<!--
Copyright 2022 The Chromium Authors
Use of this source code is governed by a BSD-style license that can be
found in the LICENSE file.
-->

<!--
This file is used to generate a comprehensive list of Privacy histograms
along with a detailed description for each histogram.

For best practices on writing histogram descriptions, see
https://chromium.googlesource.com/chromium/src.git/+/HEAD/tools/metrics/histograms/README.md

Please follow the instructions in the OWNERS file in this directory to find a
reviewer.
-->

<histogram-configuration>

<histograms>

<variants name="DIPSCookieMode">
  <variant name=".Block3PC"
      summary="in a NON-off-the-record profile, with third-party cookies
               blocked"/>
  <variant name=".OffTheRecord_Block3PC"
      summary="in an off-the-record profile, with third-party cookies blocked"/>
</variants>

<variants name="DIPSCookiePartitionKeyState">
  <variant name="NonCanonical"
      summary="The cookie partition key does not have a canonical host."/>
  <variant name="NonSerializable"
      summary="The cookie partition key cannot be serialized."/>
  <variant name="Serializable"
      summary="The cookie partition key can be serialized."/>
</variants>

<variants name="DIPSDatabaseOperation">
  <variant name="ClearTimestamps" summary="ClearTimestamps"/>
  <variant name="FilterSitesWithProtectiveEvent"
      summary="FilterSitesWithProtectiveEvent"/>
  <variant name="FilterSitesWithUserActivation"
      summary="FilterSitesWithUserActivation"/>
  <variant name="FilterSitesWithWebAuthnAssertion"
      summary="FilterSitesWithWebAuthnAssertion"/>
  <variant name="GetSitesThatBounced" summary="GetSitesThatBounced"/>
  <variant name="GetSitesThatBouncedWithState"
      summary="GetSitesThatBouncedWithState"/>
  <variant name="GetSitesThatUsedStorage" summary="GetSitesThatUsedStorage"/>
  <variant name="Init" summary="Init"/>
  <variant name="Read" summary="Read"/>
  <variant name="ReadPopup" summary="ReadPopup"/>
  <variant name="ReadRecentPopupsWithInteraction"
      summary="ReadRecentPopupsWithInteraction"/>
  <variant name="RemoveRows" summary="RemoveRows"/>
  <variant name="Write" summary="Write"/>
  <variant name="WritePopup" summary="WritePopup"/>
</variants>

<variants name="DIPSRedirectType">
  <variant name="Client" summary="client-side"/>
  <variant name="Server" summary="server-side"/>
</variants>

<!-- Each profile on a client is assigned a unique bucket, see go/profile-metrics.
Regular profiles start at bucket 1, we don't consider non-regular profiles. -->

<!-- LINT.IfChange(Profile) -->

<variants name="Profile">
  <variant name="Profile_1" summary="Profile bucket 1 for a client."/>
  <variant name="Profile_2" summary="Profile bucket 2 for a client."/>
  <variant name="Profile_3" summary="Profile bucket 3 for a client."/>
  <variant name="Profile_4" summary="Profile bucket 4 for a client."/>
  <variant name="Profile_5" summary="Profile bucket 5 for a client."/>
  <variant name="Profile_6" summary="Profile bucket 6 for a client."/>
  <variant name="Profile_7" summary="Profile bucket 7 for a client."/>
  <variant name="Profile_8" summary="Profile bucket 8 for a client."/>
  <variant name="Profile_9" summary="Profile bucket 9 for a client."/>
  <variant name="Profile_10" summary="Profile bucket 10 for a client."/>
  <variant name="Profile_11+"
      summary="All profiles with a bucket greater than 10 will be bucketed
               here."/>
</variants>

<!-- LINT.ThenChange(//tools/metrics/histograms/metadata/settings/histograms.xml:Profile) -->

<histogram name="Privacy.AFP.BlockList.CheckResult"
    enum="AntiFingerprintingBlockListResult" expires_after="2024-04-01">
  <owner>thesalsa@google.com</owner>
  <owner>rizvis@google.com</owner>
  <summary>
    The result of checking the anti-fingerprinting blocklist for a URL and
    deciding whether to block it. Recorded each time the blocklist is checked.

