IAB Tech Lab publishes comprehensive ID-Less Solutions guidance

IAB Technology Laboratory announced the final release of its ID-Less Solutions Guidance on July 17, 2025. This comprehensive document provides a technical framework for digital advertising without traditional identifiers. The 57-page specification outlines methods for targeting and measuring advertising campaigns while protecting user privacy. According to the organization, the guidance complements their existing ID Solutions Guidance released in 2023.

The guidance document addresses the industry's transition away from third-party cookies and device identifiers. According to IAB Tech Lab, contexts where identity signals are unavailable are called "ID-Less" environments. The document targets entities learning about advertising privacy, regulators interested in advertising technologies, and product managers seeking exposure to ID-Less solutions compared to ID-Based alternatives.

Summary

Who: IAB Technology Laboratory, a nonprofit research and development consortium, announced the release through their Addressability & Privacy Enhancing Technologies Working Group. Key contributors include NumberEight, ThinkMedium, ID Privacy, Covatic, TripleLift, The Trade Desk, Anonymised, and Tech Lab staff.

What: Final release of the ID-Less Solutions Guidance Version 1.0, a comprehensive 57-page technical framework providing methods for targeting ads and measuring advertising campaign performance without traditional user identifiers. The guidance covers six advertising use cases and multiple privacy-preserving technologies.

When: The final release was announced on July 17, 2025, with the document bearing a 2025 copyright date. This follows a public comment period that concluded December 19, 2024.

Where: The guidance targets global digital advertising industry implementation, with specific focus on jurisdictions with increasing privacy regulations. The document is available online at https://iabtechlab.com/idlesssolutions.

Why: The guidance addresses industry challenges from declining third-party cookies and device identifiers while meeting increasing privacy regulatory requirements. The framework aims to maintain advertising effectiveness while protecting user privacy in an ID-Less environment where traditional identifiers are unavailable.

Technical specifications define privacy-preserving methods

The guidance establishes clear distinctions between ID and ID-Less solutions. According to the document, ID-Less solutions typically use first-party user-level data to identify general audience categories rather than sharing per-user details. These methods employ contextual information about ad placements and share aggregated data about user groups that cannot identify specific individuals.

The framework covers six advertising use cases: measurement and reporting, multi-touch attribution, targeting and retargeting, lookalike audiences, frequency and recency capping, sequencing and pacing, and anti-fraud. Each use case includes detailed technical approaches with specific advantages and disadvantages outlined for implementers.

Key technologies detailed in the guidance include Shared Storage, Private State Tokens, Topics API, Curated Audiences (formerly Seller Defined Audiences), Attribution Reporting API, and Privacy-Preserving Attribution API. The document provides technical specifications for implementing these technologies while maintaining privacy compliance.

Advanced privacy techniques enable targeted advertising

The guidance introduces several sophisticated privacy-preserving techniques. Differential Privacy adds carefully calibrated noise to data, according to the specification. The amount of noise is large enough to wash out sensitive individual information but small enough for statistical pattern identification. K-anonymity ensures any data point is indistinguishable from at least 'k' others, preventing individual identification.

Cross-Context Deterministic Cohorts represent one implementation approach. This method stores observed events such as ad views and newsletter signups in shared storage on users' devices. Campaign outcomes are measured by grouping events into cohorts. When integrated by both advertisers and publishers, the system offers attribution capabilities while maintaining privacy guarantees.

Probabilistic Cohorts provide another implementation option. These measure digital events based on shared behaviors or characteristics of user groups. Simple cases include measurement by country, while advanced implementations use browsing behavior analysis. Some implementations use on-device technology and federated learning for enhanced privacy.

Industry collaboration drives standards development

The document was authored by key experts and companies in the ID-Less space according to IAB Tech Lab. Primary contributors include NumberEight, ThinkMedium, ID Privacy, Covatic, TripleLift, The Trade Desk, Anonymised, and Tech Lab staff. The Addressability & Privacy Enhancing Technologies Working Group conceived and provided primary feedback for the document.

The guidance received extensive public feedback integrated into the final version. Key updates from the public comment version include added A/B testing under solutions, additional references to important statements and assertions, and generalized language focusing on technologies and specifications. The document notes that ID-Less Solutions implementers must still comply with applicable privacy laws.

Updates also address the halting of Third-Party Cookie deprecation on Chrome, add references to W3C's Privacy-Preserving Attribution, and include references to specific solutions, particularly Multi-Touch Attribution using Shared Storage. Miguel Morales, Director of Addressability & PETs at IAB Tech Lab, emphasized the working group's role in bringing next-generation privacy-focused solutions utilizing state-of-the-art technology.

Implementation challenges require careful consideration

The guidance acknowledges several implementation challenges. Aggregated Attribution Reporting faces delays that limit real-time applications. App developers may need to whitelist all parties sending attribution reports, creating implementation friction. The mechanics of privacy budgeting can cause bias in reporting, potentially attributing sales to wrong impressions.

