The Interactive Advertising Bureau published Data Clean Rooms in Commerce in September 2026, a 13-page framework that sorts 14 common retail and commerce data use cases by whether they actually require a clean room. Five are classed as use cases a clean room typically makes possible. The other nine, including attribution, incrementality and media mix analysis, are described as work that existing tools can often handle, with a clean room adding value only when the data sits across separate organisations.

In Short

The IAB, an advertising trade group, wrote a guide that helps shops, brands and agencies decide when they really need a "clean room," a locked-down system that lets companies compare customer data without handing it to each other. It matters because clean rooms cost money, staff time and technical work, and the guide says many common jobs, like counting who saw an ad or grouping customers, can often be done with tools a company already has. The practical change is that the guide starts with the business question first, and treats the clean room as one possible answer rather than the default.

A framework built around the question, not the product

The document's own framing is direct about its purpose. According to the IAB, the goal is to help retailers, brands, agencies, publishers and technology partners "move beyond asking, 'What is a data clean room?' and instead answer the more practical question, 'When and why should an organization use a data clean room?'"

That shift is presented as a response to a market that has grown faster than its own vocabulary. "As clean room adoption has grown, so has confusion," the report states. "Organizations often struggle to determine when a data clean room is necessary, how it differs from existing analytics and reporting tools, and which business use cases justify the investment in time, cost, and technical resources."

The report is not a survey. It contains no adoption rates, no spending figures, no pricing benchmarks and no respondent counts. Its numbers are structural: five screening questions, two categories, 14 use cases and a contributor list running to 71 named individuals. Readers looking for market data will not find it here. What the document offers instead is a taxonomy, and a fairly blunt one.

Each page footer reads "Published September 2026 | IAB.COM." The cover carries the logos of the German Association for the Digital Economy (BVDW), IAB Australia, IAB Canada and IAB Europe alongside the IAB mark. IAB Australia posted a page about the framework on its own site dated September 30, 2026, under its Research & Resources section, with a link to download the PDF.

The definition it borrows

The framework does not write its own definition. It adopts the one from IAB Tech Lab, quoted in full: "A data clean room is a secure collaboration environment which allows two or more parties to leverage data assets for mutually agreed upon uses while guaranteeing enforcement of strict data access limitations."

The report then explains why commerce in particular has leaned on these environments. "Many commerce use cases require analyses at the event, individual, or identifier level rather than simply sharing aggregated reports," according to the IAB. A clean room provides a governed environment where these granular analyses can take place "without requiring participating organizations to exchange underlying datasets."

A single sentence on interoperability appears in that opening section, describing it as "an important consideration when organizations seek data collaboration across multiple environments." The idea returns with more weight in the conclusion.

One passage carries implications beyond marketing operations. "Importantly, a data clean room is a technical and governance mechanism for enabling privacy-enhancing collaboration," the report states. "Organizations remain responsible for ensuring that any data collaboration complies with applicable laws, contractual obligations, and organizational governance requirements. The use of a data clean room does not, by itself, establish a legal basis for processing or sharing data."

The IAB Australia page repeats the point in shorter form, describing a clean room as "a technical and governance mechanism" that "does not, by itself, establish a legal basis for processing or sharing data."

The statement lines up with a warning US regulators issued nearly two years earlier. In November 2024, the Federal Trade Commission's technology staff warned that data clean rooms are not a privacy silver bullet, writing that they "are not rooms, do not clean data, and have complicated implications for user privacy," and that "unlawful disclosure or use of data is unlawful regardless of whether a DCR is involved." An industry body now putting a similar disclaimer into its own guidance narrows the gap between how clean rooms are sometimes sold and how regulators describe them. For European contributors in particular, the phrase "legal basis" carries a specific meaning under the GDPR, where a technical safeguard is not one of the grounds for processing.

Why commerce depends on shared data

The report sets out four reasons it gives for clean rooms becoming important in commerce. "No single organization has a complete view of the customer," it states. Retailers, brands, agencies and media platforms each hold a different piece of the customer journey.

The division of data is spelled out. According to the IAB, retailers contribute "significant purchase, basket, and shopper behavioral data"; brands contribute customer, campaign and product data; and media platforms and agencies contribute ad exposure and delivery data.

The third reason is a constraint. "Organizations cannot simply exchange raw customer data," the report states, citing privacy requirements, contractual obligations, competitive concerns and internal governance policies. The fourth is a description of the measurement problem that has shaped commerce media for years: "Commerce media measurement is inherently fragmented," because customer interactions, media exposure and purchase outcomes often reside in different organisations.