    Only clients that have opted into the blocklist feature will emit this
    metric.
  </summary>
</histogram>

<histogram name="Privacy.ClearBrowsingData.TabsEnabled" enum="BooleanEnabled"
    expires_after="2026-11-15">
  <owner>zalmashni@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Tracks whether the tabs deletion is disabled in Clear Browsing Data due to
    the user having multiple windows.
  </summary>
</histogram>

<histogram name="Privacy.CookieControlsSetting{RegularProfileFiltered}"
    enum="CookieControlsMode" expires_after="never">
<!-- expires-never: tracked as an important privacy metric. -->

  <owner>dullweber@chromium.org</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Whether third-party cookies are blocked in incognito mode or completely.
    Recorded at the Profile startup. In case that &quot;Block all cookies&quot;
    is selected in settings, this metric records BlockThirdParty.

    This histogram is only recorded {RegularProfileFiltered}.
  </summary>
  <token key="RegularProfileFiltered">
    <variant name=".RegularProfile"
        summary="from version M-109. It is recorded only for regular profiles"/>
  </token>
</histogram>

<histogram name="Privacy.DeleteBrowsingData.Action"
    enum="DeleteBrowsingDataAction" expires_after="never">
<!-- expires-never: tracked as an important privacy metric. -->

  <owner>arabm@chromium.org</owner>
  <owner>dullweber@chromium.org</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Horizontal metric to show CBD usage across various surfaces. Recorded when
    the user deletes browsing data from one of these surfaces or when the
    browser automatically deletes cookies because the user enabled
    &quot;ClearOnExit&quot;.
  </summary>
</histogram>

<histogram name="Privacy.DeleteBrowsingData.Dialog"
    enum="DeleteBrowsingDataDialogAction" expires_after="2027-01-24">
  <owner>fsenra@google.com</owner>
  <owner>alimariam@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <component>1456716</component>
  <summary>
    Cross-platform metric to show interactions with DBD Dialog. Recorded when
    the user interacts with the dialog either by opening it, changing its prefs
    from time range to different browsing data selection, or commiting deletion.
  </summary>
</histogram>

<histogram
    name="Privacy.DeleteBrowsingData.Duration.TabsClosureAnimationDuration"
    units="microseconds" expires_after="2027-01-03">
  <owner>fsenra@chromium.org</owner>
  <owner>alimariam@chromium.org</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <component>1456716</component>
  <summary>
    The microseconds that passed between the tabs closure animation being
    triggered by Delete Browsing Data and the animation ending, iOS only.

    This histogram only records metrics on machines with high-resolution clocks.
  </summary>
</histogram>

<histogram name="Privacy.DeleteBrowsingData.MigratedToNewDefaults"
    enum="Boolean" expires_after="2026-11-01">
  <owner>fsenra@chromium.org</owner>
  <owner>alimariam@chromium.org</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <component>1456716</component>
  <summary>
    Whether a user's pref values for Delete Browsing Data selection in iOS have
    been migrated to the new defaults. Only users who have never changed their
    pref values, i.e. never changed their selection in DBD, are eligible to be
    migrated to the new defaults.

    For the new version of Delete Browsing Data in iOS, each user will go
    through the migration of pref values that represent the selection in Delete
    Browsing Data once. iOS only.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.BounceCategory{DIPSRedirectType}{DIPSCookieMode}"
    enum="DIPSRedirectCategory" expires_after="2027-01-03">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    Whether a {DIPSRedirectType} redirect accessed cookies and whether its
    origin previously had user engagement. Recorded when redirecting between
    different sites, {DIPSCookieMode}.

    In M-109, the DIPS Service was updated to explicitly not collect metrics for
    non-user profiles, such as system profiles and ChromeOS Signin, LockScreen,
    and LockScreenApp profiles.
  </summary>
  <token key="DIPSCookieMode" variants="DIPSCookieMode"/>
  <token key="DIPSRedirectType" variants="DIPSRedirectType"/>
</histogram>

<histogram name="Privacy.DIPS.ClearedSitesCount{DIPSCookieMode}" units="sites"
    expires_after="2027-07-26">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    The number of sites that may have had their storage cleared by DIPS.

