Identity and Privacy: Guides, Comparisons and Tools

Advertising identity connects an event or audience to a person, device or context. Privacy controls determine whether that connection may be made, how it is used and when it must end.

Start with the business decision and the data flow. Identify who owns the customer relationship, who receives each signal, who runs the decisioning system, and what evidence supports the result. A vendor feature list alone cannot settle those questions.

This guide brings together the reference material for this topic. Comparisons describe different operating models, rather than declaring a universal winner. The linked pages retain source dates, vendor-claim labels and the limits of each example. Read those limits before applying a figure or architecture to your own organization.

Two things to read from the table. First, the retirement was not a surprise: Google had spent 2024 moving from deprecation to "choice", and the CMA's June 2025 testing summary reported publisher revenue falling by around 30% when Privacy Sandbox tools replaced cookies (PPC Land, 18 October 2025, citing the CMA). Second, an earlier removal target is not confirmation of every API’s availability. As of the status page's 14 August 2026 update, the deprecated APIs still appear without a removal milestone, so a team should test rather than assume that document.browsingTopics() has gone from every Chrome 150 build.

Read the full privacy sandbox and cookies: identity options for 2026 guide for context, sources and limitations.

Sources for status: Privacy Sandbox blog, 17 October 2025; Privacy Sandbox status page, updated 14 August 2026.

Read the full privacy sandbox and cookies: identity options for 2026 guide for context, sources and limitations.

The arithmetic matters for planning. Roughly a fifth of global browsing was already cookieless before 2025 and remains so. Chrome's decision froze the open web's addressability at that level rather than cutting it further.

Read the full privacy sandbox and cookies: identity options for 2026 guide for context, sources and limitations.

The table lists the solutions a buyer or publisher will meet in 2026. Adoption figures are only given where a dated source exists; "n/d" means no disclosed figure.

A cookie is set and read by a domain and dies with Safari, Firefox, Incognito and cookie clearing. UID2 is a token derived from a hashed email, so it survives across devices and browsers but only exists where a user has logged in or supplied an email. The practical difference is coverage: cookies reach most Chrome users without a login; UID2 reaches authenticated users on any browser. UID2 also moves the privacy risk from the browser to the operator. The public operator is run by The Trade Desk; a private operator keeps the hashing and token generation inside your own environment (UID2 docs). For an EU deployment the relevant framework is EUID, which is "driven by the General Data Protection Regulation" and the TCF rather than US state law (EUID docs).

The two solve different problems. UID2 and EUID are deterministic: no email, no ID. ID5 combines publisher signals and hashed emails where present with probabilistic linking, which is why its site coverage is wide and why its EU position depends on the publisher's consent capture rather than on a login (PPC Land, 22 August 2026). Deterministic IDs give higher match quality on authenticated inventory; ID5 gives reach on unauthenticated inventory. Most buyers in 2026 pass several IDs in the OpenRTB user.eids array and let the bidder choose (IAB Tech Lab, OpenRTB 2.6).

Read the full privacy sandbox and cookies: identity options for 2026 guide for context, sources and limitations.

Four decisions set the boundaries. None of them is about Privacy Sandbox. All of them apply to its replacements.

Read the full privacy sandbox and cookies: identity options for 2026 guide for context, sources and limitations.

Three design rules follow from the legal frame above.

Read the full privacy sandbox and cookies: identity options for 2026 guide for context, sources and limitations.

Every field in a bid request has to pass two tests.

1. ePrivacy: did you touch the device? Article 5(3) of Directive 2002/58/EC requires consent to store information, or gain access to information already stored, on a user's terminal equipment, unless strictly necessary for a service the user requested (Directive 2002/58/EC). The CJEU confirmed in Planet49 on 1 October 2019 that this applies whether or not the information is personal data, that pre-ticked boxes are not consent, and that users must be told the cookie duration and which third parties may access it (CJEU C-673/17). The EDPB's Guidelines 2/2023, finalized in October 2024, extend "access" to pixels, URL and link tracking, local processing that reports back, and identifiers derived from the device (EDPB, Guidelines 2/2023). Reading a cookie ID, an advertising ID or a fingerprint to populate a bid request is covered.
2. GDPR: do you have a lawful basis for each purpose? Once data is personal, Article 6 applies to every purpose, and Article 9 to special categories. Three routes have been closed for personalized advertising on the open web. Contract: the DPC's Meta decisions of 4 January 2023 (DPC). Legitimate interest: the CJEU in Meta v Bundeskartellamt on 4 July 2023 treated Article 6(1) as "an exhaustive and restrictive list" to be read narrowly, and TCF v2.2 removed the option for purposes 3 to 6 (CJEU C-252/21; IAB Europe). Consent-or-pay without a real alternative: EDPB Opinion 08/2024 of 17 April 2024 and the Commission's €200 million DMA fine on Meta of 23 April 2025 (EDPB; Commission).

The practical result is that, for EU open-web traffic, consent recorded in the TC String is the only basis that reliably supports identifiers in a bid request, and legitimate interest survives only for measurement and non-personalized purposes. The identifiers themselves are compared in the identity and privacy hub; the US rules for regulated data sit in the ad tech compliance hub.

Read the full gdpr, eprivacy and rtb: tcf 2.2 bid request consent signals guide for context, sources and limitations.

The table maps OpenRTB 2.6 fields to the test each one has to pass. Field names and descriptions are from the IAB Tech Lab specification (OpenRTB 2.6).

Three rules follow. First, context fields are always safe; identifier fields are never safe without a signal. Second, "consent for purpose 1" is the gate for anything read from the device, and it is a separate question from the advertising purposes. Third, the IP address is both an identifier and a routing necessity, which is why truncation, not removal, is the practice.

Read the full gdpr, eprivacy and rtb: tcf 2.2 bid request consent signals guide for context, sources and limitations.

The core segment is a bit field decoded in order (IAB Tech Lab, Consent string and vendor list formats v2).

Read the full gdpr, eprivacy and rtb: tcf 2.2 bid request consent signals guide for context, sources and limitations.

1. Where the data sits. Warehouse-native rooms (Snowflake, Databricks, AWS Clean Rooms) query data where it already lives. Walled-garden rooms (Google Ads Data Hub, Amazon Marketing Cloud) hold the platform's event data and let you bring yours in. Vendor-hosted rooms (LiveRamp, InfoSum, Optable, Decentriq) run the join on the vendor's infrastructure, sometimes with the data staying in each party's own cloud account.

2. Who runs the compute. In AWS Clean Rooms the "member who can query" runs the job and a configurable payer is billed (AWS Clean Rooms pricing). In Snowflake the analysis runner pays (Snowflake docs). In enclave rooms the compute is a trusted execution environment that neither party nor the cloud operator can inspect (Microsoft Learn).

3. Which privacy technique limits the output. Allowed-column lists, query approval, minimum aggregation thresholds, noise injection or formal differential privacy, and cryptographic matching so that no party holds the other's cleartext identifier. AWS offers all of these as configuration; its differential privacy went GA on 10 April 2024 (AWS What's New, 10 April 2024) and reached the Spark engine on 16 July 2025 (AWS doc history).

4. Which protocol connects the room to partners. A room that joins your data with one partner's is a project; a room that can produce PAIR IDs or accept ADMaP requests is infrastructure.

Read the full data clean room architecture: 12 providers compared (2026) guide for context, sources and limitations.

"n/d" means the vendor publishes nothing on that cell as of 17 October 2026; "vendor claim" marks figures from the vendor's own site.

Read the full data clean room architecture: 12 providers compared (2026) guide for context, sources and limitations.

The differences are structural.

Membership. AWS requires every member to hold an AWS account, although since 1 December 2024 a member's data can live in Snowflake or Athena (AWS doc history). Snowflake requires every party to be on Snowflake, with Enterprise Edition for data providers, but clouds and regions can differ (Snowflake docs).

Privacy controls. AWS is more prescriptive: analysis rules are first-class objects, minimum aggregation thresholds and comparison controls can now be set inside custom rules (13 August 2026), and differential privacy is a managed feature (AWS doc history). Snowflake controls exposure through the data offering specification and approved templates; its differential privacy capability came from LeapYear and was in preview at GA in March 2024 (InfoWorld, 28 March 2024).

Machine learning. AWS Clean Rooms ML has shipped lookalike modeling (3 April 2024), custom models (7 November 2024), incremental and distributed training (1 July 2025) and synthetic datasets (30 November 2025) (AWS doc history). Snowflake rooms run approved Python code specs (Snowflake docs).

Read the full data clean room architecture: 12 providers compared (2026) guide for context, sources and limitations.

