$$\tilde{\mathrm{N}}\mathrm{*}\mathrm{a},\mathrm{k}=\mathrm{N}\mathrm{*}\mathrm{a},\mathrm{k}+{\mathrm{Z}}_{\mathrm{a},\mathrm{k}},{\mathrm{Z}}_{\mathrm{a},\mathrm{k}}\sim \mathrm{N}(0,{\mathsf{\sigma }}_{\mathrm{rep}}^2).$$

To support multi-dimensional breakdowns (e.g., region, device type, campaign), we index by a tuple $\mathrm{b}\in \mathcal{B}$ and define

$${\mathrm{N}}_{\mathrm{a},\mathrm{k},\mathrm{b}}=\sum _{\mathrm{u}\in \mathrm{U}} \sum _{\mathrm{t}} 1\left[\mathrm{event}\right(\mathrm{u},\mathrm{t}\left)\mathrm{is}\mathrm{attributed}\mathrm{to}\right(\mathrm{a},\mathrm{k},\mathrm{b}\left)\right],$$

with noisy release

$$\tilde{\mathrm{N}}\mathrm{*}\mathrm{a},\mathrm{k},\mathrm{b}=\mathrm{N}\mathrm{*}\mathrm{a},\mathrm{k},\mathrm{b}+{\mathrm{Z}}_{\mathrm{a},\mathrm{k},\mathrm{b}},{\mathrm{Z}}_{\mathrm{a},\mathrm{k},\mathrm{b}}\sim \mathrm{N}(0,{\mathsf{\sigma }}_{\mathrm{rep}}^2).$$

The sensitivity of this query under user-level adjacency is bounded by a constant $\mathsf{\Delta }$, and the noise scale ${\mathsf{\sigma }}_{\mathrm{rep}}$ is chosen according to the Gaussian mechanism to achieve $({\mathsf{ϵ}}_{\mathrm{rep}},{\mathsf{\delta }}_{\mathrm{rep}})$-DP for reporting.

The final model is obtained by jointly optimizing a composite loss function that balances prediction accuracy, consistency with DP reports, and attribution alignment:

$${\mathrm{L}}^{\mathrm{t}\mathrm{o}\mathrm{t}\mathrm{a}\mathrm{l}}={\mathrm{L}}^{\mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}}+{\mathsf{\lambda }}_1{\mathrm{L}}^{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{s}}+{\mathsf{\lambda }}_2{\mathrm{L}}^{\mathrm{M}\mathrm{T}\mathrm{A}}$$

Here, ${\mathrm{L}}^{\mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}}$ is the standard binary cross-entropy loss for conversion prediction. The hyperparameters ${\mathsf{\lambda }}_1$​ and ${\mathsf{\lambda }}_2$ control the trade-off between objectives and were set to 0.5 and 0.3 respectively, determined via grid search on a validation set. All parameters (θ,η) are updated simultaneously through backpropagation in each federated round.

3.6. Consistency Constraints Between Event-Level and Summary-Level Views

To ensure that event-level models and summary reports are consistent, we introduce a consistency regularization term. Let ${\stackrel{\mathrm{ˆ}}{\mathrm{N}}}_{\mathrm{a},\mathrm{k},\mathrm{b}}\left(\mathsf{\theta }\right)$ be the model-implied expected number of conversions for $(\mathrm{a},\mathrm{k},\mathrm{b})$ under the current model:

$$\stackrel{\mathrm{ˆ}}{\mathrm{N}}\mathrm{*}\mathrm{a},\mathrm{k},\mathrm{b}\left(\mathsf{\theta }\right)=\sum \mathrm{*}\mathrm{u}\in \mathrm{U}\sum _{\mathrm{t}} \mathrm{E}[{\mathrm{y}}_{\mathrm{u},\mathrm{t}}\mid {\mathrm{z}}_{\mathrm{u},\mathrm{t}},{\mathrm{a}}_{\mathrm{u},\mathrm{t}},{\mathrm{k}}_{\mathrm{u},\mathrm{t}};\mathsf{\theta }],1\left[\right({\mathrm{a}}_{\mathrm{u},\mathrm{t}},{\mathrm{k}}_{\mathrm{u},\mathrm{t}},{\mathrm{b}}_{\mathrm{u},\mathrm{t}})=(\mathrm{a},\mathrm{k},\mathrm{b}\left)\right].$$

