Identity resolution determines which records describe the same person or household and ties them together under one identifier. An email address in a customer relationship management (CRM) system, a cookie on a laptop, a mobile advertising ID on a phone and a postal address from a loyalty card may all describe one individual. No field says so. Resolution establishes it, producing a persistent key for targeting, frequency capping and measurement.

The discipline exists because every company, and often every system inside one, assigns its own identifiers. Data becomes useful across those boundaries only once someone decides which records correspond. Sometimes that decision rests on an observed fact. Often it is inferred, and the gap between the two drives most arguments about the practice.

How a match is made

Resolution runs in four stages. The first, normalisation, makes identical values look identical. Google's Customer Match documentation requires email addresses to be trimmed of whitespace and lowercased and, for Gmail addresses only, stripped of periods and plus-sign suffixes in the username. Phone numbers follow the E.164 international format. The cleaned values are hashed with SHA-256, so two parties can compare an email without exchanging it in readable form.

The second is matching. Deterministic matching links records sharing an exact, observed key: the same hashed email, login or customer number. Probabilistic matching scores candidate pairs on weaker signals such as IP address, device model, location and timing, and declares a link above a threshold. A January 2017 Federal Trade Commission (FTC) staff report described deterministic techniques as working "through a consumer-identifying characteristic, such as a login," and named IP address matching as the common probabilistic method.

The statistics behind that threshold date from 1969. Ivan Fellegi and Alan Sunter weighted each field by two probabilities: m, the chance it agrees when two records truly match, and u, the chance it agrees by coincidence. Summed weights sort pairs into matches, non-matches and a middle band sent for review. Commercial systems still tune that trade-off: a lower threshold links more records and makes more mistakes.

Third comes clustering, which chains pairwise links into profiles, and fourth persistence, which gives each cluster an identifier that survives new data. Both need guard rails, because one bad link can fuse many people into one. Adobe's Experience Platform calls the failure "graph collapse" and lets customers mark a namespace as unique, so a graph "can only have one identity that contains that namespace," within a ceiling of 50 identities.

Where it sits in the transaction

Resolution happens in four main places. In onboarding, an advertiser uploads a customer file and a platform reports how many records it recognised, the match rate. Inside customer data platforms, a brand stitches its own web, app, store and CRM records. In clean rooms, two parties match encrypted lists without exposing them. Google made Confidential Matching the default for Customer Match on September 12, 2024, processing uploads in trusted execution environments, and the IAB Tech Lab launched PAIR (Publisher Advertiser Identity Reconciliation) as an open standard on September 26, 2024.

The fourth is the bid stream. OpenRTB 2.6 carries resolved identities in an eids array on the user object. Each entry names a source, the domain of the ID provider, and holds uids with an atype value: 1 for an ID tied to one browser or device, 2 for an in-app device ID, 3 for a person-based ID. Because bridged identifiers had been travelling in the buyeruid and ifa fields reserved for cookie-synced and operating-system IDs, the IAB Tech Lab added three provenance fields on September 23, 2024. Inserter names the company that placed the ID in the request, matcher the one that made the link, and mm the method: 3 for authenticated, 4 for observed but unauthenticated, 5 for inferred from signals such as IP address and user agent.

Demand-side platforms (DSPs), agency data units and brands resolve on the buy side; publishers and supply-side platforms (SSPs) resolve to raise the value of bid requests. Specialists whose graph is the product, including LiveRamp, Experian, TransUnion, Epsilon and ID5, sit between them.

From vital records to ad tech

The problem predates advertising. Halbert Dunn, chief of the US National Office of Vital Statistics, used the term "record linkage" in the American Journal of Public Health in December 1946, picturing each life as a book whose pages were scattered across separate registers. Howard Newcombe showed in Science in 1959 that records could be linked automatically using probability weights; Fellegi and Sunter formalised the theory a decade later.

The phrase "identity resolution" reached commercial software through security. Jeff Jonas's Systems Research & Development built NORA, a relationship-detection system Las Vegas casinos used against card counters. IBM bought the company in 2005 and renamed the technology IBM Identity Resolution.