    If DIPS deletion is on, third-party cookies are blocked, and there are no
    url-specific exemptions by the user for the latter, then, this is the number
    of sites that have had storage cleared by DIPS. Otherwise, this number is
    the sites that would've had their storage cleared if the above conditions
    were met for all the sites.

    This is recorded every time the DIPS timer is fired, which is determined by
    the `timer_delay` parameter of the DIPS feature.

    This is only logged for site-data clearing that occurs as a result of DIPS.
    If a site contributes to this count then it has performed a potential
    tracking action (e.g. writing to storage, bouncing the user, or both)
    without the user interacting with that site before, or soon after, the
    action.
  </summary>
  <token key="DIPSCookieMode" variants="DIPSCookieMode"/>
</histogram>

<histogram name="Privacy.DIPS.Database.Operation.{DIPSDatabaseOperation}Time"
    units="ms" expires_after="2027-02-07">
  <owner>etienneb@chromium.org</owner>
  <owner>jdh@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    The time taken to execute the {DIPSDatabaseOperation} DIPS database
    operation.

    Recorded for each call to the operation.
  </summary>
  <token key="DIPSDatabaseOperation" variants="DIPSDatabaseOperation"/>
</histogram>

<histogram name="Privacy.DIPS.DatabaseEntryCount" units="entries"
    expires_after="2027-06-21">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    Number of entries present in the `bounces` table of the user's DIPS database
    (where there is 1 entry per eTLD+1). For each user profile, reported at
    profile open (which usually happens at startup). Also reported approximately
    once every 24 hours thereafter, while the profile remains open and active.
    If the database is new and therefore empty at startup, such as when a Guest
    or other OTR profile is opened, a count of 0 will be reported.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.DatabaseErrors" enum="SqliteLoggedResultCode"
    expires_after="2026-11-01">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    Errors reported by SQLite while initializing or using the DIPS database.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.DatabaseHealthMetricsTime" units="ms"
    expires_after="2025-05-27">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    The time taken to gather DIPS database health metrics. For each user
    profile, these metrics are reported at profile open (which usually happens
    at startup). They are also reported approximately once every 24 hours
    thereafter, while the profile remains open and active. Note that Guest and
    other OTR profiles (e.g. Incognito) will always startup with empty
    databases, so that may explain why some databases collect health metrics so
    quickly.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.DatabaseInit" units="attempts"
    expires_after="2027-07-27">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    Logs how many attempts it took to initialize the DIPS database. Logs a value
    of 0 if all attempts failed.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.DatabaseSize" units="KB"
    expires_after="2027-06-28">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    The size of the DIPS database file. For each user profile, reported at
    profile open (which usually happens at startup). Also reported approximately
    once every 24 hours thereafter, while the profile remains open and active.
    Note that Guest and other OTR profiles (e.g. Incognito) will always startup
    with empty databases, so that may explain why some database files are very
    small.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.DeletionLatency2" units="ms"
    expires_after="2027-08-30">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    The amount of time it takes to complete the DIPS deletion process.

    This is recorded each time the deletion of DIPS-eligible sites begins. For
    the case where the deletion is posted to the UI thread, this is the creation
    time of the StateClearer; otherwise, it is before the call to
    DIPSStorage::RemoveRows. This metric will be the result of |time when DIPS
    deletion completed - time when DIPS deletion begins|.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.Deletion{DIPSCookieMode}"
    enum="DIPSDeletionAction" expires_after="2027-07-26">
  <owner>njeunje@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    This is recorded each time we initiate a possible deletion of state on
    DIPS-eligible (incidental) sites. This metric will represents the action
    taken based on multiple conditions gating the actual deletion.

    This is recorded with {DIPSCookieMode} profiles.
  </summary>
  <token key="DIPSCookieMode" variants="DIPSCookieMode"/>
</histogram>

<histogram name="Privacy.DIPS.DIPSErrorCodes" enum="DIPSErrorCode"
    expires_after="2026-11-17">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    Tracks certain errors that DIPS may encounter when running on a client.