We define a consistency loss

$${\mathcal{L}}^{\mathrm{cons}}\left(\mathsf{\theta }\right)=\sum _{\mathrm{a}\in \mathrm{A}} \sum _{\mathrm{k}\in \mathrm{K}} \sum _{\mathrm{b}\in \mathcal{B}} {\mathrm{w}}_{\mathrm{a},\mathrm{k},\mathrm{b}}(\stackrel{\mathrm{ˆ}}{\mathrm{N}}\mathrm{*}\mathrm{a},\mathrm{k},\mathrm{b}(\mathsf{\theta })-\tilde{\mathrm{N}}\mathrm{*}\mathrm{a},\mathrm{k},\mathrm{b}{)}^2,$$

where ${\mathrm{w}}_{\mathrm{a},\mathrm{k},\mathrm{b}}\ge 0$ are weights that down-weight cells with high DP noise.

3.7. Multi-Touch Attribution and Incentive Allocation

The system must allocate credit across multiple touches in a cross-channel user journey and turn these credits into incentive scores for SMBs in a way that remains compatible with DP constraints.

3.7.1. Path-Based Attribution Weights.

For each user $\mathrm{u}$, we consider the ordered sequence of ad touches up to a conversion (or censoring time),

$${\mathrm{p}}_{\mathrm{u}}=\left(\right({\mathrm{a}}_{\mathrm{u},1},{\mathrm{k}}_{\mathrm{u},1}),({\mathrm{a}}_{\mathrm{u},2},{\mathrm{k}}_{\mathrm{u},2}),\dots ,({\mathrm{a}}_{\mathrm{u},{\mathrm{L}}_{\mathrm{u}}},{\mathrm{k}}_{\mathrm{u},{\mathrm{L}}_{\mathrm{u}}}\left)\right),$$

with ${\mathrm{L}}_{\mathrm{u}}$ touches.

We construct contextual scores ${\mathrm{s}}_{\mathrm{u},\mathcal{l}}$ for each touch,

$${\mathrm{s}}_{\mathrm{u},\mathcal{l}}={\mathsf{\phi }}_{\mathsf{\eta }}\left({\mathrm{h}}_{{\mathsf{\theta }}_{\mathrm{enc}}}\right({\mathrm{z}}_{\mathrm{u},\mathcal{l}}),{\mathrm{a}}_{\mathrm{u},\mathcal{l}},{\mathrm{k}}_{\mathrm{u},\mathcal{l}}),$$

where ${\mathsf{\phi }}_{\mathsf{\eta }}$ is a small neural network with parameters $\mathsf{\eta }$ that maps the encoded representation and channel metadata to a scalar relevance score.

Attribution weights are then produced via a softmax over the path,

$${\mathsf{\alpha }}_{\mathrm{u},\mathcal{l}}={\displaystyle \frac{\mathrm{e}\mathrm{x}\mathrm{p}\left({\mathrm{s}}_{\mathrm{u},\mathcal{l}}\right)}{\sum _{\mathrm{j}=1}^{{\mathrm{L}}_{\mathrm{u}}} \mathrm{e}\mathrm{x}\mathrm{p}\left({\mathrm{s}}_{\mathrm{u},\mathrm{j}}\right)}},\sum _{\mathcal{l}=1}^{{\mathrm{L}}_{\mathrm{u}}} {\mathsf{\alpha }}_{\mathrm{u},\mathcal{l}}=1.$$

If user $\mathrm{u}$ converts (${\mathrm{y}}_{\mathrm{u}}=1$), the fractional credit assigned to touch $({\mathrm{a}}_{\mathrm{u},\mathcal{l}},{\mathrm{k}}_{\mathrm{u},\mathcal{l}})$ is ${\mathsf{\alpha }}_{\mathrm{u},\mathcal{l}}$. The path-level estimator for attributed conversions of $(\mathrm{a},\mathrm{k})$ is

$$\stackrel{\mathrm{ˆ}}{\mathrm{N}}\mathrm{*}{\mathrm{a},\mathrm{k}}^{\mathrm{MTA}}=\sum \mathrm{*}\mathrm{u}\in \mathrm{U}{\mathrm{y}}_{\mathrm{u}}\sum _{\mathcal{l}=1}^{{\mathrm{L}}_{\mathrm{u}}} {\mathsf{\alpha }}_{\mathrm{u},\mathcal{l}}1\left[\right({\mathrm{a}}_{\mathrm{u},\mathcal{l}},{\mathrm{k}}_{\mathrm{u},\mathcal{l}})=(\mathrm{a},\mathrm{k}\left)\right].$$