In advertising, Drawbridge and Tapad began selling probabilistic cross-device matching around 2010. The FTC held a workshop on the practice on November 16, 2015, and its 2017 report asked companies not to track health, financial or children's data across devices without affirmative express consent. Experian bought Tapad for $280 million in cash in November 2020.

Apple's App Tracking Transparency, applied from iOS 14.5 in April 2021, requires permission before app data is linked with other companies' data, and Apple's developer terms bar deriving data from a device "for the purpose of uniquely identifying it." Google moved the other way. On December 18, 2024 it said advertisers could use IP addresses and device fingerprinting from February 16, 2025, a decision the UK Information Commissioner's Office (ICO) called "irresponsible".

Why it matters to marketers

Resolution quality sets reach, frequency and measurement at once. An unlinked customer is counted as two people and can receive double the intended frequency; a wrongly linked one receives advertising meant for someone else, with conversions credited to the wrong exposure. Deduplication depends entirely on the key resolution supplies.

The measurement effect can be large. A July 2026 simulation by LiveRamp and the Marketing + Media Alliance, built on 1.9 million real exposures across 147,941 users, found that a campaign truly returning $1.50 per dollar measured at $0.43when identity precision fell to 50%. LiveRamp sells identity services, but the mechanism is not disputed: an attribution model cannot credit an exposure it cannot connect.

Money follows the capability. The Trade Desk changed Identity Alliance terms in April 2026 so partners are paid only for signals not already captured elsewhere in its platform. Publicis agreed on May 17, 2026 to buy LiveRamp for $38.50 a share, about $2.5 billion in equity value, and LiveRamp shareholders approved the merger on August 17 by 99.88% of votes cast. Regulatory clearance is the remaining condition.

Accuracy, privacy and disputes

A study commissioned by the Coalition for Innovative Media Measurement (CIMM) and Go Addressable, run by Truthset across nearly one billion IP records from six providers, found IP-to-postal links correct 13% of the time and IP-to-email links 16%. Providers agreed on the same postal link only 6.4% of the time. "The state of IP data today is messy, despite the billions spent trading on it," said Kathryn Barnitt, Truthset's head of data science. In July 2026 a study by Adstra, itself an identity vendor, and InterMedia Advertising found that 23% of residential IP addresses reached their intended target in connected TV.

Deterministic links are generally more reliable but cover fewer people, and the mix is seldom disclosed. "Demand more visibility in how matching is done, because for most partners, there isn't any today," said Andy Johnson of Adstra. The Video Advertising Bureau's July 2026 guide urged buyers to question vendors on match quality, yet offered no accuracy benchmarks of its own.

Errors run in both directions. Over-linking merges different people, usually members of one household or users of a shared device. Under-linking splits one person across several profiles. Tightening a threshold trades one error for the other.

Regulators treat the output as personal data. The FTC stated in July 2024 that hashing does not make data anonymous. The European Data Protection Board's Guidelines 01/2025, adopted on January 16, 2025, hold that pseudonymised data remains personal even when the key sits with another party, although the Court of Justice of the European Union narrowed that view on September 4, 2025 for recipients with no reasonable means of re-identification.

Not the same as

Identity graph. The identity graph is the stored map of linked identifiers. Identity resolution is the process that builds and queries it, though vendors often sell the two under one name.

Device graph. A device graph links browsers and devices. Resolution may also join offline records such as postal addresses and purchase histories.

Match rate. Match rate measures recognition, not correctness. A 70% match rate says nothing about whether the matches are right.

Entity resolution. The general data engineering term covers any entity, including companies, products and places. Identity resolution is the subset concerned with people and households.

Recent developments

Much recent activity moves matching into sealed environments. On March 23, 2026 Google named Roku the first publisher in Confidential Publisher Match, a deterministic service for Display & Video 360 that runs inside trusted execution environments and builds on PAIR.

Other changes widen the inputs. Google's Data Manager API began accepting IP addresses for Customer Match on May 28, 2026, excluding users in the European Economic Area, the UK and Switzerland. In June, The Trade Desk integrated Utiq's telco-based identifiers, consent-based IDs from a joint venture of Deutsche Telekom, Orange, Telefonica and Vodafone.

