Unlinkability is the property of a system in which an observer cannot determine whether two pieces of information relate to the same person. Two ad requests, two logins, two purchases: where the property holds, nothing in the data reveals that one individual produced both. It exists because most privacy harm in digital advertising comes not from any single observation but from the joins between them. One page view is close to worthless. The same page view attached to four hundred earlier ones is a profile.

The word is precise in standards literature and loose in trade usage, where it stands in for privacy generally. The gap matters: the formal version carries conditions the casual one drops.

What the property claims

The reference definition comes from a terminology paper by Andreas Pfitzmann of TU Dresden and Marit Hansen of the Schleswig-Holstein data protection authority, circulated in numbered versions through the 2000s and last released as version 0.34 on 10 August 2010. It frames the question around items of interest: unlinkability of two or more items means an attacker cannot sufficiently distinguish whether they are related. An Internet-Draft carried those definitions to the IETF on 5 July 2010. RFC 6973, published by the Internet Architecture Board in July 2013, defines unlinkability as the inability of an observer or attacker, within a particular set of information, to distinguish whether two items of interest are related, at a probability useful to that observer.

Three conditions sit inside that sentence. The property is defined against a named adversary, so a dataset can be unlinkable to one recipient and fully linkable to another holding different side knowledge. It is probabilistic, a matter of degree rather than a binary state. And it is scoped to a set, the pool of candidates among which a record must stay indistinguishable, which is the idea that anonymity sets and k-anonymity thresholds express numerically.

In advertising the joining happens at four layers, each with its own counter-mechanism.

At the storage layer, a cookie gives one domain a stable handle on a visitor, and third-party cookies extended that handle across every site carrying the same tag. Cookie syncing reconciles two vendors' separate handles into one. At the network layer an IP address does the same job with no stored state at all.

At the transport layer the links are explicit fields. Bid requests carry an exchange cookie identifier, a buyeruid produced by syncing and an eids array of third-party identifiers, plus source.tid, which names the auction opportunity itself. OpenRTB 2.6 added provenance to the identifiers array: a source field for the party that defined an identifier, an inserter field for the party that placed it in the request and a matcher field for the party that made the link, with a match method value declaring whether an identifier was observed directly, produced by a cookie sync or bridged by a graph, and a requirement that the value be inherited downstream.

At the data layer, identity graphs and clean rooms resolve scattered identifiers to a person-level token. LiveRamp's RampID is the best-documented case. A February 2024 Cracked Labs report for the Open Rights Group, by Wolfie Christl and Alan Toner, put the system at 250 million identity records in the United States, 45 million in the United Kingdom and 25 million in France, queried more than 60 billion times a day.

How systems try to prevent it

Five families of mechanism recur.

Partitioning keys state to the top-level site rather than the embedder. Michael Kleber of Google set out the design goal in 2019, proposing that web identity be sharded by first-party site with cross-site information deliberately limited. Partitioned cookies shipped as the surviving implementation, storing an embedded service's cookie under two keys instead of one.

Rotation shortens identifier lifetimes or issues a distinct identifier per recipient. Prebid.org applied that to auction plumbing on 27 August 2025, generating bidder-specific transaction identifiers so buyers could no longer recognise one impression arriving through several exchanges.

Network masking removes the address. Chrome's IP Protection routed traffic through two proxies, one operated by Google and one by an external content delivery network, so that no single operator held both the original address and the destination.

Blind tokens separate the moment a client is vouched for from the moment it spends the voucher. The Privacy Pass architecture, standardised as RFC 9576 in June 2024, states the goal as four unlinkability properties covering the relationships between client, origin, issuer and attester, and notes that a token cannot be tied back to the interaction that issued it. Private State Tokens are the browser implementation, with a store of up to 500 per issuer and site and a redemption limit of two per device and issuer every 48 hours.

Anonymous credentials apply the same separation to identity documents. Article 5a(16)(b) of the amended eIDAS regulation requires the European Digital Identity Wallet framework to enable privacy-preserving techniques ensuring unlinkability where an attestation does not require identifying the user. A preceding paragraph bars attribute providers from tracking, linking or correlating transactions without explicit authorisation.

Why it reached the marketing agenda

Linkage is the revenue. Addressable reach, frequency capping, deduplicated reach and multi-touch attribution all assume two observations can be recognised as one person. Unlinkability is therefore a cost line before it is a compliance line, which is why the Prebid change was fought as a commercial dispute: IAB Tech Lab declared the same day that the implementation materially violated the OpenRTB specification, while publishers argued that shared identifiers let buyers stitch requests across sellers.

The regulatory weight arrived later and is heavier. The European Data Protection Board adopted Guidelines 02/2026 on Anonymisation on 7 July 2026, replacing the Article 29 Working Party test of 2014 with three criteria a dataset must satisfy: No Record Isolation, No Linkage and No Inference. The second asks whether a record could be matched, with certainty or high likelihood, to a record about the same person in a separate dataset. That is unlinkability under another name, and failing it means a controller has been processing personal data, retroactively, for the whole period it believed otherwise.

Where it breaks

Identifier removal does not produce unlinkability when the residue is distinctive enough to act as an identifier. Browser fingerprinting is the standing counterexample, and the failures are often accidental. A Firefox defect disclosed in 2026 leaked hash set iteration order reflecting internal memory layout, a stable signal that persisted across origins and contradicted guarantees documented by both Mozilla and the Tor Project. It was patched on 21 April in Firefox 150 and ESR 140.10.

