Alternative Identity Solutions: UID2, ID5 & LiveRamp

1. Why Alternative IDs Exist

For two decades, third-party cookies were the primary mechanism for identifying users across the open web. They enabled behavioral targeting, frequency capping, conversion attribution, and cross-site audience building — the foundational capabilities of programmatic advertising. With third-party cookies now blocked or restricted across all major browsers, the industry needed alternative mechanisms for user identification that respect privacy regulations and browser policies.

Alternative identity solutions emerged to fill this gap. They provide deterministic or probabilistic user identifiers that work without third-party cookies, enabling the core advertising functions of audience targeting, measurement, and personalization while operating within the constraints of GDPR, CCPA, and browser privacy features.

The key design principles of modern identity solutions include:

• Privacy by design: Built-in consent management, transparency, and user control mechanisms.
• Deterministic or probabilistic matching: Based on authenticated data (hashed emails) or statistical models rather than opaque third-party cookies.
• Interoperability: Designed to pass through the OpenRTB bid stream using standardized extensions (user.ext.eids).
• Regulatory compliance: Engineered to operate within GDPR, CCPA, and other privacy frameworks from the ground up.

2. UID2 by The Trade Desk

Unified ID 2.0 (UID2) is an open-source, deterministic identity framework originally developed by The Trade Desk and now governed by the Prebid.org community. It has become one of the most widely adopted alternative identity solutions in programmatic advertising.

How UID2 Works

1. Consent capture: A publisher obtains the user's consent (under GDPR) or provides a "Do Not Sell" opt-out mechanism (under CCPA) and collects the user's email address through authentication (login, newsletter signup, subscription).
2. Email hashing: The publisher's integration (client-side SDK or server-side API) sends the user's email address to the UID2 operator service. The service normalizes the email (lowercase, trim whitespace) and applies SHA-256 hashing to create a deterministic, opaque identifier.
3. Token generation: The operator generates a UID2 token — a refreshable, encrypted identifier that can be decrypted only by authorized participants in the UID2 ecosystem. The token contains the hashed email but is encrypted to prevent unauthorized parties from reverse-engineering the underlying email.
4. Bid stream propagation: The UID2 token is included in OpenRTB bid requests via the user.ext.eids array with source: "uidapi.com". DSPs that are UID2 participants can decrypt the token and use it for targeting, frequency management, and attribution.
5. User control: Users can view, manage, and opt out of UID2 through a centralized transparency and control portal. Opt-out signals are propagated to all UID2 participants.

Key Advantages

• Open source: The specification and reference implementations are publicly available, reducing vendor lock-in concerns.
• Deterministic: Based on authenticated email addresses, providing high match rates and accurate cross-device identification.
• Refreshable tokens: Tokens rotate regularly, preventing static identifier accumulation and supporting granular consent withdrawal.
• Broad ecosystem: Supported by major SSPs (PubMatic, Magnite, Xandr), DSPs (The Trade Desk, Google DV360, Amazon), and data providers.

3. ID5

ID5 is a London-based identity platform that provides both deterministic and probabilistic identity solutions. It has gained significant adoption particularly in the European market, where its privacy-first approach aligns well with GDPR requirements.

How ID5 Works

ID5 generates a universal identifier (the ID5 ID) by combining multiple signals:

• Deterministic signals: Hashed email addresses from authenticated publisher sessions, when available and consented.
• Probabilistic signals: Browser attributes, device characteristics, network properties, and other environmental signals that can identify a device or user cohort without persistent cookies.
• Machine learning models: Statistical matching that links probabilistic signals to deterministic identities with high confidence, improving match rates beyond email-only approaches.

The ID5 ID is passed through the bid stream in the same user.ext.eids format as UID2, with source: "id5-sync.com". ID5 provides a JavaScript library that publishers deploy on their pages, which generates and refreshes the ID5 ID client-side and makes it available to the ad tech stack via Prebid.js or direct integration.

Key Advantages

• Hybrid approach: Combines deterministic and probabilistic signals for higher match rates than email-only solutions, particularly on unauthenticated traffic.
• GDPR-native: Built with European privacy requirements as a first-class design constraint, with strong consent integration and DPA frameworks.
• Prebid integration: First-class support in Prebid.js, the most widely deployed header bidding wrapper.
• Privacy controls: Built-in user opt-out mechanism and compliance with IAB TCF consent signals.

4. LiveRamp ATS

LiveRamp's Authenticated Traffic Solution (ATS) is an identity resolution platform that connects authenticated publisher users to the programmatic supply chain. LiveRamp is one of the oldest and largest identity companies in ad tech, with a history rooted in offline-to-online data onboarding.