Transparency remains the weak point. Taboola introduced Realize ID on September 22, 2026, claiming up to 2.4 times better conversion efficiency, but the announcement is silent on how the joins are made. Nearly six decades after Fellegi and Sunter published their thresholds, most buyers still cannot see where their vendors set them.

Timeline

  • December 1946: Halbert Dunn publishes "Record Linkage" in the American Journal of Public Health
  • 1959: Howard Newcombe shows in Science that vital records can be linked automatically with probability weights
  • December 1969: Ivan Fellegi and Alan Sunter publish "A Theory for Record Linkage" in the Journal of the American Statistical Association
  • 2005: IBM acquires Systems Research & Development and renames its NORA technology IBM Identity Resolution
  • 2010: Tapad is founded; Tapad and Drawbridge begin selling probabilistic cross-device matching
  • November 16, 2015: The FTC holds a workshop on cross-device tracking
  • January 23, 2017: The FTC publishes its cross-device tracking staff report
  • November 2020: Experian acquires Tapad for $280 million in cash
  • April 2021: Apple begins requiring App Tracking Transparency permission with iOS 14.5
  • October 2022: Google's Display & Video 360 team creates the PAIR protocol
  • July 24, 2024: The FTC states that hashing does not make data anonymous
  • September 12, 2024: Google makes Confidential Matching the default for Customer Match
  • September 23, 2024: The IAB Tech Lab adds inserter, matcher and mm provenance fields to OpenRTB 2.6
  • September 26, 2024: The IAB Tech Lab launches PAIR as an open standard
  • December 18, 2024: Google announces it will permit IP addresses and fingerprinting in advertising; the ICO calls the decision irresponsible the next day
  • January 16, 2025: The EDPB adopts Guidelines 01/2025 on pseudonymisation
  • February 16, 2025: Google's fingerprinting policy change takes effect
  • September 4, 2025: The Court of Justice narrows when pseudonymised data counts as personal data for recipients
  • November 5, 2025: The CIMM, Go Addressable and Truthset study finds IP-to-postal links accurate 13% of the time
  • March 23, 2026: Roku becomes the first publisher in Google's Confidential Publisher Match
  • April 2026: The Trade Desk shifts Identity Alliance payments to incremental signals
  • May 17, 2026: Publicis agrees to acquire LiveRamp for $38.50 a share
  • May 28, 2026: Google's Data Manager API begins accepting IP addresses for Customer Match
  • July 2026: LiveRamp simulation links 50% identity precision to a measured return of $0.43 on a $1.50 campaign; Adstra study puts residential IP accuracy at 23%
  • August 17, 2026: LiveRamp shareholders approve the Publicis merger
  • September 22, 2026: Taboola introduces Realize ID

Summary

Who. Identity resolution is performed by brands and their customer data platforms, by DSPs, SSPs and publishers, and by specialist providers such as LiveRamp, Experian, TransUnion, Epsilon and ID5. The IAB Tech Lab sets the bid stream fields that describe resolved IDs, and regulators including the FTC, the EDPB and the ICO set the limits on how the data may be used.

What. It is the process of deciding which emails, phone numbers, cookies, device IDs, IP addresses and postal records belong to one person or household, and assigning them a persistent identifier. Matching is deterministic when it rests on a shared, observed key and probabilistic when it is inferred from weaker signals.

When. The statistics were set out between 1946 and 1969 for public health records. The term entered commercial software around 2005, advertising adopted cross-device matching from about 2010, and since 2024 matching has moved into encrypted clean rooms and gained provenance fields in OpenRTB.

Where. Resolution runs in customer data platforms, onboarding services, clean rooms and trusted execution environments, and in the bid stream through the OpenRTB eids array. Its outputs feed targeting, frequency capping and attribution across web, app, connected TV and retail media.

Why. Every system assigns its own identifiers, so data from one cannot be used in another until records are joined. Accurate resolution avoids double counting and misattribution; inaccurate resolution, which independent studies suggest is common where IP addresses carry the link, distorts reach, frequency and measured returns while creating personal data that regulators do not treat as anonymous.