Some implementations require Trusted Execution Environments (TEEs), which add latency to processing. As of November 2024, some API implementers cannot host their own TEE servers and must rely on platform operator-provided TEEs, according to the document. Report utility depends on noise levels, and implementers must balance summary-level reporting costs against event-level reporting frequency limitations.

The document emphasizes that whether solutions are "cookie-less" has no bearing on whether they qualify as ID-Less. Many cookie-less solutions depend on commonly available user information consistent across contexts, such as email addresses or phone numbers, to identify activity related to the same user. Some Privacy-Enhancing Technologies relying on match keys remain out-of-scope, including Data Clean Room interactions using match keys and Trusted Execution Environments where cross-party IDs identify user records.

Market implications signal advertising transformation

The guidance reflects broader industry trends toward privacy-first advertising methodologies. Traditional advertising measurement faces significant challenges as third-party cookies become unavailable. IAB Tech Lab has been developing privacy-preserving standards to address these challenges across multiple initiatives.

The organization's broader 2025 roadmap includes privacy technical training and compliance programs for privacy preference signals. IAB Tech Lab plans to deliver 31 new specifications or updates throughout 2025, demonstrating continued investment in privacy-enhancing technologies. This represents an increase from 23 releases in 2024, indicating accelerated development in response to regulatory pressure.

The guidance supports industry efforts to maintain advertising effectiveness while respecting user privacy. Previous IAB Tech Lab initiatives have focused on standardizing privacy management across the digital advertising ecosystem. The ID-Less Solutions Guidance extends these efforts by providing specific technical implementations for advertising without traditional identifiers.

Research cited in IAB Tech Lab documentation indicates US publishers face potential losses of USD 10 billion due to reduced personalization capabilities and challenges activating authenticated audiences. The ID-Less Solutions Guidance addresses these concerns by providing alternative technical approaches that maintain advertising functionality while protecting user privacy.

Technical architecture supports scalable implementation

The guidance outlines specific technical requirements for implementation. Solutions must use first-party user-level data to identify general audience categories without sharing per-user details. Contextual information about ad placements provides targeting signals without individual identification. Aggregated data about user groups cannot be used to identify specific individuals.

Browser and device manufacturers can provide aggregated reports with noise-induced data and limited reporting frequency to preserve individual user privacy. Examples include AdAttributionKit, Attribution Reporting API, and Privacy-Preserving Attribution API. Some implementations such as Interoperable Private Attribution use Multi-Party Compute to maintain anonymity.

The framework includes specific requirements for all participating entities. Publishers must ensure proper user consent collection and maintain URL-safe format for identifiers. Advertisers must implement appropriate data handling procedures and respect privacy constraints. Technology providers must implement required privacy safeguards including mandatory key rotation schedules and restrictions on data access.

Standards evolution addresses regulatory compliance

The document development process reflects industry adaptation to increasing privacy regulations. With 14 U.S. state privacy laws enforceable in 2025 and additional regulations expected, the advertising industry requires privacy-preserving alternatives to traditional identifiers. The guidance provides specific technical approaches for maintaining advertising effectiveness under these regulatory constraints.

The specification includes requirements for compliance with applicable privacy laws. Implementers must consider jurisdiction-specific requirements while implementing ID-Less solutions. The document notes that the use of words such as "Privacy," "Private," "Security," "Control," "Processing," "Personal Data," and "PII" is generic and does not refer to definitions in specific regulations such as GDPR or CCPA.

Technologies excluded from ID-Less classification include those using email addresses or phone numbers in original or modified form to identify users. IP addresses, alone or in combination with other values, for user identification also remain outside the ID-Less framework. Probabilistic IDs generated by applying statistical models to device attributes fall under ID solutions rather than ID-Less approaches.

The guidance supports broader privacy initiatives being developed by IAB Tech Lab. The organization has been working on multiple privacy-preserving protocols to address various aspects of advertising technology adaptation to privacy requirements.

Industry adoption requires coordinated implementation

The guidance emphasizes the importance of coordinated implementation across the advertising ecosystem. Attribution is only possible where both publishers and advertisers use the same technology, creating scale limitations. Solutions may require access to user data subject to consent requirements in many jurisdictions.

Industry standardization efforts have been developing across multiple IAB Tech Lab initiatives. The organization renamed its Seller Defined Audiences specifications as part of the broader Curation Framework while maintaining core functionality. These efforts support coordinated adoption of privacy-preserving advertising technologies.

The document encourages industry participation through the Addressability & PETs Working Group. Organizations can email memberships@techlab.com to join the group and contribute to standards development. The collaborative approach reflects IAB Tech Lab's commitment to developing practical, industry-wide solutions addressing complex challenges of modern digital advertising while prioritizing user privacy.

Implementation success depends on widespread acceptance and adoption across the advertising ecosystem. The guidance provides practical recommendations for organizations implementing ID-Less solutions, including use case prioritization, resource allocation, timeline development, and risk management. Technical preparation requirements cover infrastructure assessment, capability evaluation, and testing protocols necessary for successful implementation.