How ATS Works

1. Authentication: Publishers collect authenticated user data (email, phone number) through login, subscription, or other consented interactions.
2. RampID generation: LiveRamp applies its proprietary hashing and identity resolution process to generate a RampID — a pseudonymous, people-based identifier that can be matched across devices, channels, and platforms.
3. Envelope creation: The RampID is wrapped in an "envelope" — an encrypted token that can be passed through the bid stream and decrypted by authorized LiveRamp partners.
4. Resolution: DSPs and data providers that partner with LiveRamp can resolve the RampID to their own identity graph, enabling cross-device targeting and measurement.

Key Advantages

• Cross-device graph: LiveRamp maintains one of the industry's largest identity graphs, linking email, phone, cookie, device ID, and offline identifiers across billions of profiles.
• Offline-to-online bridge: Unique capability to connect online advertising exposure to offline purchase behavior through retail and CRM data partnerships.
• Enterprise adoption: Widely used by large advertisers and agencies for audience activation, measurement, and data collaboration.
• Clean room integration: LiveRamp's identity infrastructure powers several leading data clean room solutions for privacy-safe data collaboration.

5. NextRoll & Other Solutions

Beyond the three major solutions, several other identity and targeting platforms operate in the cookieless ecosystem:

• NextRoll: Operates a proprietary identity graph based on first-party data from its network of publisher and advertiser partners. Provides retargeting and prospecting capabilities using cookieless matching.
• Lotame (now part of ID5): Provided audience data management and identity solutions focused on publisher-first data strategies. Acquired by ID5 to strengthen its publisher-side capabilities.
• Tapad: Cross-device identity and targeting based on probabilistic device graph matching, particularly strong in connected TV and cross-screen attribution.
• Throtle: Real-time identity resolution and audience targeting using a combination of deterministic and probabilistic signals.
• publisher-first identity graphs: Large publishers (The New York Times, Washington Post, Meredith) have built proprietary identity systems based on their authenticated user bases, offering direct targeting products to advertisers.

6. Comparison Table

7. Publisher Integration

For publishers looking to implement alternative identity solutions, the following integration steps apply across most providers:

1. Establish authentication touchpoints: Identify where users provide email addresses or other authenticated identifiers on your properties (login, newsletter signup, subscription, gated content, surveys).
2. Implement consent capture: Ensure that identity generation is conditioned on valid consent (GDPR) or opt-out compliance (CCPA). Integrate with your CMP so that identity signals are only generated when the user has consented to the relevant purposes.
3. Deploy the identity SDK: Install the provider's JavaScript library or server-side integration on your authenticated pages. Configure it to generate identity tokens and make them available to your ad stack.
4. Wire to your ad stack: Configure your SSP or header bidding wrapper (Prebid.js) to include the identity token in bid requests. Most providers have native Prebid.js modules that handle this automatically.
5. Test and validate: Verify that identity tokens appear correctly in bid requests, that DSPs can resolve them, and that consent withdrawal is properly handled.
6. Monitor match rates: Track the percentage of impressions carrying a valid identity signal. Typical match rates range from 20–60% depending on authentication rates and traffic mix.

8. Privacy Compliance

All alternative identity solutions must operate within the same privacy frameworks that governed the cookie-based ecosystem — and in many cases, with additional scrutiny:

• GDPR compliance: Hashed email addresses are personal data under GDPR. Generating and sharing UID2, ID5, or RampID tokens requires valid consent (or legitimate interest, depending on the DPA's interpretation) and must be disclosed in the publisher's privacy notice and CMP.
• CCPA compliance: Sharing identity tokens with ad tech partners constitutes "sharing" under CPRA if used for cross-context behavioral advertising. Publishers must honor "Do Not Sell or Share" requests by ceasing identity token generation and propagation for opted-out users.
• Transparency: Publishers must clearly disclose which identity providers they use, what data is collected, and how it is used. This information should appear in the CMP's vendor list and the publisher's privacy policy.
• User rights: Users must be able to access, correct, delete, and opt out of identity-based processing. Each identity provider offers user-facing control mechanisms, and publishers should link to these from their privacy settings.
• Data minimization: Only collect and process identity signals that are necessary for the stated advertising purpose. Avoid collecting identity data for purposes beyond what was disclosed and consented.

Alternative identity solutions represent the programmatic industry's most significant infrastructure investment since the adoption of real-time bidding itself. They provide a path forward for audience targeting, measurement, and personalization in a world where third-party cookies no longer function. The solutions that succeed will be those that combine broad ecosystem adoption, strong privacy compliance, high match rates, and genuine user transparency and control.