    This is currently recorded when expected invariants are violated, such as
    there being an open-ended time range in the database. See `DIPSErrorCode`
    for all possible codes this histogram can output.

    Since these error codes can be recorded several times by a client, using
    per-client aggregation when analyzing this metric is recommended.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.TimeFromNavigationCommitToClientBounce"
    units="ms" expires_after="2026-11-02">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    The amount of time after a navigation to a site commits until a renderer
    initiated navigation (without user activation) is started to a different
    site. Not recorded if the redirecting site does not access state (e.g.
    cookies) or takes longer than 10 seconds to initiate the redirect (bounce).

    In M-109, the DIPS Service was updated to explicitly not collect metrics for
    non-user profiles, such as system profiles and ChromeOS Signin, LockScreen,
    and LockScreenApp profiles.
  </summary>
</histogram>

<histogram name="Privacy.DIPS.{Source}.AllAccessesMatched" enum="Boolean"
    expires_after="2027-07-01">
  <owner>liu@chromium.org</owner>
  <owner>src/content/browser/btm/OWNERS</owner>
  <summary>
    Counts the number of times all cookie accesses were correctly matched and
    the number of times they weren't.
  </summary>
  <token key="Source">
    <variant name="BtmBounceDetector"/>
  </token>
</histogram>

<histogram name="Privacy.DoNotTrackSetting2" enum="BooleanEnabled"
    expires_after="never">
<!-- expires-never: tracked as an important privacy metric. -->

  <owner>mkwst@chromium.org</owner>
  <owner>msramek@chromium.org</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Whether the Do Not Track setting is enabled. Recorded at the profile open,
    only for regular profiles (not Incognito, Guest, etc.).
  </summary>
</histogram>

<histogram name="Privacy.PageInfo.SiteExceptionsScopeType"
    enum="ContentSettingPatternScope" expires_after="2026-05-03">
  <owner>olesiamarukhno@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    The pattern scope of the exceptions shown in page info to the user.

    The pattern scope is defined based on the use of wildcards in the pattern.
    Examples of scopes are origin scope (https://www.example.com:433), domain
    wildcard scope (https://[*.]example.com:433) or custom scope (https://*,
    *:433 etc)
  </summary>
</histogram>

<histogram name="Privacy.QuickDelete" enum="QuickDeleteAction"
    expires_after="2027-02-07">
  <owner>fsenra@google.com</owner>
  <owner>zalmashni@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Tracks interactions with the Quick Delete feature, including the entry
    points and the dialog.
  </summary>
</histogram>

<histogram name="Privacy.QuickDelete.TabsEnabled" enum="BooleanEnabled"
    expires_after="2026-05-09">
  <owner>zalmashni@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Tracks whether the tabs deletion is disabled in the Quick delete dialog due
    to the user having multiple windows.
  </summary>
</histogram>

<histogram name="Privacy.SiteExceptionsAdded.ContentSettingType"
    enum="ContentType" expires_after="2026-05-03">
  <owner>olesiamarukhno@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    The type of the content setting exception that was manually created in the
    site settings page.
  </summary>
</histogram>

<histogram name="Privacy.SiteExceptionsAdded.ScopeType"
    enum="ContentSettingPatternScope" expires_after="2026-05-03">
  <owner>olesiamarukhno@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    The pattern scope of the exception manually created in the site settings
    page.

    The pattern scope is defined based on the use of wildcards in the pattern.
    Examples of scopes are origin scope (https://www.example.com:433), domain
    wildcard scope (https://[*.]example.com:433) or custom scope (https://*,
    *:433 etc)
  </summary>
</histogram>

<histogram
    name="Privacy.ThirdPartyCookieBlockingSetting{RegularProfileFiltered}"
    enum="BooleanEnabled" expires_after="never">
<!-- expires-never: tracked as an important privacy metric. -->

  <owner>mkwst@chromium.org</owner>
  <owner>msramek@chromium.org</owner>
  <owner>dullweber@chromium.org</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Whether the third party cookie blocking setting is enabled. Recorded at the
    Profile startup.

