Glossary/Privacy & Identity

• Ads Data Hub (ADH)

  Google's cloud-based clean room for analyzing Google ads and YouTube event data alongside an advertiser's first-party data in BigQuery under privacy checks.

• Anonymization

  Irreversibly processing data so individuals can no longer be identified by any reasonable means, taking it outside the scope of GDPR.

• App Tracking Transparency (ATT)

  Apple's rule requiring apps to get permission before tracking users across apps and sites.

• Authenticated Traffic

  Visits from users who are logged in or have shared an email, enabling deterministic, consented identifiers for targeting and measurement.

• California Delete Act (DROP)

  California law creating DROP, a state platform letting residents request deletion from all registered data brokers with one request, which brokers must process from August 2026.

• California Invasion of Privacy Act (CIPA)

  A California wiretapping law increasingly used in class actions alleging that website pixels, chat tools and session replay intercept communications without consent.

• CAN-SPAM Act

  The US law setting rules for commercial email, including truthful headers and subject lines, a physical address and honoring opt-out requests within 10 business days.

• Canada's Anti-Spam Legislation (CASL)

  Canadian law requiring consent, sender identification and an unsubscribe mechanism for commercial electronic messages such as marketing email and texts.

• CCPA / CPRA

  California's consumer privacy laws granting rights to know, delete, and opt out of data sale.

• Children's Online Privacy Protection Act (COPPA)

  A US law requiring verifiable parental consent before collecting personal data from children under 13 online; FTC amendments finalized in 2025 tightened its rules.

• Consent Management Platform (CMP)

  Tools that collect and store users' privacy consent choices.

• Consent Rate

  The share of visitors who accept tracking or marketing in a consent prompt, which directly affects how much data analytics and ad platforms receive.

• Cookieless Advertising

  Targeting and measurement approaches that do not rely on third-party cookies.

• Cross-Device Tracking

  Recognizing the same person across phones, computers and TVs, using logins (deterministic) or statistical signals (probabilistic), for targeting and attribution.

• Customer Data Platform (CDP)

  Software that unifies customer data from many sources into persistent profiles.

• Customer Match

  Google's feature for uploading hashed customer lists to reach or exclude those people across Search, YouTube, Gmail and other Google inventory.

• Dark Patterns

  Interface designs that manipulate users into choices they might not otherwise make, such as hidden reject buttons, which regulators treat as invalidating consent.

• Data Broker

  A company that collects and sells or licenses personal data about consumers it has no direct relationship with.

• Data Clean Room

  A secure environment where parties match and analyze data without exposing raw records.

• Data Management Platform (DMP)

  A legacy platform for collecting and segmenting mostly anonymous audience data for ad targeting.

• Data Minimization

  The principle of collecting and keeping only the personal data necessary for a specified purpose.

• Data Onboarding

  Matching offline or CRM records to online identifiers so a brand can reach or measure those customers in digital media.

• Data Processing Agreement (DPA)

  A contract between a data controller and processor setting out how personal data may be handled, as required by GDPR Article 28.

• Data Subject Access Request (DSAR)

  A request from an individual to see, correct, delete or obtain the personal data an organization holds about them.

• Deterministic Matching

  Linking identities using exact identifiers, such as a hashed email or login.

• Device Fingerprinting

  Identifying a device by combining its technical attributes, often restricted by privacy rules.

• Differential Privacy

  Adding statistical noise so aggregate insights can be shared without identifying individuals.

• Digital Markets Act (DMA)

  An EU law imposing obligations on designated gatekeeper platforms, including requiring user consent before combining personal data across their services for advertising.

• Digital Services Act (DSA)

  An EU law regulating online platforms that bans ads targeted to minors or based on sensitive data and requires ad transparency and repositories.

• ePrivacy Directive (Cookie Law)

  The EU directive requiring user consent before storing or accessing information on a device, such as non-essential cookies, which is why cookie banners exist.

• EU AI Act

  The EU's risk-based AI law, phased in from 2024, whose transparency duties require disclosing AI-generated or manipulated content such as deepfakes and chatbot interactions.

• EU-U.S. Data Privacy Framework (DPF)

  The 2023 mechanism allowing certified US companies to receive personal data from the EU, replacing the invalidated Privacy Shield.

• First-Party Cookie

  A cookie set by the domain a user is visiting, used for logins, preferences and analytics, and far less restricted by browsers than third-party cookies.

• First-Party Data

  Data a company collects directly from its own customers and audiences.

• GDPR

  The EU's General Data Protection Regulation governing personal data use.

• Global Privacy Control (GPC)

  A browser signal that tells sites a user opts out of data sale or sharing.

• Google Consent Mode

  Google's method for adjusting tags based on consent and modeling lost conversions.

