What deterministic signals are

Deterministic signals are identity and audience data tied to a person, household or device by a direct, observed key: a login, a verified email address, a phone number, a customer number or a purchase record. The link is asserted by the data itself rather than estimated, so a match is exact, not scored. The category exists because every system in advertising issues its own identifiers - cookies, mobile advertising IDs, CRM keys - and none records that two entries describe the same person.

PPC Land's explainer on identity resolution separates the approaches by whether matching rests on a shared, observed key or is inferred from weaker signals such as IP address, device model and timing. The boundary blurs in practice. The IAB Tech Lab's identity guidance, finalised in May 2024, sets deterministic data such as hashed emails or login credentials against probabilistic data inferred from statistical models, though the guidance itself accepts that a provider may reconcile users by hashed email and still associate some signals probabilistically.

How a deterministic match works

The sequence applies to customer-list uploads and to live bidding alike.

  1. Capture. A person signs in - to a news site, a retailer's checkout, a streaming profile - or an advertiser already holds a CRM record. The key exists from that moment, with consent where the law requires it.
  2. Normalisation. Trivial differences break matches. According to the Unified ID 2.0 (UID2) documentation, an email is trimmed and lowercased, and in gmail.com addresses periods and any plus-sign suffix are removed; phone numbers must be in E.164 format. Google's Customer Match Help Center page asks for trimmed lowercase text, E.164 phone numbers and periods removed before the domain in gmail.com and googlemail.com addresses.
  3. Hashing. The cleaned value passes through SHA-256, so two parties can compare an email without exchanging it in readable form. Encoding then decides the outcome: UID2 requires a Base64 string of 44 characters, while Google's Customer Match instructions specify hexadecimal, which runs to 64. Two partners holding the same address can still fail to match.
  4. Joining. A platform either compares uploaded hashes with those of its own signed-in users, as Customer Match does, or an identity operator converts the hash into a token. For UID2, the operator adds a secret salt to form a raw UID2 and encrypts that into the token a publisher sends into the bidstream. LiveRamp's RampID rests on deterministic linkages supplied by match partners.
  5. Transmission. In real-time bidding, the token travels in the OpenRTB user.eids array, which version 2.6 (April 2022) moved from user.ext.eids. Each entry names a source domain, such as uidapi.com, plus identifiers carrying an agent-type value: 1 for a browser or device, 2 for in-app, 3 for a person-based ID constant across devices.
  6. Use. A demand-side platform (DSP) looks the token up for inclusion, suppression, frequency capping or attribution. On the buy side, advertisers, agencies and customer data platforms upload hashed lists; on the sell side, publishers run login flows and Prebid's User ID module, and supply-side platforms (SSPs) forward the values. Operators include The Trade Desk (UID2 and its European counterpart, EUID), LiveRamp, ID5, Yahoo ConnectID and the telecom-based Utiq.

Scale is bounded by sign-ins. Yahoo ConnectID covers 232 million logged-in users in the United States, and Google caps Customer Match membership at 540 days, effective April 7, 2025.

Origin and evolution

Matching records on exact keys predates programmatic buying, but the vocabulary was formalised on January 23, 2017, when Federal Trade Commission staff published a report on cross-device tracking after a November 2015 workshop. It split techniques into deterministic, relying on a consumer-identifying characteristic such as a login, and probabilistic, which infer a user from signals such as a shared IP address, and noted that companies often combine the two.

Browser and platform changes then raised the value of authenticated keys. Safari blocked all third-party cookies by default on March 24, 2020, and Apple's App Tracking Transparency took effect with iOS 14.5 on April 26, 2021. The Trade Desk began signing partners for UID2 in October 2020, opened a beta in March 2021 and committed the open-source code to an IAB Tech Lab working group in May 2021, AdExchanger reported.