During training, we encourage consistency between $\stackrel{\mathrm{ˆ}}{\mathrm{N}}\mathrm{*}{\mathrm{a},\mathrm{k}}^{\mathrm{MTA}}$ and the DP-reported $\tilde{\mathrm{N}}\mathrm{*}\mathrm{a},\mathrm{k}$ via an additional loss term,

$${\mathcal{L}}^{\mathrm{MTA}}(\mathsf{\theta },\mathsf{\eta })=\sum _{\mathrm{a}\in \mathrm{A}} \sum _{\mathrm{k}\in \mathrm{K}} {\mathrm{v}}_{\mathrm{a},\mathrm{k}}(\stackrel{\mathrm{ˆ}}{\mathrm{N}}\mathrm{*}{\mathrm{a},\mathrm{k}}^{\mathrm{MTA}}-\tilde{\mathrm{N}}\mathrm{*}\mathrm{a},\mathrm{k}{)}^2,$$

with ${\mathrm{v}}_{\mathrm{a},\mathrm{k}}\ge 0$ tuning channel-level trust in the DP aggregation.

3.7.2. Uplift-Based Incentive Scores.

For each advertiser $\mathrm{a}\in \mathrm{A}$ and for each incentive program $\mathrm{c}$ (e.g., a subsidy scheme or discount on platform fees), we define an uplift-based benefit estimate. Let $\mathrm{U}\mathrm{*}\mathrm{a},\mathrm{c}$ denote the set of users targeted by advertiser $\mathrm{a}$ under incentive configuration $\mathrm{c}$. For each user $\mathrm{u}\in \mathrm{U}\mathrm{*}\mathrm{a},\mathrm{c}$, we obtain the uplift estimate,

$${\mathsf{\tau }}_{\mathrm{u},\mathrm{a},\mathrm{c}}=\mathsf{\tau }\left({\mathrm{z}}_{\mathrm{u},\mathrm{c}}\right)={\mathsf{\mu }}_1\left({\mathrm{z}}_{\mathrm{u},\mathrm{c}}\right)-{\mathsf{\mu }}_0\left({\mathrm{z}}_{\mathrm{u},\mathrm{c}}\right),$$

where ${\mathrm{z}}_{\mathrm{u},\mathrm{c}}$ summarizes the user and campaign context under $\mathrm{c}$.

The aggregated uplift for $(\mathrm{a},\mathrm{c})$ is

$$\stackrel{\mathrm{ˆ}}{\mathsf{\tau }}\mathrm{*}\mathrm{a},\mathrm{c}={\displaystyle \frac{1}{|\mathrm{U}\mathrm{*}\mathrm{a},\mathrm{c}|}}\sum _{\mathrm{u}\in \mathrm{U}\mathrm{*}\mathrm{a},\mathrm{c}} \mathsf{\tau }\mathrm{*}\mathrm{u},\mathrm{a},\mathrm{c}.$$

To maintain DP at the advertiser level, we apply a noisy release,

$$\tilde{\mathsf{\tau }}\mathrm{*}\mathrm{a},\mathrm{c}=\stackrel{\mathrm{ˆ}}{\mathsf{\tau }}\mathrm{*}\mathrm{a},\mathrm{c}+{\mathrm{W}}_{\mathrm{a},\mathrm{c}},{\mathrm{W}}_{\mathrm{a},\mathrm{c}}\sim \mathrm{N}(0,{\mathsf{\sigma }}_{\mathrm{uplift}}^2),$$

where ${\mathsf{\sigma }}_{\mathrm{uplift}}$ is calibrated such that the mapping from user-level data to $\tilde{\mathsf{\tau }}\mathrm{*}\mathrm{a},\mathrm{c}$ is $(\mathsf{ϵ}\mathrm{*}\mathrm{uplift},{\mathsf{\delta }}_{\mathrm{uplift}})$-DP.

These ${\tilde{\mathsf{\tau }}}_{\mathrm{a},\mathrm{c}}$ values form the core signals for incentive allocation.

Incentive Optimization Under Budget and Fairness Constraints

Let ${\mathrm{b}}_{\mathrm{a},\mathrm{c}}\in \mathrm{0,1}$ be a binary decision variable indicating whether advertiser $\mathrm{a}$ receives incentive program $\mathrm{c}$. Let ${\mathsf{\kappa }}_{\mathrm{c}}>0$ be the cost of assigning program $\mathrm{c}$ to a single advertiser and $\mathrm{B}>0$ be the total incentive budget for a given period.

