Shared Storage: privacy-preserving experiments, now being retired

type SharedStorage = {
  worklet: { addModule: (url: string) => Promise<void> };
  set: (key: string, value: string, options?: { ignoreIfPresent?: boolean }) => Promise<void>;
  run: (operation: string, options?: { data?: Record<string, unknown> }) => Promise<void>;
};

export const recordExperimentExposure = async (variant: string): Promise<boolean> => {
  const sharedStorage = (window as { sharedStorage?: SharedStorage }).sharedStorage;
  if (!sharedStorage) return false;
  await sharedStorage.worklet.addModule("/experiment-worklet.js");
  await sharedStorage.set("variant", variant, { ignoreIfPresent: true });
  await sharedStorage.run("report-exposure", { data: { variant } });
  return true;
};

What

Before anything else: don't build on this. Shared Storage was a Privacy Sandbox API that let a site write cross-site data accessible only from an isolated worklet, which could act on it (e.g. picking which of several URLs to render) without ever exposing the raw values back to the page. Chrome announced its deprecation in version 144 and plans full removal of the underlying implementation by version 152 — this post documents how it worked and why it's going away, not a pattern to adopt.

Why it matters

Shared Storage existed to answer a specific question: how do you run something like an A/B test or frequency-capped creative rotation across sites, using data that persists across origins, without giving any single page script-readable access to another site's data — the thing third-party cookies made trivial and privacy-invasive at the same time. The design was genuinely clever: sharedStorage.set() writes are unreadable from the page; only a registered worklet module can get() them, and only from inside output-gated operations (run(), selectURL()) whose results are similarly constrained, so no script ever gets a readable cross-site value directly.

It never got the adoption that would have made it durable. In April 2025 Chrome reversed course on deprecating third-party cookies entirely — the change that was Shared Storage's original reason to exist — and by October 2025 announced it was retiring the broader Privacy Sandbox ads bundle (Topics, Protected Audience, Attribution Reporting, and Shared Storage among them), citing low ecosystem adoption and the fact that other browser engines never signaled intent to implement it. As of this writing, Chrome has deprecated Shared Storage as of version 144, with the underlying implementation slated for removal by version 152. If you're evaluating this API today, the honest answer is: its only implementer is actively shutting it down.

How it works

For the record, here's the shape the API actually had:

• recordExperimentExposure reads window.sharedStorage through a narrow cast — this was never in TypeScript's DOM lib, since it was a Chrome-only, non-standard proposal from the start, not a gap that was ever going to be filled.
• sharedStorage.worklet.addModule(url) loads a worklet script — a separate file, running in its own isolated global scope with no access to the page's variables — that defines the operations (run, selectURL) available to call. A SharedStorageWorklet could only ever have one module added to it, by design, to limit what a single origin's worklet could do.
• sharedStorage.set() writes a cross-site-persistent key/value pair from the main page; { ignoreIfPresent: true } makes the write a no-op if the key already exists, useful for "assign a variant once, keep it stable" semantics.
• sharedStorage.run("report-exposure", { data }) invokes a worklet operation by name, passing data in — the operation itself (defined inside the worklet module, not shown here since it executes in a different global scope entirely) is what could read previously-set() values via this.sharedStorage.get(), something only available inside the worklet, never on the page.

Gotchas

• This was never cross-browser. MDN lists Firefox as explicitly opposed to the specification; it shipped in Chromium only, behind Privacy Sandbox enrollment.
• It is being removed, not just deprecated. Chrome 150 rejects all API calls behind a field trial; Chrome 152 replaces the underlying implementation with a stub. Code written against this API will stop working in current Chrome well before this post's publish date.
• Data written to Shared Storage had a 30-day expiry from last write — it was never meant as long-term storage, only as a rolling window for experiment/measurement state.
• If you're maintaining code that still calls this API: there is no drop-in replacement. Chrome's own guidance points affected sites toward first-party data and server-side experimentation instead of a like-for-like Privacy Sandbox substitute.

Related

• Private Aggregation API — Shared Storage's usual pairing for turning worklet-computed results into noised, aggregate reports; deprecated and being removed on the same timeline.
• Server-side experimentation (feature flags, server-rendered variant assignment) — the practical replacement for cross-site experiment logic now that the client-side Privacy Sandbox approach is being wound down.