An identity graph is a database that records which identifiers belong to the same person or the same home. A postal address held by a retailer, an email address collected at checkout, a loyalty card number, a browser cookie, a phone's advertising ID and a television's device ID are separate strings with nothing in common. The graph asserts that they describe one consumer and gives that consumer a persistent key. It exists because marketing data is scattered across companies that cannot, and often may not, exchange names directly. The VAB, the US video advertising trade body, defines it as a database of every known identifier tied to individual customers or households, from usernames and emails to IP addresses and offline records, and treats identity resolution as the process of matching them to one profile.

How a graph is assembled

The structure borrows from mathematics. Each identifier is a node; each assertion that two identifiers belong together is an edge; a connected cluster of nodes is treated as a person or a household. Construction usually runs through five stages.

Ingestion comes first. Records arrive from customer relationship management (CRM) systems, point-of-sale files, website logins, publisher registrations and, for commercial graphs, licensed data from other suppliers.

Normalisation follows, and small differences decide whether two records meet. Under the Unified ID 2.0 (UID2) specification, an email address is trimmed and lowercased, and for gmail.com addresses the periods and any plus-sign suffix are removed before hashing. The value is then hashed with SHA-256 and encoded in Base64, producing a 44-character string. Google's Measurement Protocol requires the same SHA-256 hash but hex encoding, a 64-character string. Two partners can hold the same normalised email and still fail to match if one sends hex and the other Base64.

Matching is where graphs differ most. Deterministic links rest on an observed event: a login, a purchase, a verified household record. Probabilistic links are inferred from shared IP addresses, device characteristics and behaviour. Most commercial graphs mix the two. ID5, for instance, says its deterministic signals train the models that produce probabilistic links, which in turn are used to check deterministic ones.

Clustering and persistence assign the key. People move house, change phones and share computers, so the graph must decide which old identifiers to retire. Adobe's Experience Platform documentation shows the trade-offs as configuration. Its Identity Service caps a graph at 50 identities. When a full graph receives a new one, the oldest is deleted in a set order: cookie IDs first, then device IDs, then cross-device IDs, emails and phones. Profiles holding more than 50 identities are excluded from segmentation, exports and lookups, and a batch will not link identities already tied to 50 or more others, a guard against one shared device merging strangers into a single person.

Output is a pseudonymous identifier. LiveRamp's version is RampID, built from two graphs: AbiliTec, which resolves offline records, and a second map joining that person to digital devices.

Where it sits in a campaign

Most marketers meet the graph during onboarding. An advertiser uploads a customer file, the graph provider matches it, strips the personal data and returns pseudonymous IDs that a demand-side platform (DSP) can target, exclude or measure against. On the sell side, publishers and exchanges use graphs to attach identifiers to bid requests. In measurement, graphs connect ad exposure logs to sales records, frequently inside a clean room.

Graphs also sit behind other graphs. The Trade Desk describes Identity Alliance as a "graph of graphs" that joins providers including Experian, ID5 and LiveRamp into one layer for cross-device targeting and measurement. Graphs are also built privately. Wunderkind runs a graph inside brand domains using each brand's consent tools.

Origin and evolution

The practice is older than digital advertising. Acxiom, founded in Conway, Arkansas in 1969, built its business on mailing lists and created AbiliTec in the late 1990s to link name and address variants to a single record. According to Wikipedia's company history, Acxiom launched AbiliTec Digital in October 2010 to match online identities to name-and-address data, and bought LiveRamp, a San Francisco onboarding company spun out of RapLeaf, for $310 million on May 14, 2014.

Regulators noticed the same month. On May 27, 2014, the Federal Trade Commission (FTC) published Data Brokers: A Call for Transparency and Accountability, a study of nine companies including Acxiom, Datalogix and Rapleaf, and asked Congress to legislate. It did not.

Consolidation then pulled graphs inside agency holding companies. Interpublic Group agreed in July 2018 to buy Acxiom Marketing Solutions for $2.3 billion; the remaining listed company took the LiveRamp name. Publicis bought Epsilon for $4.4 billion in 2019 and agreed to buy Lotame in March 2025, saying the combined assets reached 91 percent of adult internet users. Omnicom completed its acquisition of Interpublic on November 26, 2025, which put Acxiom's Real ID graph at the centre of Omnicom's Omni platform.

Some graphs closed instead. Oracle, which sold an ID Graph product, agreed in 2024 to a $115 million class action settlement covering data made available through ID Graph and its Data Marketplace since August 19, 2018, and shut its advertising business on September 30, 2024. Oracle denied wrongdoing.

Why it matters to marketers

Nearly every use of first-party data outside the company that collected it depends on a graph: suppressing existing customers, extending a CRM segment into connected television, linking an impression to a store sale. The quality of those links now affects how money is judged. Research published by LiveRamp and the Marketing + Media Alliance on July 20, 2026 simulated a campaign with a true return of $1.50 per dollar. At 50 percent identity precision, measured return fell to $0.43, low enough to cancel a profitable campaign. The report labels 50 percent an illustrative lower bound, and LiveRamp sells the remedy it recommends.

Commercial terms are shifting in the same direction. The Trade Desk revised Identity Alliance payments in April 2026 to reward incremental reach rather than data volume, so a graph that duplicates signals already present earns less.

Ownership has become a buying question. Publicis agreed on May 17, 2026 to acquire LiveRamp for $38.50 per share, an equity value of $2.5 billion. "In the age of AI, the name of the game is connect or die," Arthur Sadoun, chairman and chief executive of Publicis, said when the group agreed to buy Lotame. Rival holding companies pay for LiveRamp's graph, and Omnicom accelerated a planned exit in favour of Real ID.