We define a linear utility function based on DP uplift estimates,

$$\mathrm{U}\left(\mathrm{b}\right)=\sum _{\mathrm{a}\in \mathrm{A}} \sum _{\mathrm{c}} {\mathrm{b}}_{\mathrm{a},\mathrm{c}},{\tilde{\mathsf{\tau }}}_{\mathrm{a},\mathrm{c}}.$$

The budget constraint is

$$\sum _{\mathrm{a}\in \mathrm{A}} \sum _{\mathrm{c}} {\mathrm{b}}_{\mathrm{a},\mathrm{c}},{\mathsf{\kappa }}_{\mathrm{c}}\le \mathrm{B}.$$

To capture fairness toward SMBs, let $\mathrm{A}\mathrm{*}\mathrm{SMB}\subseteq \mathrm{A}$ denote the subset of SMB advertisers and define a minimum allocation level $\mathsf{\rho }\in \left[\mathrm{0,1}\right]$. We impose

$${\displaystyle \frac{\sum \mathrm{*}\mathrm{a}\in \mathrm{A}\mathrm{*}\mathrm{SMB}\sum \mathrm{*}\mathrm{c}{\mathrm{b}}_{\mathrm{a},\mathrm{c}},{\mathsf{\kappa }}_{\mathrm{c}}}{\sum _{\mathrm{a}\in \mathrm{A}} \sum _{\mathrm{c}} {\mathrm{b}}_{\mathrm{a},\mathrm{c}},{\mathsf{\kappa }}_{\mathrm{c}}}}\ge \mathsf{\rho },$$

ensuring that at least a fraction $\mathsf{\rho }$ of the incentive budget flows to SMBs.

The resulting optimization problem is

$$\begin{array}{lllllll}\underset{\mathrm{b}}{\mathrm{m}\mathrm{a}\mathrm{x}} & \mathrm{U}\left(\mathrm{b}\right)=\sum _{\mathrm{a}\in \mathrm{A}} \sum _{\mathrm{c}} {\mathrm{b}}_{\mathrm{a},\mathrm{c}},\tilde{\mathsf{\tau }}\mathrm{*}\mathrm{a},\mathrm{c},\mathrm{s}.\mathrm{t}.& & \sum \mathrm{*}\mathrm{a}\in \mathrm{A}\sum _{\mathrm{c}} {\mathrm{b}}_{\mathrm{a},\mathrm{c}},{\mathsf{\kappa }}_{\mathrm{c}}\le \mathrm{B},& {\displaystyle \frac{\sum _{\mathrm{a}\in \mathrm{A}\mathrm{*}\mathrm{SMB}} \sum \mathrm{*}\mathrm{c}{\mathrm{b}}_{\mathrm{a},\mathrm{c}},{\mathsf{\kappa }}_{\mathrm{c}}}{\sum _{\mathrm{a}\in \mathrm{A}} \sum _{\mathrm{c}} {\mathrm{b}}_{\mathrm{a},\mathrm{c}},{\mathsf{\kappa }}_{\mathrm{c}}}}\ge \mathsf{\rho },& & {\mathrm{b}}_{\mathrm{a},\mathrm{c}}\in \mathrm{0,1},\forall \mathrm{a},\mathrm{c}.\end{array}$$

In practice, this integer program can be relaxed to ${\mathrm{b}}_{\mathrm{a},\mathrm{c}}\in \left[\mathrm{0,1}\right]$ and solved via convex optimization, or approximated using greedy heuristics that preserve DP guarantees (since DP already resides in the upstream signals ${\tilde{\mathsf{\tau }}}_{\mathrm{a},\mathrm{c}}$ rather than in the solver itself).

4. Valuation

This section empirically evaluates the proposed Federated–Differentially Private cross channel incentive marketing framework. Experiments focus on three core questions:

It is important to note that in the current privacy-centric ecosystem, a direct comparison with traditional, identity-based third-party cookie systems is neither feasible nor methodologically sound. Therefore, our evaluation is designed to assess whether the proposed federated-DP framework can outperform other viable, privacy-compliant measurement techniques, thereby establishing its utility in the post-cookie era.

Does the federated + DP model preserve accuracy across web and app channels despite noise constraints?

Does the proposed multi-touch attribution (MTA) mechanism increase consistency with privacy-preserving summary reports?

Does uplift-based incentive allocation improve SMB performance under realistic privacy budgets?

We conduct experiments on a combined dataset synthesized from web Topics/Protected Audience signals and app–SKAdNetwork-like postbacks. To ensure realistic modeling, web events are grouped into 5 Topics categories and 6 PA cohorts, whereas app events contain coarse-grained conversion values (0–5) consistent with SKAdNetwork behavior.