• Hashed Email

  An email address converted to an irreversible string used as a privacy-safer identifier.

• HIPAA

  The US health privacy law protecting patient information held by healthcare providers and their partners, which restricts health organizations' use of tracking pixels.

• Identity Graph

  A database connecting identifiers that belong to the same person or household.

• Identity Resolution

  Linking identifiers across devices and channels to one person or household.

• Intelligent Tracking Prevention (ITP)

  Apple Safari's set of protections that block third-party cookies and shorten the lifespan of some first-party cookies and tracking storage.

• Legitimate Interest

  A GDPR lawful basis allowing processing without consent when an organization's interest is balanced against, and not overridden by, the individual's rights.

• Link Tracking Protection

  An Apple feature that strips known tracking parameters, such as click IDs, from URLs in Mail, Messages and Safari Private Browsing.

• Mail Privacy Protection (MPP)

  An Apple Mail feature that preloads remote content, including tracking pixels, making email open rates unreliable for users who enable it.

• Maryland Online Data Privacy Act (MODPA)

  Maryland's privacy law, effective October 2025, among the strictest US state laws, with strict data-minimization rules and a ban on selling sensitive data.

• Match Rate

  The percentage of a brand's records that a platform, onboarder or clean room partner can successfully match to its own users.

• Mobile Ad ID (MAID / IDFA / GAID)

  Device-level advertising identifiers on iOS (IDFA) and Android (GAID).

• Opt-In Consent

  Permission a person actively gives, such as ticking a box, before their data is collected or they receive marketing, as GDPR and CASL generally require.

• Opt-Out of Sale or Sharing

  A consumer right under US state privacy laws to stop a business from selling their data or using it for targeted or cross-context advertising.

• Overlap Analysis

  A clean room analysis showing how many customers two parties share, without either side seeing the other's individual records.

• Pay or Okay (Consent or Pay)

  A model where users must either consent to personalized ad tracking or pay a subscription for an ad-free or tracking-free experience, contested under EU law.

• Personally Identifiable Information (PII)

  Information that can identify a specific individual directly, like name or email, or in combination with other data, like address and birth date.

• PIPEDA and Law 25

  Canada's federal privacy law and Quebec's stricter provincial privacy law.

• Privacy by Design

  Building privacy protections into products and processes from the start, a principle GDPR codifies as data protection by design and by default.

• Privacy Sandbox

  Google's set of APIs proposed to support ads with less cross-site tracking in Chrome.

• Privacy-Enhancing Technologies (PETs)

  Techniques such as differential privacy and encryption that protect data during use.

• Probabilistic Matching

  Linking identities using statistical signals such as IP address and device type.

• Pseudonymization

  Replacing direct identifiers with codes or tokens so data cannot be linked to a person without separately held information; still personal data under GDPR.

• Publisher Provided Identifier (PPID)

  A first-party ID a publisher assigns to its logged-in or known users and shares with its ad server for frequency capping and audience targeting.

• RampID

  LiveRamp's pseudonymous people-based identifier that links devices and records to individuals and households for targeting and measurement.

• Right to Erasure (Right to Be Forgotten)

  An individual's right under GDPR and similar laws to have their personal data deleted when it is no longer needed or consent is withdrawn.

• Second-Party Data

  Another company's first-party data shared directly through a partnership.

• Sensitive Personal Information

  Special categories of data such as health, precise location, race, religion, sexual orientation and biometrics that privacy laws protect more strictly.

• Server-Side Tracking

  Collecting and sending event data from a server rather than the user's browser.

• SKAdNetwork (AdAttributionKit)

  Apple's privacy-preserving framework for measuring app install campaigns.

• Standard Contractual Clauses (SCCs)

  European Commission-approved contract terms that companies sign to legally transfer personal data from the EU to countries without an adequacy decision.

• TC String

  The encoded text string created under IAB Europe's TCF that records a user's consent and objection choices for each purpose and vendor.

• Third-Party Cookie

  A cookie set by a domain other than the one a person is visiting, used for cross-site tracking.

• Third-Party Data

  Data collected by companies with no direct relationship to the consumer and sold to others.

• Unified ID 2.0 (UID2)

  An open-source identifier built on hashed, consented email addresses.

• Universal ID

  A shared identifier across the ad ecosystem meant to replace third-party cookies.

• US State Privacy Laws

  The growing patchwork of comprehensive consumer privacy laws in states such as California, Virginia, Colorado, Connecticut and Texas, absent a federal US privacy law.

• Washington My Health My Data Act

  A Washington State law, effective 2024, requiring consent to collect or share consumer health data broadly defined, with a private right of action.

• Zero-Party Data

  Data customers intentionally share, such as preferences and survey answers.