    Previously recorded as the &quot;ThirdPartyCookieBlockingEnabled&quot; and
    &quot;ThirdPartyCookieBlockingDisabled&quot; actions.

    This histogram is only recorded {RegularProfileFiltered}.
  </summary>
  <token key="RegularProfileFiltered">
    <variant name=".RegularProfile"
        summary="from version M-109. It is recorded only for regular profiles"/>
  </token>
</histogram>

<histogram name="Privacy.UniversalOptOut.EligibilityChanged"
    enum="UniversalOptOutEligibilityTransition" expires_after="2027-08-01">
  <owner>zalmashni@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Recorded when background eligibility evaluation determines that a user's
    feature eligibility status has changed, capturing the transition direction
    (Ineligible to Eligible, or Eligible to Ineligible).
  </summary>
</histogram>

<histogram name="Privacy.UniversalOptOut.EligibilitySystem.Startup"
    enum="UniversalOptOutEligibilitySystem" expires_after="2027-08-01">
  <owner>zalmashni@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Records which underlying system determined profile eligibility at startup
    (Account Capabilities or Finch/Variations) and whether the profile is
    eligible or ineligible. Recorded when UniversalOptOutService is initialized.
  </summary>
</histogram>

<histogram name="Privacy.UniversalOptOut.ProfileEligibility.Startup"
    enum="BooleanEligible" expires_after="2027-08-01">
  <owner>zalmashni@google.com</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Tracks whether a profile is eligible for Universal Opt-Out at profile
    startup. Recorded when UniversalOptOutService is initialized.
  </summary>
</histogram>

<histogram name="PrivacyGuide.CanShowNTPPromo" enum="Boolean"
    expires_after="2026-10-25">
  <owner>msramek@chromium.org</owner>
  <owner>rainhard@chromium.org</owner>
  <owner>chrome-browser-privacy-team@google.com</owner>
  <summary>
    Recorded when we attempt to show a Privacy Guide NTP promotion as instructed
    by the server. True if the conditions to do so are met.
  </summary>
</histogram>

<histogram
    name="PrivacySandbox.Attestations.EstimateMemoryUsage.AttestationsMap"
    units="KB" expires_after="2026-09-22">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Records the estimated dynamic memory usage by the parsed attestations map.
  </summary>
</histogram>

<histogram
    name="PrivacySandbox.Attestations.InitializationDuration.ComponentReadyFromApplicationStart"
    units="ms" expires_after="2027-01-17">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Records the amount of time taken for the downloaded attestations file to be
    detected from application starts. The measurement ends when `ComponentReady`
    is invoked with valid inputs.

    On ChromeOS: Before M129, the login screen counted as an interruption, so
    most initialization times were being logged under
    &quot;ComponentReadyFromApplicationStartWithInterruption&quot;. This was
    fixed in M129 to count as &quot;ComponentReadyFromApplicationStart&quot;.
  </summary>
</histogram>

<histogram
    name="PrivacySandbox.Attestations.InitializationDuration.ComponentReadyFromApplicationStartWithInterruption"
    units="ms" expires_after="2027-01-17">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Records the amount of time taken for the downloaded attestations file to be
    detected from application starts with interruption during startup. For
    example, if the user has multiple profiles, a profile picker will appear
    during the startup. This is a non-browser UI that interrupts the startup
    process. The measurement ends when `ComponentReady` is invoked with valid
    inputs.

    On ChromeOS: Before M129, the login screen counted as an interruption, so
    most initialization times were being logged under
    &quot;ComponentReadyFromApplicationStartWithInterruption&quot;. This was
    fixed in M129 to count as &quot;ComponentReadyFromApplicationStart&quot;.
  </summary>
</histogram>

<histogram
    name="PrivacySandbox.Attestations.InitializationDuration.ComponentReadyFromBrowserWindowFirstPaint"
    units="ms" expires_after="2027-01-17">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Records the amount of time taken for the downloaded attestations file to be
    detected from first browser window paint. The measurement ends when
    `ComponentReady` is invoked with valid inputs.
  </summary>
</histogram>

