Audience Data, Identity and Targeting

Introduction

Programmatic advertising depends on the ability to make decisions about audiences at machine speed. Every bid, impression, frequency decision and optimisation action is influenced by information about users, devices, contexts or households. Yet audience data is not a neutral resource. It is collected through particular technical systems, interpreted through assumptions, exchanged under contractual and regulatory constraints, and activated through identifiers whose reliability is variable.

The most important strategic change in contemporary programmatic advertising is the movement from indiscriminate third-party tracking towards consented, first-party, contextual and privacy-enhancing approaches. The decline of third-party cookies is part of this change, but it is not the whole story. Mobile identifiers, connected television identifiers, identity graphs, login systems, retail media data, clean rooms, browser controls and data-protection law all shape the emerging audience ecosystem.

This chapter examines how audience data is classified, evaluated and activated. It distinguishes first-, second- and third-party data; explains contextual and behavioural targeting; analyses customer data platforms (CDPs), identity graphs and data clean rooms; and evaluates cohort-based and post-cookie strategies. The central managerial question is not simply whether an audience can be identified, but whether it can be identified lawfully, accurately, transparently and with sufficient value to justify the associated risks.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Distinguish first-, second- and third-party data and evaluate their relative strengths and weaknesses.
2. Compare contextual, behavioural, demographic, geographic, predictive and cohort-based targeting.
3. Explain the roles of CDPs, data-management platforms, identity graphs and clean rooms.
4. Assess identity quality using concepts such as determinism, probability, reach, match rate and persistence.
5. Design a consented, post-cookie audience strategy.
6. Critically evaluate privacy, fairness, governance, security and regulatory implications.

1. Audience Data as an Economic and Technical Resource

Audience data consists of observations, attributes, events and inferences associated with people, households, devices, accounts or contexts. An observation may be a page view, product purchase, app event, video completion or store visit. An attribute may be an age range, subscription status or broad geographic area. An inference may be a predicted propensity to purchase.

A useful distinction is between identity, attributes and intent:

• Identity concerns which account, device, household or person is being represented.
• Attributes describe characteristics associated with that entity.
• Intent concerns a likely future action, such as purchase or subscription.

These categories are often confused. A browser identifier does not necessarily identify a person. A segment labelled “luxury travellers” is not a directly observed fact; it may be an inference based on browsing, transactions or statistical modelling. Sound planning therefore requires explicit documentation of what is observed, what is inferred and what is merely predicted.

Audience data has four principal dimensions of quality:

Data quality must be considered together with activation value. Highly accurate data may have limited value if it cannot be used in the relevant media environment. Conversely, broad data may provide reach but little predictive or strategic value.

2. First-, Second- and Third-Party Data

2.1 First-party data

First-party data is collected directly by an organisation from its own interactions with customers, prospects, employees or users. Examples include account registration, authenticated website activity, app events, loyalty transactions, customer-service records and declared preferences.

Its principal advantages are provenance, direct relationship and potential relevance. A retailer can often observe whether a customer purchased a product, while an external vendor may only infer purchase intent. First-party data can also support value-based segmentation, lifecycle marketing and measurement.

Its limitations include restricted scale, organisational silos, incomplete consent records, inconsistent identifiers and the risk that customer data is used beyond reasonable expectations. First-party does not mean automatically lawful or ethically unrestricted. The organisation must still establish an appropriate legal basis, communicate purposes, respect user choices and protect the data.

2.2 Second-party data

Second-party data is another organisation’s first-party data made available through a direct partnership. For example, an airline and a hotel group might create a controlled audience partnership, or a publisher might provide an advertiser with access to a consented contextual or subscriber segment.

Second-party arrangements can provide differentiated reach and strategic relevance. They require contractual controls covering purpose limitation, data fields, retention, security, matching methods, audit rights, deletion and restrictions on onward transfer. The buyer should not assume that the seller’s consent or notice automatically covers every downstream use.

2.3 Third-party data

Third-party data is obtained from an organisation that did not collect the data through the advertiser’s direct relationship. Data brokers and audience vendors may aggregate information from multiple sources and create segments for activation.

