A universal ID is a single pseudonymous identifier for a user that every company in an advertising transaction can read. The publisher, its supply-side platform (SSP) and the bidding demand-side platform (DSP) all see the same value, rather than each holding its own cookie and swapping them through cookie syncing. The idea exists because syncing leaks data and loses users at every hop, and because the third-party cookie it relies on has been blocked or threatened in most browsers since 2017.

It is a category, not a product. Unified ID 2.0 (UID2), its European counterpart EUID, LiveRamp's RampID, the ID5 ID, Lotame's Panorama ID and Prebid's SharedID are all described as universal IDs, though they are built and owned differently.

How a universal ID is made

Most universal IDs start with a deterministic input, a value the user supplied. The usual one is an email address entered at login or newsletter sign-up. The UID2 documentation sets out the steps: remove spaces, convert to lowercase and, for gmail.com addresses only, strip periods and anything after a plus sign. The cleaned address is hashed with SHA-256 and Base64-encoded into a 44-character string. According to the UID2 documentation, a publisher that skips the lowercasing step gets a different value from an advertiser holding the same address, and the two records never meet.

The hash is not the identifier. A UID2 operator adds a secret salt, drawn from one of more than one million salt buckets that rotate over time, and hashes again to produce a raw UID2. For the bid stream, the raw value is encrypted into a UID2 token that changes on each refresh, so the string on the page cannot be stored and reused indefinitely. The documentation recommends refreshing tokens hourly, partly because opt-outs, made through a Transparency and Control Portal, are checked at each refresh.

RampID follows a similar path through LiveRamp's Authenticated Traffic Solution (ATS). A submitted email is exchanged for an encrypted envelope, which the SSP decrypts and turns into a RampID specific to each DSP. When LiveRamp has no maintained record for the person, it returns a derived RampID of 70 characters rather than the 49-character maintained one.

Other IDs lean on probabilistic signals. The ID5 ID can use hashed emails when available but also draws on IP address, user agent and browsing patterns, and ID5 says each method is used to check the other. Lotame's Panorama ID and Prebid's SharedID began as first-party cookie identifiers written on the publisher's own domain.

Where it travels

On the web, most universal IDs reach the auction through Prebid.js, the open-source header bidding library. Its User ID module, according to Prebid's documentation, lets a publisher list ID providers under userSync.userIds, choose cookie or local storage, and set an expiry in days. As of October 2026 the documentation lists 68 accepted provider names. If the Transparency and Consent Framework signal shows no consent for storage, the module calls no vendor and stores nothing.

From there the IDs travel in OpenRTB, the IAB Tech Lab's bid request protocol. Version 2.6 moved extended identifiers into the user object as an eids array. Each entry names a source, the ID provider's domain such as uidapi.com or id5-sync.com, and carries one or more uids, each with an atype value marking a browser, app or person-based origin. Later fields name the inserter, matcher and match method, mm: 3 for authenticated, 4 for observed first-party data, 5 for inference from signals such as IP address and user agent.

A DSP reads the array, matches the ID against advertiser data onboarded through the same provider, and bids, with no cookie sync.

Origin and evolution

The first serious attempt at a shared identifier was DigiTrust, founded by Jordan Mitchell, which gave participating companies a common pseudonymous token stored in a cookie. The IAB Tech Lab acquired it in April 2018 and shut it down on July 31, 2020, citing costs that outran funding. The IAB Tech Lab called Google's January 2020 Chrome announcement "the final nail in the coffin for third-party cookies."

That announcement, on January 14, 2020, committed Chrome to phasing out third-party cookies within two years. Safari had restricted them since Intelligent Tracking Prevention arrived in 2017, and Firefox had blocked third-party trackers by default since September 2019. Chrome's decision turned universal IDs into a survival plan.

