PAIR

PAIR (Publisher Advertiser Identity Reconciliation) is an IAB Tech Lab protocol, originally Google's, that lets an advertiser and a publisher target the customers they share without either handing over its raw list.

Google's ads team built the protocol before IAB Tech Lab adopted it. It relies on commutative encryption: an email encrypted with the advertiser's key and then the publisher's key gives the same result as the reverse order. Both parties can therefore match double-encrypted IDs without ever decrypting them (IAB Tech Lab, PAIR specification). The matching runs offline in one data clean room, or in two that work together. The publisher also keeps a rotating secret key, and only IDs encrypted with it leave the clean room.

The online step uses the result in bidding. The publisher's SSP attaches the encrypted IDs to bid requests, and the advertiser's DSP recognises the ones on its list. The specification sets four design goals: no party can see cleartext personal data, learn identities outside its own data, learn which of its customers matched, or reuse what it learns in another context. It recommends elliptic-curve ciphers such as Curve25519.

Example: A hotel group and a travel publisher each load hashed emails into their clean rooms. PAIR finds 180,000 shared customers. The publisher's SSP adds their encrypted IDs to bid requests, and the hotel's DSP bids on those readers without either company seeing the other's list.

Related terms: clean room, hashed email, ADMaP, identity resolution, second-party data, UID2.

Authoritative source: IAB Tech Lab, "PAIR (Publisher Advertiser Identity Reconciliation)" specification (GitHub, updated 31 March 2026).

Read the full guide: Clean room architectures compared.