Enforcement inside a protocol is similarly fragile. A 2024 academic evaluation of Protected Audience described attacks in which code running during an auction passed identifiers through covert channels despite the browser's threshold checks.

The relativity condition causes the most confusion in practice. Ruling on pseudonymised transfers involving the Single Resolution Board, the court accepted that data can be non-personal for one recipient while remaining personal for the sender, provided that recipient has no reasonable means of attribution. The corollary is unattractive to anyone selling a fixed guarantee: the same file changes status when it changes hands.

Design choices also get made optional. The Electronic Frontier Foundation, reviewing the European age verification specifications, noted that many of the envisaged privacy mechanisms are options rather than requirements, with the Commission's text saying applications should implement salted hashes and zero-knowledge proofs without obliging them to. Cryptographers reviewing the wallet architecture make a sharper argument about selective disclosure formats built on salted hashes, which reveal a reusable signature across presentations and so fail unlinkability by construction.

The deepest limitation is that the property is not sufficient. No Inference covers cases where a party draws a specific and meaningful conclusion about someone without isolating a record or matching it to another, which is what lookalike modelling and propensity scoring do.

Not the same as

Anonymity concerns whether a record can be attributed to a person at all. Unlinkability concerns the relationship between items: records can be anonymous individually and linkable as a series.

Pseudonymity replaces an identifier with a token and preserves linkage by design. That is the point of a pseudonym, and why the Federal Trade Commission restated on 24 July 2024 that hashing does not produce anonymous data.

k-anonymity is a numeric threshold: each record matches at least k-1 others on the quasi-identifiers considered. It measures isolation within one release rather than correlation across releases.

Undetectability and unobservability, the neighbouring terms in the same terminology paper, protect the existence of an item rather than its relationships. Encryption protects content and leaves linkability untouched.

Recent developments

The consultation on the European anonymisation guidelines runs to 30 October 2026, which puts No Linkage into a live argument with the Commission's Digital Omnibus package and its proposed relativity clause, opposed in a joint opinion by the board and the European Data Protection Supervisor on 10 February 2026.

Mechanism supply is moving the other way. Chrome retired most Privacy Sandbox technologies on 17 October 2025, including IP Protection and Protected Audience, keeping partitioned cookies, federated identity and Private State Tokens. A United States court gave final approval on 26 March 2026 to the Google real-time bidding settlement, adding a user control that strips Google user identifiers, IP addresses, device identifiers and cookie-matching data from bid requests. The most active standards work has moved to credentials, where the W3C Federated Identity Working Group's Digital Credentials draft defines unlinkability explicitly, separating the case where verifiers compare presentations from the case where a verifier colludes with the issuer.

Timeline

  • 1981: David Chaum publishes the work on untraceable mail and digital pseudonyms underpinning the field
  • 2000s: Pfitzmann and Hansen circulate successive versions of their privacy terminology paper
  • 5 July 2010: An Internet-Draft submits that terminology to the IETF
  • 10 August 2010: Version 0.34 of the terminology paper is released
  • July 2013: RFC 6973 defines unlinkability for Internet protocol design
  • 2019: A potential privacy model for the web proposes sharding identity by first-party site
  • 20 May 2024: Regulation (EU) 2024/1183 enters into force with an unlinkability requirement for the identity wallet
  • June 2024: RFC 9576 specifies the Privacy Pass architecture and its unlinkability goals
  • 24 July 2024: The Federal Trade Commission restates that hashed identifiers are not anonymous
  • 15 May 2025: W3C publishes Privacy Principles as a Statement
  • 27 August 2025: Prebid.org ships bidder-specific transaction identifiers
  • 17 October 2025: Chrome retires most Privacy Sandbox technologies, including IP Protection
  • 10 February 2026: European data protection authorities oppose the Digital Omnibus relativity clause
  • 26 March 2026: Final approval of the Google real-time bidding settlement
  • 21 April 2026: Firefox patches a cross-origin leak contradicting its unlinkability guarantees
  • 7 July 2026: The European Data Protection Board adopts Guidelines 02/2026 on Anonymisation
  • 30 October 2026: Deadline for comment on those guidelines

Summary

Who. Defined by privacy researchers and standards bodies, chiefly Pfitzmann and Hansen, the Internet Architecture Board, the IETF and W3C; required of identity wallets by the European legislator; tested for by the European Data Protection Board; and resisted, where it cuts revenue, by buyers and intermediaries.

What. The inability of a specified observer to determine whether two items of information relate to the same person, at a probability useful to that observer.

When. Formalised in terminology work through the 2000s, fixed in RFC 6973 in July 2013, written into European identity law in 2024, and made a regulatory test as No Linkage in July 2026.

Where. At the browser storage layer, the network layer, the bid request fields carrying identifiers and auction identifiers, the graphs and clean rooms that resolve them, and the credential presentations now being standardised.

Why. Every addressable audience, frequency cap and attributed conversion depends on linking two observations to one person, so the property that prevents linking sets the outer boundary of what advertising can measure, and that boundary is now drawn by regulators rather than by vendors.