Vendors moved fast. ID5 made its ID available in Prebid.js in July 2019. The Trade Desk began signing partners for UID2 in October 2020 and, according to a February 18, 2021 announcement, named Prebid.org as operator. That arrangement did not hold: Prebid.org later said it would operate UID2 only if The Trade Desk were not also the administrator, and no independent administrator emerged. Lotame launched Panorama ID in October 2020, and Prebid launched SharedID on December 1, 2020. LiveRamp renamed IdentityLink as RampID on May 24, 2021.

Google then ruled itself out. On March 3, 2021, David Temkin, a Google product director, wrote that "we will not build alternate identifiers to track individuals as they browse across the web," and dismissed "PII graphs based on people's email addresses."

Chrome's deadline kept moving. Tracking Protection reached 1% of Chrome users on January 4, 2024. In April 2024 full deprecation slipped to early 2025. On July 22, 2024, Anthony Chavez, Google's vice president for Privacy Sandbox, replaced deprecation with a user-choice prompt. The Trade Desk's chief executive, Jeff Green, described the pattern as a "bait and switch". On April 22, 2025, Google dropped the prompt as well, and on October 17, 2025 it retired most Privacy Sandbox advertising APIs after low adoption.

Europe followed its own path. The Trade Desk and LiveRamp announced EUID in February 2022, and The Trade Desk reported early adopters, including Tesco Media and Insights and Future, in June 2023.

Why it matters to marketers

A universal ID sets how far first-party data reaches. A retailer can upload a hashed customer file once and find the same people at every publisher passing that ID. The deterministic signals behind UID2 and RampID also tie measurement to people rather than browsers.

The reversal in Chrome removed the deadline but not the use case. Safari users, app users and connected TV viewers carry no third-party cookie, and those environments are where universal IDs have been adopted most widely. Ownership is concentrating: Publicis agreed to acquire Lotame in March 2025 and LiveRamp in May 2026.

Limitations and disputes

Neutrality is the oldest complaint. The Trade Desk built UID2, administers it and bids with it. "Grading your own homework, being in control of that, seems a little funky," Garett McGrath, chair of Prebid.org, said in May 2026. The same reporting found that a connected TV publisher running as a private UID2 operator sent improperly encrypted tokens for about three months without detection, and saw no change in revenue once the error was fixed. Samantha Jacobson of The Trade Desk said no third party needs "to sit in the middle and look at every single impression."

Privacy is the second. A hashed email is still personal data in the view of most regulators. The US Federal Trade Commission (FTC) said in July 2024 that hashing does not make data anonymous. Critics argue that a persistent cross-site identifier rebuilds the tracking browsers set out to block, with a stronger link to a real person. Supporters answer that login-based IDs carry notice, opt-out and consent records that cookies lacked.

Accuracy and scale are the third. Deterministic IDs cover only users who log in, which is a minority on most open-web sites. Probabilistic extensions widen reach at a cost in precision, and no independent audit of match quality has been published for the main IDs. The Video Advertising Bureau's July 2026 guide named UID2 and RampID and urged buyers to question vendors on how matches are validated, without setting benchmarks.

Fragmentation undercuts the word "universal." A publisher running six ID modules sends six entries in each bid request, and each DSP reads only those it has contracts for.

Not the same as

Third-party cookie. A cookie is a storage mechanism set by one domain and read only by that domain. A universal ID is a value that may be stored in a cookie, often a first-party one, but is meant to be read by many companies.

Mobile advertising ID. Apple's IDFA and Google's advertising ID are device identifiers issued by the operating system and reset by the user. A universal ID is issued by an ad tech provider and usually tied to a login, not a device.

Identity resolution. Identity resolution is the process of deciding which records belong to one person. A universal ID is one possible output of that process, packaged for the bid stream.