Key Terms Explained

Differential Privacy: A mathematical technique that protects individual privacy while enabling data analysis. According to the IAB Tech Lab guidance, differential privacy adds carefully calibrated noise to datasets. The amount of noise is large enough to "wash out" sensitive individual information but small enough to allow pattern identification through statistical analysis. This approach enables advertisers to derive insights from user behavior without compromising personal privacy, making it a cornerstone technology for ID-Less advertising solutions.

K-Anonymity: A privacy protection method ensuring any given data point remains indistinguishable from at least 'k' other similar data points. According to the guidance, this technique prevents individual identification by requiring that any released information applies to a minimum number of users. For example, if k=5, any advertising insight must apply to at least five users, making it impossible to single out any individual's behavior or characteristics within the dataset.

Multi-Touch Attribution: A measurement methodology that assigns credit to different touchpoints in a customer's interaction journey with an advertiser. According to the document, this includes various media channels where customers viewed or engaged with advertisements that resulted in customer actions like purchases. In ID-Less environments, this becomes more complex as traditional tracking methods are unavailable, requiring new approaches like Shared Storage implementation for attribution analysis.

Privacy-Enhancing Technologies (PETs): Technology solutions that use privacy technologies including differential privacy, secure multi-party compute, and on-device learning to accomplish complex data processing functions. According to the guidance, PETs prevent exposure of personally identifying information while enabling sophisticated advertising operations. These technologies provide safeguards to prohibit identification or reidentification of individual, household, or device-level personal information to parties that do not already have access.

Shared Storage: A browser-based technology that enables cross-site data storage while maintaining privacy controls. According to the guidance, this technology stores observed events such as ad views, newsletter signups, and content viewed on users' devices. Campaign outcomes and reports can be measured by grouping events into cohorts, offering attribution capabilities when integrated by both advertisers and publishers while providing additional privacy guarantees compared to third-party cookies.

Trusted Execution Environment (TEE): A secure processing environment that protects data and code from unauthorized access during computation. According to the document, implementers typically must use TEEs for privacy-preserving advertising operations, though this adds latency to processing. As of November 2024, some API implementers cannot host their own TEE servers and must rely on platform operator-provided TEEs, creating dependencies on external infrastructure providers.

Curated Audiences: Previously known as Seller Defined Audiences, these represent audience segments created by publishers based on first-party data and contextual signals. According to the guidance, these audiences enable targeting without revealing individual user information. Publishers package audience characteristics, content metadata, and enrichment signals into curated supply pools, allowing advertisers to reach relevant audiences while maintaining privacy compliance in ID-Less environments.

Cross-Context Deterministic Cohorts: A privacy-preserving measurement approach that groups users based on shared behaviors across different advertising contexts. According to the guidance, this method stores observed events in shared storage on users' devices and measures campaign outcomes by organizing events into cohorts. When implemented by both advertisers and publishers using the same technology, it provides attribution capabilities while ensuring that individual user actions cannot be traced across different websites or platforms.

Attribution Reporting API: A browser-based system that provides aggregated conversion reports while protecting individual user privacy. According to the document, this API delivers noise-induced data with limited reporting frequency to preserve privacy while offering useful advertising insights. Examples include AdAttributionKit, Attribution Reporting API, and Privacy-Preserving Attribution API, which enable measurement without exposing individual user conversion events to advertisers.

Probabilistic Cohorts: Measurement groups created based on statistical models of user behavior rather than deterministic identifiers. According to the guidance, these cohorts measure digital events based on shared characteristics or behaviors, ranging from simple geographic groupings to complex browsing behavior analysis. Some implementations use on-device technology and federated learning for enhanced privacy, though they tend to be less specific than ID-Based solutions due to data scarcity.

Timeline

• Early 2023: IAB Tech Lab establishes comprehensive Curation Framework with four fundamental components including Seller-Defined Audiences and data transparency standards
• February 15, 2024: Google responds to IAB Tech Lab "Fit Gap Analysis for Digital Advertising" addressing Privacy Sandbox APIs assessment for replacing third-party cookies
• May 10, 2024: IAB Tech Lab publishes Understanding Differential Privacy white paper exploring privacy-preserving ad targeting solutions
• May 20, 2024: IAB Tech Lab releases Identity Solutions Guidance addressing cookieless environment navigation
• September 7, 2024: IAB Tech Lab launches Privacy Taxonomy for public comment to standardize data privacy management
• October 19, 2024: IAB Tech Lab unveils ADMaP attribution protocol enabling secure conversion data sharing
• December 1, 2024: IAB Tech Lab announces ID-Less Solutions Guidance public comment period extending through December 19, 2024
• January 21, 2025: IAB Tech Lab releases PAIR protocol version 1.0 for secure audience matching with privacy protection
• January 29, 2025: IAB Tech Lab unveils 2025 technical standards roadmap planning 31 new specifications addressing privacy compliance
• July 16, 2025: IAB Tech Lab releases PAIR protocol version 1.1 with clarified encoding standards and Open PAIR prebid module
• July 17, 2025: IAB Tech Lab announces final release of ID-Less Solutions Guidance Version 1.0