  In this work, we study ad conversion measurement, a central functionality in
digital advertising, where an advertiser seeks to estimate advertiser website
(or mobile app) conversions attributed to ad impressions that users have
interacted with on various publisher websites (or mobile apps). Using
differential privacy (DP), a notion that has gained in popularity due to its
strong mathematical guarantees, we develop a formal framework for private ad
conversion measurement. In particular, we define the notion of an operationally
valid configuration of the attribution rule, DP adjacency relation,
contribution bounding scope and enforcement point. We then provide, for the set
of configurations that most commonly arises in practice, a complete
characterization, which uncovers a delicate interplay between attribution and
privacy.
