Even with server-side cookies extending lifetimes, cookies alone don’t solve cross-device tracking or attribution after a user clears their browser data. Cookies track devices, not people. A user who researches on iPhone and converts on desktop is invisible to cookie-based attribution — two separate device identities with no connection.
The identity resolution approaches that fill this gap for advertising measurement work fundamentally differently from cookie-based tracking. Instead of persisting a device identifier across sessions, they match user actions to known identities using signals that survive browser restrictions: first-party data you collected with consent, logged-in Google or email identity, and privacy-safe collaborative datasets.
These approaches don’t replace server-side tracking. They extend its reach into scenarios where cookies can’t operate.
Enhanced Conversions
Google’s Enhanced Conversions captures first-party data at the point of conversion — email address, phone number, physical address, name — hashes it using SHA-256, and sends the hashed values alongside the conversion event. On Google’s side, the hash is matched against signed-in Google accounts to attribute the conversion even when cookies have been deleted or were never set.
The implementation belongs in a server-side GTM tag rather than client-side, for two reasons. First, hashing sensitive data client-side exposes it to browser inspection and any JavaScript running on the page. Second, a server-side tag can enrich the conversion data before forwarding it — appending additional first-party signals that the client-side event might not have included.
The consent requirement is non-negotiable: ad_user_data must be granted in Consent Mode v2 before Enhanced Conversions data will be used. Google’s system silently drops the enhanced data when this parameter isn’t granted — the conversion tag appears to fire normally in preview mode, but the identity matching doesn’t happen. This is one of the most common silent failures in Google Ads implementations.
Realistic uplift: advertisers report 5-25% more attributed conversions after implementing Enhanced Conversions. The best results come when more than half of conversion events include enhanced data. If only 10% of conversions carry email addresses, the uplift is minimal because there’s little to match. This means the value of Enhanced Conversions scales with your ability to collect first-party data at conversion points — which is a product and UX problem as much as a technical one.
Unified ID 2.0 (UID2) and EUID
Unified ID 2.0, created by The Trade Desk, uses hashed email addresses as the cross-site identifier. When a user authenticates or provides their email on a publisher’s site, the publisher generates a UID2 token from the hashed email. That token travels through the programmatic advertising ecosystem — DSPs, SSPs, buy-side and sell-side — where it enables targeting and attribution without third-party cookies.
The consent model is explicit: UID2 requires users to have consented to the use of their email for advertising purposes. The consent is distinct from email marketing consent; it covers the use of the identifier for advertising targeting across different sites. Publishers must present this clearly and record it.
The European variant, EUID, is designed specifically for GDPR and TCF compliance. The token generation happens in European infrastructure, and the consent framework integrates with TCF v2.2 so that signals flow correctly through the standard consent chain that European publishers already use.
Major SSPs supporting UID2 include Index Exchange, Magnite, PubMatic, and OpenX. Buy-side adoption includes The Trade Desk itself and a growing number of DSPs. For publishers in programmatic advertising, UID2/EUID represents a post-cookie alternative identity graph that doesn’t depend on browser-set cookies for recognition.
The practical limitation: UID2 only works when users authenticate or provide an email. Unauthenticated visits produce no UID2 token and remain unresolvable. Coverage varies dramatically by site type — media and ecommerce sites where users log in have high coverage; content sites without authentication have near-zero.
Data Clean Rooms
Data clean rooms are computation environments where two or more parties can run analytics against joined datasets without either party being able to see the other’s raw data. The privacy guarantee comes from the computation model: queries execute inside a controlled environment, and only aggregated, statistically safe results leave.
For advertising measurement, the common use case is matching an advertiser’s customer file against a platform’s user graph to measure campaign performance without the advertiser seeing individual platform user data or the platform seeing the advertiser’s full customer records.
Platform-specific clean rooms:
- Google Ads Data Hub: Matches Google Ads data against first-party data. Allows cross-channel attribution, frequency analysis, and audience overlap analysis that aren’t available through the standard Google Ads interface.
- Meta Advanced Analytics: Equivalent capability in the Meta ecosystem.
- Amazon Marketing Cloud: Attribution analysis for campaigns across Amazon’s ad inventory.
Cloud-native clean rooms allow multi-party collaboration without being tied to a single platform’s ecosystem:
- Snowflake Data Sharing + Clean Rooms: SQL queries run against shared datasets with privacy controls built into the sharing agreement.
- AWS Clean Rooms: Similar model in AWS infrastructure.
- BigQuery Analytics Hub: Google’s offering for dataset sharing with row-level and column-level security.
Clean rooms are increasingly standard infrastructure for large advertisers who run significant spend across multiple channels and need to reconcile attribution without giving each platform access to the full cross-platform dataset. They’re overkill for most small and mid-market implementations but become necessary at scale — especially when you’re trying to measure true incrementality across channels that each claim credit for the same conversions.
How These Fit Together
These approaches are not alternatives to each other or to server-side tracking. They’re a stack:
- Server-side cookies extend cookie lifetimes for the users where cookies work (solving the Safari ITP problem)
- Enhanced Conversions recovers attribution for converting users who cleared cookies or used a different device
- UID2/EUID enables targeting and attribution for authenticated users in the programmatic ecosystem
- Data clean rooms provide cross-platform measurement at scale, where no single platform can see the full picture
Each layer handles a different failure mode. The baseline that makes all of them work better is a solid consent implementation — because Enhanced Conversions requires ad_user_data granted, UID2 requires authenticated consent, and clean rooms only contain data that was legally collected.
The analytics identity resolution problem (linking GA4 cookie identifiers to CRM records) is adjacent but distinct. That’s about building a complete picture of a customer’s journey in your warehouse. The ad measurement identity problem here is about attributing advertising spend to outcomes — the underlying techniques (hashing, matching, consent gating) overlap, but the infrastructure and business purpose differ.