Standards bodies caught up. The IAB Tech Lab circulated its Identity Solutions Guidance for public comment in October 2023, finalised it in May 2024 and, in July 2025, published ID-Less Solutions Guidance for cases where no identifier is available. Chrome went another way. Google said on April 22, 2025 that Chrome would keep third-party cookies and retired most Privacy Sandbox technologies on October 17, 2025, citing low adoption. Google also built deterministic routes of its own: on March 23, 2026 it named Roku the first publisher in Confidential Publisher Match, a service that maps Google IDs to publisher IDs inside trusted execution environments.

Why it matters to marketers

The commercial question is whether a match is correct, because mismatches distort reach, frequency and measured return. Adoption is wide: the IAB's October 30, 2025 guide to conversion APIs for connected TV cited 68% of advertisers using deterministic signals such as hashed emails and device IDs. Trade bodies treat the distinction as a standard, and Go Addressable's definition of addressable TV excludes targeting done only through IP address matching.

Part of the case rests on evidence against the alternative. Research commissioned by the Coalition for Innovative Media Measurement (CIMM) and Go Addressable and run by Truthset examined nearly one billion IP records and found IP-to-postal linkages accurate 13% of the time, with IP-to-email at 16% and the six providers tested agreeing on the same household only 6.4% of the time. FreeWheel used the same data on February 28, 2026 to argue that IP-based targeting can miss 87% of households, while disclosing that IP addresses make up 17% of targeting on its own platform. Adstra and InterMedia Advertising reported on July 15, 2026 that 23% of residential IP addresses reached the intended geography, and that device-level CTV identifiers stayed 71% consistent month to month against 57% for IP addresses.

Measurement leans on the same keys. Alliance Digitale, the French digital marketing trade group, ties deterministic attribution to identifier-based tracking.

Limitations, criticisms and open disputes

Exact is not the same as correct. Truthset's State of Data Accuracy 2026 report rated email-to-postal matches accurate 51% of the time, the strongest of three linkages it measured, and age segments accurate 13% of the time. An authenticated identifier confirms that a consenting person exists; it does not validate the demographic attributes attached to that person. Coverage is the other cost, since someone who never signs in produces no key.

The label is applied loosely. ID5 says that deterministic signals reconcile users and train models that resolve identity probabilistically, with probabilistic linkages in turn validating deterministic ones. ID5's position, recorded in a September 5, 2026 clarification, is that no single weak signal determines an identifier. Overwolf calls gameplay-derived signals deterministic, but the label attaches only to the gameplay half of its dataset, not to the third-party layer.

The evidence also has interested parties. Truthset sells accuracy scores, Adstra sells identity products and FreeWheel promotes deterministic identity; none of the studies tests how Google matches uploaded addresses against its own signed-in users.

Regulators treat the keys as personal data. The FTC restated on July 24, 2024 that hashing does not make data anonymous, citing a case in which a recipient could undo the hashing of shared emails. The European Data Protection Board's Guidelines 01/2025, adopted on January 16, 2025, hold that pseudonymised data remains personal even when the key sits with another party, though the Court of Justice of the European Union narrowed that on September 4, 2025 for recipients with no reasonable means of re-identification. Hashed emails and UID-style tokens count as pseudonymisation, not anonymisation.

Not the same as

Probabilistic signals infer a link from attributes such as IP address and user agent, according to the IAB Tech Lab guidance, and carry a confidence level rather than a verified key. First-party data describes who collected the data, not how records were linked: first-party records can be matched probabilistically, and third parties such as telecom operators can supply consented deterministic keys. Deterministic cohorts appear in the ID-Less guidance, where observed events such as ad views or newsletter sign-ups are stored in shared storage on a device and grouped without any user identifier; the word there refers to events, not matched people. Deterministic attribution, in the Alliance Digitale guidance, means rule-based credit models such as last-click, first-click, linear, time-decay and position-based.