4.1. Model Performance Across Channels

We simulate a cross-channel advertising dataset reflecting post-cookie constraints. User journey sequences are generated using a Markov model calibrated against publicly available ad interaction logs. Web events are annotated with synthetic Topics (5 categories, assigned via weighted random sampling) and Protected Audience cohort IDs (6 cohorts). App events are paired with SKAdNetwork-like postbacks, containing coarse-grained conversion values (0-5) and source identifiers.

We first evaluate prediction and uplift accuracy across channels — Web–Topics, Web–Protected Audience (PA), and App–SKAdNetwork.As shown in Table 1.

The following table summarizes performance across three core metrics:

AUC for conversion prediction

Calibration Error (ECE)

Uplift RMSE for counterfactual uplift modeling

4.2. Attribution Consistency Under DP Summary Reporting

We next evaluate whether the proposed multi-touch attribution (MTA) system remains aligned with the differentially private summary reports from Attribution Reporting and SKAdNetwork.As shown in Table 2.

Our framework reduces attribution inconsistency by more than 56% relative to DP summary-only reporting.

Consistency losses significantly enhance alignment between event-level and summary-level measurement.

Cross-channel MTA is only feasible with unified federated representation learning, as seen in the results.

4.3. Incentive Allocation Outcomes for SMB Advertisers

Finally, we evaluate how uplift-based incentive allocation affects SMB campaign performance. As shown in Table 3.

Total incentive cost divided by the total number of incremental conversions (estimated via the uplift model). SMB Allocation Ratio: The proportion of the total incentive budget allocated to SMB advertisers.

5. Conclusion

This paper presents a unified federated and differentially private framework for cross-channel marketing measurement and incentive optimization in post-cookie digital ecosystems. Motivated by the growing fragmentation between web and mobile advertising environments—where Topics, Protected Audience, Attribution Reporting, and SKAdNetwork each impose distinct privacy and reporting constraints—we propose an end-to-end architecture that harmonizes heterogeneous privacy-preserving signals while supporting accurate attribution, uplift estimation, and incentive allocation for advertisers, particularly SMBs operating under limited data resources.

Technically, the framework combines federated learning, differential privacy, multi-touch attribution, and uplift-based incentive modeling into an integrated system. A unified representation encoder allows both web-side and app-side privacy sandbox signals to be embedded into a common latent space, reducing channel asymmetries and improving cross-environment generalization. Differentially private SGD ensures that all model updates adhere to strict privacy budgets, and DP-based reporting mechanisms align event-level predictions with coarse-grained summary reports from Attribution Reporting and SKAdNetwork. A consistency regularization module further links federated predictions with noisy aggregate statistics, narrowing the long-standing gap between platform-level and device-level measurement pipelines.

Empirical evaluations demonstrate that the proposed architecture yields substantial gains across three critical dimensions:

• measurement utility, improving AUC, calibration, and uplift RMSE under realistic DP budgets;
• attribution consistency, reducing discrepancies between model-derived multi-touch paths and DP summary-level conversions;
• economic efficiency, delivering higher incremental lift and lower cost per incremental conversion in SMB-targeted incentive programs while satisfying fairness constraints.

Beyond technical contributions, this work has important practical implications. It shows that privacy-preserving advertising does not inherently preclude high-fidelity performance measurement or equitable incentive distribution. With appropriate algorithmic design—particularly unified federated learning, adaptive DP calibration, and uncertainty-aware attribution—it is possible to construct a scalable and regulator-aligned commercialization infrastructure capable of serving platforms, advertisers, and end users simultaneously. The framework therefore provides a viable blueprint for the next generation of trusted AI systems in digital commerce, where privacy guarantees, economic incentives, and measurement accuracy must coexist.

Nevertheless, several challenges remain. Federated learning at scale introduces optimization instability under heterogeneous device participation; differential privacy continues to impose noise ceilings on uplift estimation; and cross-channel temporal misalignment between Attribution Reporting and SKAdNetwork remains a structural barrier to perfect attribution harmonization. Future work should explore causal representation learning, asynchronous federated optimization with privacy accounting, and mechanism-design–aligned incentive policies that can reduce strategic manipulation while maintaining fairness for SMBs.

In conclusion, the proposed federated–DP measurement framework represents a significant step toward rebuilding marketing effectiveness in a privacy-centric era. By integrating regulatory-compliant data flows with robust attribution and incentive modeling, it establishes a principled, scalable foundation for trustworthy, AI-powered digital commerce.