Five questions before signing a contract

The most practical part of the document is a five-question screen. The report opens it with an unusual admission for an industry body: "The opportunity cost of engaging in a data clean room can be high if not properly thought through and scoped."

The questions, in the report's own wording, are:

  1. "What business question are we trying to answer?"
  2. "Does answering that question require data from multiple parties?" If only one party's data is needed, according to the IAB, "a clean room may not be necessary."
  3. "Does the use case require privacy-enhanced collaboration on sensitive data?"
  4. "Can existing capabilities answer this question?" The report names retailer reporting dashboards, analytics and attribution platforms, reach and frequency tools and brand measurement studies as alternatives.
  5. "Can we operationalize the analysis?"

The third question carries the most technical weight. The report separates a governed compute environment from simpler alternatives. "Identity resolution, onboarding, APIs, or other privacy-enhancing technologies may be sufficient when the objective is simply to match or transfer an audience," it states. "A data clean room is more relevant when organizations need to perform governed analysis or computation across data sets without exposing underlying records."

In other words, matching an audience and moving it somewhere is not, by itself, a reason to buy clean room capacity. Computation across two parties' records without either side seeing the other's rows is.

The fifth question addresses cost, without putting a figure on it. "Depending on the platform and use case, data clean room collaborations can require substantial investments in platform fees, data science and technical resources, and ongoing operational management," according to the IAB. Organisations, it says, need to count "both the direct and indirect costs required to prepare data, execute analyses, interpret outputs, and translate findings into business decisions."

Enabled versus enhanced

The report explains why it rejects the usual way clean room use cases are grouped. "Data clean room use cases are often organized by business functions such as planning, activation, measurement, or optimization," it states. "While those categorizations can be helpful, they do not help organizations determine when a data clean room is necessary."

Instead, the 14 use cases are split by the role cross-party collaboration plays in them. Each entry follows the same template: what it is, how or when a clean room adds value, and the typical outputs.

The five that typically depend on a clean room

The first group is labelled "Commerce Use Cases Enabled by Data Clean Rooms." Even here the report hedges. "Depending on the use case and participating organizations, other technologies such as identity resolution, onboarding solutions, or direct platform integrations may also enable similar forms of collaboration."

Audience overlap analysis measures how much of a brand's first-party customer base overlaps with a retailer's shopper population. Outputs listed include overlap size, match rates, audience composition, retailer penetration among brand customers, shared customer profiles and retailer-specific insights on the brand's dataset, such as basket purchasing information.

Data enrichment combines a brand's CRM data with retailer behavioural, transaction or demographic data. Typical outputs include category affinity, purchase frequency, basket composition, customer value indicators and "competitive purchasing behavior."

Bring your own data (BYOD) targeting lets brands activate their own customer audiences inside retailer media environments by matching a brand-supplied audience against the retailer's identity graph. According to the IAB, a clean room "provides the environment required to perform that match and enable activation." Outputs are an activation-ready audience, a match rate and a reach estimate.

Suppression and exclusion removes groups such as existing purchasers, loyalty members or recent buyers from campaigns. Outputs include suppression audiences, exclusion segments and a suppression match rate.

Retailer audience activation runs in the opposite direction: retailer-defined shopper audiences are matched against the identity space of an external platform and activated on "social platforms, DSPs, CTV, and the open web."

The nine where existing tools often suffice

The second group, "Commerce Use Cases Enhanced by Data Clean Rooms," is the larger one. According to the IAB, these "can often be performed using existing measurement, analytics, or reporting tools when required data resides within a single environment." The report adds a cost warning specific to this group: clean rooms "can also introduce operational complexity," which it calls "a key consideration."

For several of the nine, the report states outright when a clean room is not needed.

Attribution and outcome measurement: a clean room adds value when purchase outcomes and ad exposure sit with different organisations, such as retailer purchase data matched to social or CTV exposure, or offsite retail media measurement. "When both exposure and purchase data exist within a retailer's owned environment, attribution can often be performed without a DCR."

Incrementality measurement: the report defines incrementality as the causal impact of advertising, measured by comparing exposed populations against a control or holdout group at user, household, store, geographic or market level. Its verdict on the single-environment case is the firmest in the document: "When both exposure and purchase data are available within a retailer's owned media environment, a DCR is unnecessary for incrementality." Listed outputs include incremental sales, incremental buyers, incremental return on ad spend (iROAS) and cost per incremental buyer.