Recent developments

Apple's iOS 27, rolling out from September 14, 2026, blocks Safari requests to domains used by UID2, ID5, LiveRamp, Permutive and Audigent, AdExchanger reported on September 29. On October 2 it reported that the list had become a remotely updated library of hundreds of companies, and ID5's chief executive, Mathieu Roche, called the change an attack on the business model of the web on October 3. Apple has given no public explanation.

A September 25, 2026 documentation change lets advertisers add unhashed IP addresses and interaction timestamps to Google Customer Match files, excluding people in the EEA, the UK and Switzerland; an address uploaded without a timestamp resolves to its latest known user.

Ownership of a main operator is also shifting. Publicis Groupe agreed on May 17, 2026 to buy LiveRamp at $38.50 a share, an equity value of $2.5 billion, and LiveRamp shareholders approved the deal on August 17, with closing expected before the end of 2026.

Timeline

  • January 23, 2017: Federal Trade Commission staff publish a report on cross-device tracking, distinguishing deterministic from probabilistic techniques
  • March 24, 2020: Safari blocks all third-party cookies by default
  • October 2020: The Trade Desk begins signing partners for Unified ID 2.0
  • March 2021: Unified ID 2.0 enters beta
  • April 26, 2021: App Tracking Transparency takes effect with iOS 14.5
  • May 2021: The Trade Desk commits the Unified ID 2.0 code base to an IAB Tech Lab working group
  • April 2022: OpenRTB 2.6 is released
  • October 2023: The IAB Tech Lab circulates its Identity Solutions Guidance for public comment
  • May 2024: The IAB Tech Lab finalises the guidance
  • July 24, 2024: The FTC restates that hashing does not make data anonymous
  • January 16, 2025: The European Data Protection Board adopts Guidelines 01/2025 on pseudonymisation
  • January 21, 2025: Display & Video 360 broadens availability of PAIR
  • April 22, 2025: Google confirms Chrome will keep third-party cookies
  • July 17, 2025: The IAB Tech Lab releases ID-Less Solutions Guidance
  • September 4, 2025: The Court of Justice of the European Union rules in EDPS v Single Resolution Board (C-413/23 P)
  • October 17, 2025: Chrome retires most Privacy Sandbox technologies
  • November 5, 2025: CIMM, Go Addressable and Truthset publish the IP address accuracy study
  • February 28, 2026: FreeWheel publishes its analysis of IP-based targeting
  • March 23, 2026: Roku is named first publisher in Google's Confidential Publisher Match
  • May 17, 2026: Publicis Groupe agrees to acquire LiveRamp
  • July 15, 2026: Adstra and InterMedia report 23% geographic accuracy for residential IP addresses
  • August 17, 2026: LiveRamp shareholders approve the Publicis deal
  • September 14, 2026: Apple begins rolling out iOS 27
  • September 25, 2026: Google Customer Match documentation is reported to accept IP addresses and timestamps
  • October 3, 2026: ID5's chief executive criticises Apple's Safari blocklist

Summary

Who: Advertisers, agencies, publishers and identity operators such as The Trade Desk (UID2), LiveRamp, ID5, Yahoo and Utiq; standards bodies including the IAB Tech Lab, Prebid.org and Go Addressable; regulators including the FTC and the European Data Protection Board.

What: Identity and audience data linked to a person, household or device by a direct, observed key such as a login or hashed email, rather than by statistical inference, used to match, target, cap and measure advertising.

When: The deterministic and probabilistic split was formalised by FTC staff on January 23, 2017; UID2 began signing partners in October 2020; the IAB Tech Lab finalised its identity guidance in May 2024; Safari's iOS 27 blocklist and Google's IP matching change landed in September 2026.

Where: Across the open internet, connected TV, mobile apps and walled gardens, in OpenRTB bid requests (user.eids), customer-list uploads and clean room joins, mainly in the United States and Europe.

Why: Cookies and device IDs cannot say that two records describe the same person, so advertising needs a shared key. Exact keys reduce guesswork, but they cover only people who authenticate, can still be wrong about attributes, and remain personal data under privacy law.