Third-party data can provide scale, but its provenance may be distant from the advertiser and the individual. Common problems include duplicated records, outdated attributes, opaque modelling, uncertain consent, low match quality and segment labels that are difficult to validate. Third-party data should therefore be treated as a claim requiring due diligence, not as an objective description of an audience.

3. Targeting Models

3.1 Contextual targeting

Contextual targeting selects an impression according to the content, topic, semantic meaning, keywords, placement, device environment or moment in which the advertisement appears. A travel advertisement may appear alongside an article about destination planning without requiring knowledge of the reader’s previous browsing.

Modern contextual systems use taxonomies, natural-language processing, computer vision and brand-safety classification. They may analyse text, video frames, audio, page metadata and signals such as language or location at a coarse level. Contextual targeting is not necessarily completely data-free: a system may still process page-level information or use consented geographic and device signals. Its defining feature is that relevance is derived primarily from the environment rather than a persistent individual profile.

Contextual targeting offers strong privacy advantages and can support brand relevance. Its weaknesses include semantic error, limited understanding of a user’s stage in the purchase journey and possible adjacency to controversial content. Contextual suitability must therefore be distinguished from mere keyword matching.

3.2 Behavioural targeting

Behavioural targeting uses observed actions over time, such as visits, searches, clicks, app events or purchases, to construct an audience or predict an outcome. Retargeting is a common form: users who viewed a product may receive an advertisement intended to encourage completion of the purchase.

Behavioural targeting can be effective because it uses signals closer to a user’s demonstrated interest. However, it is vulnerable to over-frequency, stale intent, shared devices, inaccurate inference and privacy objections. A product view may have resulted from research, accidental navigation or a purchase already completed offline. Behavioural data should therefore include recency, event quality and exclusion logic.

3.3 Declared, demographic and geographic targeting

Declared data is supplied by a user, such as a preference centre response or account attribute. It may be more transparent than inferred data, but users can provide incomplete or inaccurate information. Demographic targeting uses characteristics such as age band or household composition; geographic targeting may use country, region, postcode, coordinates or inferred location. Fine-grained location data has heightened privacy and security implications and should be minimised.

3.4 Predictive targeting

Predictive targeting applies statistical or machine-learning models to estimate a probability or rank. A model might predict the likelihood of subscription within a specified period. A generic probability expression is:

Here, Y = 1 represents the target event, such as a purchase; X represents available features; and p is the estimated probability. The expression does not prove causation. A high predicted probability may reflect correlation, previous targeting or selection bias. Models must be evaluated on data separate from the training data and monitored for drift and disparate impact.

4. Identity: From Cookies to Graphs

An identifier is a technical handle used to recognise an entity. It may be a first-party account ID, a cookie, a mobile advertising ID, a connected-TV household ID, an email-derived token or a probabilistic device signal. An identifier is not equivalent to a legal identity or a human being.

4.1 Deterministic and probabilistic identity

Deterministic matching links records using a known common key, such as a consented login ID or a securely transformed email address. It can be highly accurate when the key is valid, unique and current. It remains vulnerable to account sharing, data-entry errors, multiple accounts and unauthorised use.

Probabilistic matching estimates that records belong to the same entity based on shared characteristics such as device patterns, timing, location at a broad level or browsing behaviour. It can expand coverage but introduces uncertainty and the possibility of false matches. Probabilistic identity should not be treated as certain identity, especially for sensitive decisions.

An identity graph represents relationships among identifiers, devices, accounts, households and events. Graph edges may be deterministic or probabilistic and should carry confidence, source, timestamp and consent status. A responsible graph can answer “which consented identifiers may represent the same eligible account?” rather than claiming to know every device used by a person.

4.2 Match rate and reach

A basic match rate can be expressed as:

The numerator is the number of submitted records successfully matched under defined rules, and the denominator is the number of eligible records submitted. The measure is meaningful only when eligibility, deduplication, time period and matching method are specified. A high match rate does not demonstrate identity accuracy, incremental reach or legal permission.

Suppose 80,000 eligible records are submitted and 52,000 are matched. The match rate is 65%. If 10,000 of the matched records are duplicates across devices, the deduplicated addressable set is smaller than 52,000. