BYOD targeting, short for "bring your own data" targeting, is the practice of an advertiser loading its own audience data into a buying platform and using it to decide which people, households or devices see its ads. The data is usually first-party: customer relationship management (CRM) records, loyalty files, app events or website visitors. Sometimes it is licensed from a partner. The platform might be a demand-side platform (DSP) such as Amazon DSP or The Trade Desk, a connected television (CTV) seller, a retail media network or a walled garden such as Meta.

The practice exists because a platform's own segments describe the platform's view of people, not the advertiser's. A car maker knows which households bought a vehicle in 2022 and are due for a lease renewal; no DSP does. BYOD targeting carries that knowledge into the auction without the advertiser handing over the underlying list in readable form.

The abbreviation is informal. Platforms rarely use it in documentation, preferring labels such as Customer Match (Google), Custom Audiences (Meta and OpenAI), advertiser audiences or simply first-party audiences. The mechanics underneath are close to identical.

How the data gets in

The process starts with normalisation and hashing. Email addresses are lowercased and stripped of spaces, phone numbers are converted to E.164 international format, and each value is run through SHA-256, a one-way function that turns it into a 64-character string. Google's Display & Video 360 (DV360) help centre describes exactly these steps, and accepts either pre-hashed files or plain text that DV360 hashes itself. As the PPC Land clean room explainer notes, inconsistent normalisation is the most common reason a match rate collapses.

The hashed file then reaches the platform by one of four routes. The oldest is a manual upload through an interface or a secure file transfer protocol (SFTP) drop. The second is an application programming interface (API); Google forced Customer Match uploads onto its Data Manager API from April 1, 2026, with limits of 10,000 audience members per request. The third is a customer data platform (CDP) connector. According to Amazon Ads, CDPs including Adobe, Hightouch, Salesforce and Tealium were integrated with Amazon DSP and Amazon Marketing Cloud on October 25, 2023, replacing hand-prepared files with automatic hashing and streaming. The fourth is an onboarder or clean room, such as LiveRamp, which converts personal data into its pseudonymous RampID before it reaches a buying platform.

Other identifiers travel too. Samsung's DSP, according to its help centre, accepts Tizen identifiers for advertising (TIFA) from Samsung televisions and IP address lists written as single addresses, ranges or CIDR masks. Microsoft's Invest DSP documents three routes: browser pixels, batch server-side segment uploads and a streaming API.

What happens at auction time

The advertiser's list never travels inside a bid request. Instead, the platform matches each hashed record against identities it already recognises and stores the result as a segment. When an impression is offered, the exchange sends an OpenRTB bid request carrying identifiers in the user object, including the buyeruid field that cookie syncing populates and the extended identifiers (eids) array that holds values such as Unified ID 2.0 (UID2). The DSP looks those identifiers up, finds a segment membership and bids, adjusts a bid or declines. OpenRTB, now stewarded by IAB Tech Lab, standardises the fields; it does not standardise how a DSP stores advertiser segments.

Two numbers govern what is left at the end. The match rate is the share of uploaded records the platform recognises. A 60% rate means 60,000 of 100,000 emails were recognised, and losses of 40% to 70% between platforms have been cited by a vendor that sells curation. The minimum audience size sets whether a matched list can run at all. Google cut its thresholds to 100 active users across Search, Display and YouTube. OpenAI requires 25,000 matched users for an inclusion audience, according to coverage of the LiveRamp integration with ChatGPT ads. Membership also expires: DV360 drops members not refreshed within 540 days.

Restrictions vary by seller. DV360 contact-information lists serve only on Google Ad Manager and YouTube inventory, not third-party exchanges, according to Google's help centre.

Origin and evolution

The idea predates the abbreviation. Facebook formally launched Custom Audiences around September 20, 2012, letting businesses upload hashed emails, phone numbers or user IDs, according to TechCrunch. Google followed with Customer Match on September 28, 2015, initially email-only with a 1,000-address minimum.

The phrase "bring your own data" itself surfaced in mobile programmatic trading. Victor Malachard, co-founder of byyd, the company Adfonic rebranded as in March 2014, wrote in a column for Fourth Source that BYOD meant advertisers overlaying their own first-party data onto byyd's audience engine. He adapted the corporate IT term "bring your own device". Byyd ceased trading in 2016, but the shorthand stayed in circulation.

The open-web DSPs formalised the practice as cookies weakened. The Trade Desk launched Galileo in January 2023, taking CRM data from CDP and clean room partners and matching it against UID2. StackAdapt released a Snowflake Native App in July 2025 so marketers could map warehouse tables to campaigns. On September 28, 2026, Amazon Ads redesigned its Ads data manager around three tabs for sources, datasets and destinations.

Why it matters

BYOD targeting decides who controls the most valuable input in a campaign. A buyer that relies on platform segments rents someone else's view of the market; one that brings its own data keeps a reusable asset. Infillion's guide for DSP buyers asks whether a platform lets advertisers bring customer data without locking it in, co-mingling it or using it "for their own gain".

It also shapes CTV, where premium sellers limit data sharing. Netflix told buyers at its May 2026 upfront that advertiser data can be matched against its viewers in Snowflake and Amazon Web Services clean rooms, with InfoSum added by the end of 2026. Google's Confidential Publisher Match, with Roku as its first partner in March 2026, aims to raise match rates for DV360 buyers targeting Roku households. Supply-side platforms are also opening the door: Magnite's ClearLine Activate added advertiser first-party data alongside 27 data partners in September 2026.

Limitations and disputes

The first problem is accuracy. A list is only as good as the identity links behind it. Truthset figures cited in PPC Land's coverage of an Adstra study put email-to-postal linkage accuracy at 51% and IP-to-email at 16%, and found that only 23% of residential IP addresses reached their intended target. Every figure comes from firms that sell identity verification. The Video Advertising Bureau's identity guide urges buyers to ask how vendors define a match, without offering a benchmark.

The second is law. Hashing is pseudonymisation, not anonymisation. On September 26, 2018, the Bavarian Higher Administrative Court in Munich (case 5 CS 18.1157) upheld an order requiring an online shop to delete a Custom Audience list, according to law firm Taylor Wessing. It found that Facebook could reattach hashed emails to users without disproportionate effort, that consent was required and that Facebook was not acting as a mere processor. Facebook began requiring advertisers to state where uploaded contact data came from on July 2, 2018, according to TechCrunch. The court's reasoning has not been uniformly adopted across Europe.

The third is leakage of control. Uploading a list to a walled garden gives that platform a signal it did not have. LiveRamp's RampID faces a February 2024 Open Rights Group complaint over whether the identifier is truly anonymous, and Publicis agreed to buy LiveRamp on May 17, 2026, raising questions about the neutrality of a central onboarder. Clean rooms are offered as the answer, yet the Federal Trade Commission (FTC) warned on November 13, 2024 that they are not privacy-protective by default.

Not the same as

Bring your own device. The original BYOD, an IT policy letting employees use personal phones and laptops for work. It has no advertising meaning, but the two share search results.

Third-party data and audience marketplaces. Third-party segments are compiled by companies with no direct relationship to the people described, and are bought through marketplaces inside DSPs, usually for a fee on top of media. BYOD targeting uses data the advertiser already holds or has licensed directly. Amazon Audiences applied to Netflix inventory are a platform's data, not the buyer's.

Data activation. Activation is the broader step of making any dataset usable in a channel, including email, personalisation and measurement. BYOD targeting is one activation use, limited to selecting ad audiences.

Universal IDs. UID2, RampID and similar identifiers are the plumbing that lets a hashed email become something recognisable in a bid request. They enable BYOD targeting but are not the data itself.

Recent developments

Activity has accelerated through 2026. Hightouch and The Trade Desk launched Exposure Log Matching on June 1, 2026, resolving impression logs back to the brand's own customer keys. OpenAI added custom audiences in a gated rollout spotted on May 14, 2026, accepting raw or SHA-256 hashed emails and phone numbers. LiveRamp followed on September 28, 2026, letting CRM lists reach ChatGPT ads in 11 markets.

Retailers are moving the other way, pushing their own data outward. Walmart made its shopper audiences available in Yahoo DSP on May 28, 2026, without saying whether advertisers can combine them with their own lists. As of October 2026, Google's first-party data rules also allow IP addresses as a Customer Match key outside the European Economic Area, the UK and Switzerland, though not in DV360.

Timeline

  • January 2012 - OpenRTB 2.0 is released with the buyeruid field, later used to match synced identifiers against segments.
  • September 2012 - Facebook formally launches Custom Audiences, matching hashed customer emails, phone numbers and user IDs.
  • March 2014 - Adfonic rebrands as byyd, whose co-founder later promotes "bring your own data" in mobile programmatic.
  • September 28, 2015 - Google launches Customer Match on Search, YouTube and Gmail, with a 1,000-email minimum.
  • July 2, 2018 - Facebook requires advertisers to declare the source and consent basis of uploaded contact lists.
  • September 26, 2018 - The Bavarian Higher Administrative Court rules that uploading hashed emails to Custom Audiences requires consent.
  • January 5, 2023 - The Trade Desk announces Galileo for first-party data matching.
  • October 25, 2023 - Amazon DSP and Amazon Marketing Cloud integrate with nine CDP providers.
  • November 13, 2024 - The FTC says clean rooms are not privacy-protective by default.
  • July 24, 2025 - StackAdapt releases its Snowflake Native App.
  • December 9, 2025 - Google launches the Data Manager API.
  • March 23, 2026 - Google announces Confidential Publisher Match with Roku.
  • April 1, 2026 - Customer Match uploads through the Google Ads API stop working.
  • May 14, 2026 - OpenAI custom audiences are spotted in a gated rollout.
  • June 1, 2026 - Hightouch and The Trade Desk launch Exposure Log Matching.
  • September 9, 2026 - Magnite adds advertiser first-party data to ClearLine Activate.
  • September 28, 2026 - Amazon Ads redesigns Ads data manager; LiveRamp connects CRM lists to ChatGPT ads.

Summary

Who. Advertisers and their agencies supply the data; onboarders and clean room operators such as LiveRamp, Snowflake and InfoSum prepare it; DSPs including Amazon DSP, The Trade Desk, DV360 and StackAdapt, sellers such as Netflix, Roku and Magnite, and walled gardens including Meta, Google and OpenAI accept it. Courts and regulators, including the Bavarian Higher Administrative Court and the FTC, set the limits.

What. The use of an advertiser's own or directly licensed audience data, typically hashed emails, phone numbers, device IDs or IP addresses, to select or exclude who sees ads inside a buying platform, rather than relying on the platform's or a third party's segments.

When. Customer list matching began with Facebook Custom Audiences in 2012 and Google Customer Match in 2015. The "bring your own data" label appeared in mobile programmatic around 2014, and open-web DSPs formalised onboarding from 2023 as cookies weakened.

Where. In DSPs, CTV platforms, retail media networks, social and search platforms and, since 2026, AI chat advertising, with data arriving through uploads, APIs, CDP connectors and clean rooms. Legal treatment is stricter in the European Union than in the United States.

Why. Advertisers hold knowledge about their customers that no platform has, and want to keep control of it. The practice is limited by match rates, identity accuracy, consent law and the risk of handing a valuable signal to the platforms that sell the media.