Reach and frequency measurement: a clean room helps when audience duplication must be measured, or a frequency cap enforced, across several retailers or media platforms. The report attaches a technical condition. "The accuracy of cross-platform deduplication depends on the participating parties' ability to resolve audiences through common identifiers or interoperable identity frameworks." Within a single media environment, it says, no clean room is required.

Customer journey analysis needs one only when journeys span multiple organisations.

Consumer and category analytics: "Many consumer and category insights can be generated from retailer analytics platforms alone," according to the IAB.

Audience discovery: retailers "can often provide audience recommendations using their own shopper data or external data providers," the report states, giving payment solutions as an example of a source for non-endemic audiences.

Customer segmentation: the report notes that segmentation "can be performed using retailer-owned data alone, and many consumer brands in CPG may not have their own customer data to segment." That second clause is a pointed observation, since packaged-goods brands are among the largest buyers of retail media and frequently lack direct customer relationships.

Lookalike audience modelling: a clean room helps when a brand contributes a seed audience to be matched against retailer data, but "lookalike audiences can often be created using retailer-owned shopper data alone."

Media mix and channel analysis: it "can be conducted using a single organization's data or aggregate reporting sources."

What the split implies for buyers

Read together, the two lists draw a clear line. The five enabled use cases are all, at root, matching problems: two parties' customer records meet, and something is produced from the overlap. The nine enhanced use cases are mostly analysis and measurement problems that become clean room problems only when the inputs are spread across companies.

That matters commercially because clean room access is often packaged with retail media measurement and activation products. If a brand's campaign runs entirely on a retailer's own site and is measured against that retailer's sales, the framework says attribution, incrementality and reach and frequency can be handled without one. The calculation changes for offsite campaigns, where the retailer's purchase data has to be joined with exposure logs held by a social platform, a CTV publisher or a DSP.

PPC Land has tracked that offsite use case directly. In October 2025, LiveRamp let retail media networks measure Meta campaigns against their own sales data inside its clean room, with Albertsons Media Collective and Target's Roundel among the early users. Two employees of Roundel appear on the IAB contributor list.

The framework also connects to the IAB's earlier measurement work. The November 2025 Guidelines for Incremental Measurement in Commerce Media, issued with IAB Europe, ranked methods by causal strength, with experiments at the top. The new document's incrementality entry is consistent with that work, but adds the question of where the data physically sits.

Interoperability as the unresolved problem

The conclusion is short and less prescriptive than the rest. "Data clean rooms are becoming more common in the commerce data ecosystem, but adoption alone will not make collaboration easier," according to the IAB. Organisations, it says, are "managing a fragmented landscape of clean room providers, identity solutions, and partner requirements."

"Interoperability will become a larger challenge going forward as brands partner across more retailers, media platforms, and technology providers," the report states. It argues that "better integration across clean rooms, identity frameworks, and other data usage best practices can reduce costs and operational friction," and that "the next phase of clean room adoption should focus not only on broader use cases, but also on reducing the cost and complexity of collaboration."

The framework does not name a standard or set any timetable for that integration work. IAB Tech Lab, whose definition the document uses, has been building pieces of it. Its PAIR protocol, released in a first official version in January 2025, described deployments using either a single clean room with separate tenants or two interoperable clean rooms. Version 1.1, released in July 2025, required clean rooms to enforce minimum dataset sizes and k-anonymity processing. And in August 2026, Tech Lab opened ECAPI guidelines for data clean rooms to public comment until September 4, 2026, specifying how advertisers package conversion events, including Parquet file layouts and hashing or encryption before upload. None of those specifications is referenced in Data Clean Rooms in Commerce.

The underlying infrastructure also keeps changing. LiveRamp moved its clean room compute to NVIDIA GPU infrastructure in April 2026, and NIQ opened a clean room on Snowflake in October 2025 for data enrichment and outcome measurement, two of the use cases the IAB framework describes.

Who wrote it

The contributor list fills nearly three pages. Two IAB staff head the list: Collin Colburn, vice president, commerce and retail media, and Fred Seddon, director, retail media. The other 69 names include retailers and retail media operators such as Walmart, Lowe's, CVS Health, Ahold Delhaize USA, Roundel, Instacart, DoorDash and Uber; platform and media owners including Amazon Ads, Google, Pinterest, Roku, Samsung Ads, Disney Advertising Sales, DISH Media and T-Mobile's T-Ads; agencies including WPP Media, Mars United Commerce, Goodway Group, Wpromote, Ovative Group and CROSSMEDIA; and measurement and data firms including Nielsen, VideoAmp, LiveRamp, Epsilon, Anonym, decentriq, Lifesight and the Alliance for Audited Media.