<histogram name="PrivacySandbox.Attestations.InitializationDuration.Parsing"
    units="ms" expires_after="2026-07-26">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Records the amount of time taken to parse the attestations file from disk.
    The parsing is done on a thread pool thread, not on the main UI thread. The
    measurement starts from the invocation of the protobuf parsing function and
    ends when the function returns. Note this metric is recorded only if the
    parsing succeeds.
  </summary>
</histogram>

<histogram name="PrivacySandbox.Attestations.IsSiteAttested"
    enum="PrivacySandboxApiAllowed" expires_after="2026-06-30">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Records the status of Privacy Sandbox APIs attestation checks. Each time a
    Privacy Sandbox API attestation check takes place, the status is recorded.
    The status can be allowed, or denied with reasons. This is an aggregate
    metric across all Privacy Sandbox APIs that require attestations.
  </summary>
</histogram>

<histogram name="PrivacySandbox.Attestations.IsSiteAttested.FileSource"
    enum="PrivacySandboxAttestationsFileSource" expires_after="2026-07-26">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    This histogram is recorded each time a Privacy Sandbox API attestation is
    checked. It records whether the in-memory attestation map, which is used as
    the source of truth for the incoming attestation check, is obtained by
    parsing a pre-installed or downloaded attestation list file.
  </summary>
</histogram>

<histogram name="PrivacySandbox.Attestations.IsSiteAttested.FirstCheckTime"
    units="ms" expires_after="2026-09-22">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Records the duration from Chrome startup to the first Privacy Sandbox API
    attestation check. This metric should be recorded at most once per Chrome
    session. Here the measurement is taken from the time Chrome application
    starts.
  </summary>
</histogram>

<histogram name="PrivacySandbox.Attestations.IsSiteAttestedStatus"
    enum="PrivacySandboxApiAllowed" expires_after="2027-01-03">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Same as PrivacySandbox.Attestations.IsSiteAttested. This histogram entry is
    created because what the histogram buckets represent has changed. Its bucket
    `AttestationsFileNotYetReady` used to represent the aggregation of the
    following cases: 1. The component installer has already checked and found
    the attestations file did not exist on disk. 2. The component installer has
    not checked the attestations file yet. The file may or may not exist on
    disk.

    In this version, these two cases have been separated out. Case 1 is recorded
    in `AttestationsFileNotPresent`, which is remaned from
    `AttestationsFileNotYetReady`. Case 2 now goes into
    `AttestationsFileNotYetChecked`.
  </summary>
</histogram>

<histogram name="PrivacySandbox.Attestations.LoadAPKAssetStatus"
    enum="PrivacySandboxAttestationLoadAPKAssetStatus"
    expires_after="2026-08-09">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    This histogram is only recorded on Android. It is only recorded if feature
    `PrivacySandboxAttestationsLoadFromAPKAsset` is enabled. It records the
    loading status of Privacy Sandbox attestations component from Android APK
    assets. The loading will be aborted when an error is encountered. The
    recorded status can be either success or failure with reasons per loading
    attempt.
  </summary>
</histogram>

<histogram name="PrivacySandbox.Attestations.Parsing.Status"
    enum="PrivacySandboxAttestationParsingStatus" expires_after="2027-01-31">
  <owner>shivanisha@chromium.org</owner>
  <owner>xiaochenzh@chromium.org</owner>
  <summary>
    Records the parsing status of Privacy Sandbox APIs attestation file. Each
    time a Privacy Sandbox Attestation file is parsed, the status is recorded.
    The status can be success, or failure with reasons.
  </summary>
</histogram>

<histogram name="PrivacySandbox.ProtectedAudience.JoiningTopFrameDisplayed"
    enum="BooleanShown" expires_after="2025-01-05">
  <owner>sauski@google.com</owner>
  <owner>behamilton@chromium.org</owner>
  <summary>
    Records whether the joining site (including host fallback) for a Protected
    Audience interest group was successfully displayed. True if it was, false if
    the interest group was not displayed because no site or host could be
    determined. Recorded on a per interest group data key basis when the user
    opens the Protected Audience settings page.
  </summary>
</histogram>

</histograms>

</histogram-configuration>