Limitations and disputes

Accuracy is the central dispute, and scale claims do not settle it. Vendors quote large numbers: Wunderkind cites 9 billion devices, and ID5 said its combined graph after buying TrueData recognised about 1.5 billion users. None of these figures measures whether the links are right.

Independent testing is less flattering. A study commissioned by the Coalition for Innovative Media Measurement (CIMM) and Go Addressable, run by Truthset across nearly one billion records from six providers, found IP-to-postal links accurate 13 percent of the time and IP-to-email links 16 percent. Providers agreed on the same IP-to-household link 6.4 percent of the time. An earlier CIMM study put hashed email-to-household match rates as low as 32 percent. "The state of IP data today is messy, despite the billions spent trading on it," said Kathryn Barnitt, head of data science at Truthset. Sellers of deterministic data, including FreeWheel, have used those figures in their own marketing.

Privacy objections go further. A February 2024 Cracked Labs report by Wolfie Christl and Alan Toner, commissioned by Open Rights Group, described LiveRamp's system as population-scale identity surveillance and estimated more than 60 billion queries a day. Open Rights Group filed complaints with UK and French regulators on February 28, 2024. The FTC restated on July 24, 2024 that hashing does not make data anonymous, which undercuts the argument that a hashed email is not personal data.

Deletion rights sit awkwardly with graphs built to preserve links. California's Delete Request and Opt-out Platform (DROP), whose rules were approved in November 2025, receives requests keyed mostly to postcodes and phone numbers. Only 10 percent carried a mobile advertising ID and 3 percent a connected TV ID.

Disambiguation

A device graph is a narrower map linking browsers, phones and televisions. An identity graph may contain one, but adds offline records such as names, postal addresses and purchase histories; the device graph explainer covers that layer.

A universal ID is an output, not a map. UID2, ID5 and RampID are strings passed between systems; graphs generate and connect them.

A customer data platform stores profiles and events for one company. It may run a private identity graph, as Adobe's does, but the graph is a component rather than the product.

A knowledge graph maps facts and concepts rather than people, answering what something is rather than who someone is.

Recent developments

LiveRamp shareholders approved the Publicis deal on August 17, 2026 while rejecting executive merger pay by 44.3 million votes to 7.3 million; closing is expected before the end of 2026. LiveRamp's SEC filing says RampID and Epsilon's CoreID will continue to operate separately. Since August 1, 2026, registered California data brokers must retrieve DROP deletion lists at least every 45 days.

Deterministic claims now dominate vendor positioning. Deep Sync and MiQ sold voter file matching on that basis in April 2026, and Adstra and InterMedia reported in July 2026 that 23 percent of residential IP addresses reached the intended geographic target. Doceree described in September 2026 ESPYIAN, a graph of more than six million physicianskeyed to the National Provider Identifier, with no probabilistic lookalikes.

Timeline

  • 1969: Charles Ward founds Demographics, Inc., later Acxiom, in Conway, Arkansas
  • Late 1990s: Acxiom creates AbiliTec to link name and address records
  • October 2010: Acxiom launches AbiliTec Digital to match online identities to offline records
  • 2011: LiveRamp spun out of RapLeaf in San Francisco
  • May 14, 2014: Acxiom acquires LiveRamp for $310 million
  • May 27, 2014: FTC publishes its data broker report covering nine companies
  • July 2018: Interpublic agrees to buy Acxiom Marketing Solutions for $2.3 billion
  • October 2018: The listed company renames itself LiveRamp and trades as RAMP
  • April 14, 2019: Alliance Data agrees to sell Epsilon to Publicis for $4.4 billion
  • February 28, 2024: Open Rights Group files complaints against LiveRamp in the UK and France
  • July 24, 2024: FTC restates that hashed data is not anonymous
  • September 30, 2024: Oracle shuts its advertising business, including ID Graph
  • March 2025: Publicis agrees to acquire Lotame
  • November 4, 2025: ID5 announces the acquisition of TrueData
  • November 5, 2025: CIMM and Go Addressable publish the Truthset IP accuracy study
  • November 6, 2025: California approves DROP regulations
  • November 26, 2025: Omnicom completes its acquisition of Interpublic
  • January 1, 2026: DROP opens to California consumers
  • April 2026: The Trade Desk shifts Identity Alliance payments to incremental value
  • May 17, 2026: Publicis agrees to acquire LiveRamp for $2.5 billion
  • July 20, 2026: LiveRamp and the Marketing + Media Alliance publish identity precision research
  • August 1, 2026: California data brokers must begin processing DROP requests
  • August 17, 2026: LiveRamp shareholders approve the Publicis acquisition

Summary

Who. Data companies such as LiveRamp, Acxiom, Epsilon, Experian and ID5 operate commercial identity graphs; brands and customer data platforms run private ones; DSPs, publishers, exchanges and measurement firms consume them. Agency holding companies now own several of the largest.

What. A database that links names, postal addresses, emails, phone numbers, cookies, device IDs and platform IDs into clusters representing one person or household, and issues a persistent pseudonymous key for each, using deterministic and probabilistic matching.

When. Offline record linkage dates to Acxiom's AbiliTec in the late 1990s; digital onboarding grew after 2010; regulators examined brokers from 2014; holding companies bought graph operators between 2018 and 2026, with Publicis agreeing to buy LiveRamp on May 17, 2026.

Where. In onboarding pipelines between advertisers and DSPs, in bid request enrichment on the sell side, in clean rooms and measurement systems, and in regulatory regimes such as California's DROP.

Why. Customer data is split across companies that cannot share names, so a common key is needed to target, suppress and measure. Independent tests since 2025 suggest many links are wrong, and privacy regulators question whether pseudonymous keys protect anyone.