Instacart supplied four contributors, the most of any single company. Amazon Ads and WPP Media supplied three each. Several contributing companies sell clean room products or clean room-adjacent services, and the framework's conclusion that clean rooms are unnecessary for many common tasks is notable given that composition. Brand-side representation is thin by comparison: Spectrum Brands and a former PepsiCo Tea executive are the clearest examples.

Eight contributors are listed through BVDW, including Philipp Hagen, director legal affairs and data privacy, and Stephan Zimprich of the law firm Fieldfisher. Retailers in the German contingent include a contributor from Schwarz Digits, the technology arm of the group that owns Lidl and Kaufland.

Differences between the report and the IAB Australia page

The two source documents agree on substance, but there are small differences worth recording.

The IAB Australia page states that "contributors from five markets shaped the guidance," and lists IAB US (United States), BVDW (Germany), IAB Australia, IAB Canada and IAB Europe (Europe). The report itself names no individual contributor affiliated with IAB Australia, IAB Canada or IAB Europe; those bodies are thanked collectively in the final paragraph "and your members." The IAB Australia page separately thanks the members of its Commerce and Retail Media Council "for representing the Australian market." Europe also appears as a "market" alongside Germany, which is itself a European country.

The web page condenses the five questions, and in doing so shortens the third question's distinction. Where the report contrasts "a governed, compute environment" with "a privacy-safe identity match or data transfer," the web page says identity resolution, onboarding or APIs "may be enough for a simple audience match or transfer." The meaning is preserved. The web page also uses Australian spelling ("operationalise," "organisations"), while the report uses US spelling.

The PDF's metadata records its creation on September 24, 2026, six days before the date on the IAB Australia page. The report carries one visible drafting slip, in its conclusion: "An industry focus of interoperability and efficiency will better support scaled data collaboration."

Why it matters for the marketing community

Clean rooms have spent several years being presented as a near-default answer to the loss of third-party identifiers. PPC Land's coverage of Meta's clean room case studies at IAB Australia's MeasureUp conference in September 2025, of DoorDash's LiveRamp clean room partnership in June 2026 and of the Australian retail media market, where proving incrementality was called "the really difficult part" at IAB Australia's July 2026 summit, shows how widely the technology is now marketed.

The IAB framework does not dispute any of that. It does, however, give advertisers and agencies an industry-endorsed document saying that, for nine of 14 common commerce tasks, the question to ask first is whether the data is actually held by more than one company. Where it is not, the report's language is plain: a clean room is often unnecessary, and in the case of on-site incrementality, "unnecessary" is the word used.

For retail media networks, the implication runs the other way. The use cases the framework treats as dependent on clean rooms are audience matching, enrichment, BYOD targeting, suppression and offsite activation. These are activation and data-access products, rather than measurement products sold to justify spend that already happened on the retailer's own properties.

What the document leaves open is cost. It warns repeatedly about platform fees, data science resources and operational complexity, but contains no figures. Without them, the trade-off it asks organisations to make, weighing "the value of each use case against the implementation costs," remains a judgement each buyer has to make with numbers the framework does not supply.

Timeline

Summary

Who: The Interactive Advertising Bureau (IAB US), working with BVDW, IAB Australia, IAB Canada and IAB Europe. The contributor list, headed by Collin Colburn and Fred Seddon of the IAB, names 71 people from retailers, platforms, agencies, measurement firms and BVDW.

What: Data Clean Rooms in Commerce, a 13-page framework that sets five screening questions and splits 14 commerce use cases into five "enabled" by clean rooms (audience overlap, data enrichment, BYOD targeting, suppression and exclusion, retailer audience activation) and nine "enhanced" by them (attribution, incrementality, reach and frequency, customer journey, consumer and category analytics, audience discovery, segmentation, lookalike modelling, media mix). It states that a clean room does not by itself establish a legal basis for processing or sharing data. It contains no survey or cost data.

When: Published in September 2026. The PDF was created on September 24, 2026, and IAB Australia posted it on September 30, 2026.

Where: Published on IAB.com and distributed through the IAB Global Network, including IAB Australia's website. Contributors came from the United States, Germany and other markets.

Why: The IAB says clean room adoption has produced confusion about when one is needed and which use cases justify the cost in fees, data science and operational management. For advertisers and retail media networks, the framework draws a line between matching tasks that typically need a clean room and measurement tasks that often do not, especially when ad exposure and purchase data already sit inside one retailer's environment.