privacy preserving ad click attribution