User Data, Targeting in the Cookieless Era: Data Clean Rooms

In recent years, quite a few articles have been warning us about the “cookieless era” that awaits us, starting in 2024. Going forward, the use of third-party cookies will be phased out, impacting our online marketing capabilities. One of the proposed solutions for being able to target our audiences in the future is called a Data Clean Room. Before we dive into its role and benefits, let us start by understanding what a Data Clean Room is.

What is a Data Clean Room?

A Data Clean Room (DCR) is a neutral environment where companies can exchange customer data without revealing any of the underlying personal information (e.g., email addresses or phone numbers). These anonymized data sets then enable companies to collaborate without sharing actual customer data, which is often not possible due to privacy regulations or competitive considerations.

For example, a shoe store like Foot Locker might be willing to assist in targeted campaigns to boost demand for Nike shoes. However, it may not be wise to share their own customer list with Nike, considering Nike’s own e-commerce interests. Even when working with trusted partners, every time a list is shared, the risk of leaks exists, making it challenging to determine which names to remove in case of consent withdrawal.

The essence of a DCR is that it enables collaboration across different organizations with diverse data sources, without sharing any sensitive information.

To illustrate how a DCR can be of benefit, let us consider the example of Max:

Max is an avid hiker and has been a loyal customer of an outdoor retailer, where she buys her hiking shoes and camping gear. Last summer, Max booked a trip through a travel agency, which is now launching a new type of travel package: adventurous hiking vacations. For their launch campaign, the agency decided to collaborate with the outdoor retailer by setting up a Data Clean Room.

Both organizations upload their customer databases to the DCR environment. Max appears in both datasets, but the data from one party cannot be extracted from the DCR by the other. This means that the travel agency does not know that their existing customer Max is also interested in hiking. The DCR prevents direct communication of this information to the travel agency. However, they can gain insights into how many customers of the outdoor retailer can be identified as potential hikers. The retailer’s data can then be used to create a customer segment and activate it across multiple media channels via the DCR. This way, all potential hikers from the retailer’s data set can be targeted with ads for a new adventurous hiking vacation without the travel agency accessing the individual data of the retailer’s customers.

In addition to activating external customer data, segments can also be created by combining the two datasets. The travel agency, for example, could target only the customers of the retailer who are not already known to the travel agency, assuming that these customers are already reached through their email campaigns. Based on a common identifier, these mutual customers can be filtered out.

A DCR can also help to improve match rates, filling any identification gaps by using data from other organizations. If the travel agency only has a phone number, and the retailer has both a phone number and email address, Max can now be retargeted by the travel agency via email because the activation to media channels occurs through the DCR.

What are the benefits of using a Data Clean Room?

In general, there are several benefits associated with the use of a DCR:

Enriched customer insights: By placing data into a Data Clean Room, organizations enrich their first-party data with the help of other partners in the DCR, gaining additional insights into their own customers (e.g., 40% of the retailer’s customers are interested in hiking).

Online targeting without cookies: DCR environments integrate with publishers, providing an alternative to traditional cookie-based targeting, especially as browsers restrict the exchange of customer data through third-party tracking scripts and cookies.

Attribution analysis: DCRs allow advertisers to perform attribution analyses by connecting touchpoints with prospects across platforms, providing insights into the effectiveness of campaigns.

How does a DCR address privacy regulation?

We mentioned that personal information cannot be extracted from the Data Clean Room environment. But how does this work exactly? Below, we go through the most common precautions taken by several types of DCRs to respect consumer privacy and help their clients comply with GDPR regulations.

• Pseudonymization: One of the primary data operations performed by a DCR is pseudonymizing any personally identifiable information (PII), transforming it into a non-identifiable format by replacing sensitive information such as names or addresses with abstract identification codes.
• Differential Privacy: This concept involves adding “noise” to the data to prevent the identification of individual data points. It ensures that data analysis results remain statistically significant while protecting individuals’ privacy. Additionally, privacy thresholds are applied, meaning that data is only shared at a sufficiently high aggregation level to prevent the identification of individual users.
• Federated Learning: In federated learning, algorithms or models are trained across multiple, decentralized datasets without the need to merge the data. This allows operationalizing a model without sharing data.
• Private Set Intersection: This technique encrypts data, only revealing which data points are common with the own dataset. This allows the identification of overlap without exposing the rest of the data.

Within the DCR environment, data can be combined and compared, but the enriched data cannot be exported back to your data warehouse. In our example, the travel agency can learn that, for example, 40% of their customers are hiking enthusiasts according to the outdoor retailer. They can then target this specific group in an advertising campaign on connected media channels. However, they cannot export this data to their own CDP/CRM, and the travel agency cannot enrich Max’s customer profile with the attribute “hiking”.

To prevent advertisers from trying to enrich their own datasets through indirect means, a good DCR imposes limits that make it impossible to reduce insights to one specific profile. For example, they may apply minimum segment volumes (e.g., a segment must always contain at least 100 profiles) and/or randomly add false positives, introducing noise to the data by adding profiles to a segment without qualifying for that segment.

Other privacy measures found in many DCRs include data retention limitations (e.g., data is automatically deleted after 14 months) and data processing logs keeping track of which parties have consulted or modified any data).

It is crucial to emphasize that a Data Clean Room is not an alternative to obtaining consent. Companies are still responsible for obtaining the correct permissions for all profiles shared within the DCR platform. This means informing the customer about the use of their data and the parties with whom that data can be shared.

Challenges in deploying a DCR:

• Match rates depend on the applied keys and identifiers:

If Max is known to the travel agency as max@outlook.com and uses the email address max@gmail.com with the outdoor retailer, there will be no match within the DCR. In such cases, finding an additional party with the Outlook email address and another key available to the outdoor retailer, such as a phone number, can still enrich the DCR. This allows the retailer to link the Gmail account to the Outlook account and still make the match.

• Need for qualitative data sets:

A DCR requires a more active role in your data strategy. You either need to have an extensive first-party dataset or find the right partners to help you build the right segments and/or identify customers.

• Not a solution for GDPR:

While a DCR anonymizes PII from uploaded datasets and individual user data cannot be extracted from the DCR, the anonymized keys are still linked to a specific person and thus considered personal data. This data is used within the DCR for marketing purposes, and consent remains necessary.

Convinced? These would be your next steps:

• Start with a first-party data strategy to build your own database of customer profiles as effectively as possible.
• Define your use case: What do you want to achieve, and what does a successful deployment of a DCR look like for your organization?
• Map the other data partners you need: Do you have all the required pieces to make your data valuable?
• Select a suitable DCR technology based on your use case and requirements.
• Evaluate and monitor your results: Is the DCR setup performing as expected? Adjust where necessary.

If you want to know how to start a first-party data strategy, need advice on Data Clean Rooms, or want to increase your match rates, contact us at Stitch’d.