Minimum requirements, derived from what the managed rooms above expose as features:

Read the full data clean room architecture: 12 providers compared (2026) guide for context, sources and limitations.

Is Google still getting rid of third-party cookies? No. On 22 April 2025 Google said Chrome would keep its current third-party cookie settings and would not introduce a standalone prompt (Privacy Sandbox blog, 22 April 2025). The CMA released Google's commitments on 17 October 2025 and closed its case (CMA). Incognito still blocks third-party cookies, and users can block them in settings.

What Privacy Sandbox APIs still exist? CHIPS (partitioned cookies, Chrome 114+), FedCM (Chrome 108+) and Private State Tokens continue; the Storage Access API (Chrome 119+) is also supported. Topics, Protected Audience, Attribution Reporting, Private Aggregation, Shared Storage, SelectURL and Related Website Sets were retired on 17 October 2025, deprecated in Chrome 144 (13 January 2026) and set for removal in Chrome 150 (30 June 2026) (Privacy Sandbox status page, updated 14 August 2026; Chromium Dash).

What is the difference between UID2 and EUID? Both are open-source frameworks that turn a hashed email or phone into a rotating token, and both have a public operator run by The Trade Desk plus a private-operator option. UID2's consent model follows US state law such as the CCPA; EUID's is "driven by the General Data Protection Regulation" and the IAB TCF, with a Transparency and Control Portal for opt-out, and it uses a separate namespace (EUID docs). EU and UK publishers use EUID.

Is ID5 better than UID2? They are different tools. UID2 and EUID are deterministic and need an email or phone, so they work on authenticated traffic. ID5 links publisher signals and hashed emails where present with probabilistic methods, so it reaches unauthenticated pages; Sincera counted it on about 100,000 sites in January 2025, a vendor-selected figure (PPC Land, 22 August 2026). Most stacks pass both in user.eids and let the bidder weigh them.

Do universal IDs comply with GDPR? They can, if the controller has a lawful basis for the hashed identifier and the token, passes a valid TCF signal, and can prove it. The CJEU held on 7 March 2024 that a consent string is itself personal data (CJEU C-604/22), and the Norwegian DPA's October 2026 Xandr decision found that a platform cannot rely on another party's consent (EDPB, 16 October 2026). Compliance is a property of your consent records and contracts, not of the ID format.

• Privacy Sandbox and Cookies: Identity Options for 2026: Privacy Sandbox retirement, API status and third-party cookies: compare first-party data, consented IDs and contextual approaches with dated sources.
• GDPR, ePrivacy and RTB: TCF 2.2 Bid Request Consent Signals: What a bid request may contain under GDPR and ePrivacy, TCF 2.2 and 2.3 signals field by field, the IAB Europe rulings, DPA fines, annotated OpenRTB JSON.
• RTB Display Ads in Email Newsletters: 2026 Benchmarks: Programmatic newsletter advertising connects an email placement with an ad decision and a measurement workflow.
• RTB Performance Strategies for First-Party Media Buyers: First-party media buying improves when the team can explain why a particular audience, supply path and bid are eligible for a campaign.

• Data Clean Room Architecture: 12 Providers Compared (2026): Data clean rooms explained: AWS, Snowflake, Databricks, Google ADH, AMC, Azure, LiveRamp, InfoSum, Optable, Decentriq and self-hosted, with prices.
• Data Clean Room vs CDP: Which One Do You Need?: Data Clean Room vs CDP: a practical guide to the definitions, operating decisions, measurement and evidence you need.

1. PPC Land, 18 October 2025
2. Privacy Sandbox blog, 17 October 2025
3. Privacy Sandbox status page, updated 14 August 2026
4. UID2 docs
5. EUID docs
6. PPC Land, 22 August 2026
7. OpenRTB 2.6
8. Directive 2002/58/EC
9. CJEU C-673/17
10. EDPB, Guidelines 2/2023
11. DPC
12. CJEU C-252/21
13. IAB Europe
14. EDPB
15. Commission
16. IAB Tech Lab, Consent string and vendor list formats v2
17. AWS Clean Rooms pricing
18. Snowflake docs
19. Microsoft Learn
20. AWS What's New, 10 April 2024
21. AWS doc history
22. InfoWorld, 28 March 2024

• October 18, 2026: aligned the search title and heading, expanded the source-linked guide and reviewed its page groups.
• October 17, 2026: assembled this guide from the approved reference pages, retaining their source links and limitations.