Recent developments

The pressure now comes from Apple rather than Google. A WebKit change merged on February 13, 2026 lets Safari block listed domains unconditionally, and with iOS 27, released on September 14, 2026, Safari on iPhone and iPad stopped loading requests to domains including uidapi.com, id5-sync.com and LiveRamp's rlcdn.com, as well as The Trade Desk's ad delivery domain. Apple has not published the list. Mathieu Roche, chief executive of ID5, called it "an attack against the business model of the web". On October 5, 2026, Apple's John Wilander asked The Trade Desk to test an iOS 27.2 beta, without saying what it changes.

Meanwhile, alternatives keep arriving. In June 2026 The Trade Desk added Utiq's telco-based identifiers alongside UID2 and EUID in Europe. Six years after Chrome promised to end the third-party cookie, the cookie remains, and the IDs built to replace it face their sharpest test in Safari.

Timeline

  • 2017: Apple introduces Intelligent Tracking Prevention in Safari
  • April 2018: The IAB Tech Lab acquires DigiTrust
  • July 2019: ID5 makes its universal ID available in Prebid.js
  • September 2019: Firefox blocks third-party tracking cookies by default
  • January 14, 2020: Google says Chrome will phase out third-party cookies within two years
  • July 31, 2020: DigiTrust shuts down
  • October 2020: The Trade Desk begins signing UID2 partners; Lotame launches Panorama ID
  • December 1, 2020: Prebid.org launches SharedID
  • February 18, 2021: Prebid.org is named UID2 operator
  • March 3, 2021: Google says it will not build alternate identifiers to track individuals across the web
  • May 24, 2021: LiveRamp renames IdentityLink as RampID
  • February 2022: The Trade Desk and LiveRamp announce EUID
  • 2022: OpenRTB 2.6 adds the eids array to the user object
  • June 15, 2023: The Trade Desk announces brand and publisher adoption of EUID
  • January 4, 2024: Chrome restricts third-party cookies for 1% of users
  • April 23, 2024: Google delays Chrome cookie deprecation to early 2025
  • July 22, 2024: Google replaces deprecation with a proposed user-choice prompt
  • March 6, 2025: Publicis agrees to acquire Lotame
  • April 22, 2025: Google drops the user-choice prompt and keeps third-party cookies
  • October 17, 2025: Google retires most Privacy Sandbox advertising APIs
  • February 13, 2026: WebKit merges a change allowing unconditional blocking of listed domains
  • May 2026: Reporting reveals three months of undetected broken UID2 tokens at a CTV publisher
  • May 17, 2026: Publicis agrees to acquire LiveRamp
  • June 1, 2026: The Trade Desk adds Utiq telco identifiers in EMEA
  • September 14, 2026: iOS 27 ships; Safari blocks domains used by UID2, ID5 and LiveRamp
  • October 5, 2026: Apple asks The Trade Desk to test an iOS 27.2 beta

Summary

Who. Universal IDs are issued by ad tech companies, including The Trade Desk (UID2 and EUID), LiveRamp (RampID), ID5, Lotame (Panorama ID) and Prebid.org (SharedID). Publishers and SSPs attach them to bid requests; DSPs and advertisers read them. The IAB Tech Lab sets the OpenRTB fields that carry them.

What. A universal ID is a pseudonymous identifier that every party in an ad transaction can read, removing the need for cookie syncing. Most are derived from a normalised, hashed email or phone number; some add probabilistic signals such as IP address.

When. DigiTrust ran from the mid-2010s until July 31, 2020. Most current IDs appeared in 2019 and 2020 after Google's January 2020 cookie announcement. Google reversed that plan in 2024 and 2025, and Apple's iOS 27 began blocking several ID domains in September 2026.

Where. The IDs are created through publisher logins and provider APIs, stored in first-party cookies or local storage, passed through the Prebid User ID module, and carried in the OpenRTB eids array to DSPs, across web, app and connected TV.

Why. Third-party cookies are blocked in Safari and Firefox and absent in apps and connected TV, and cookie syncing loses users at each step. Universal IDs let advertisers apply first-party data across publishers, at the cost of disputes over neutrality, privacy and accuracy.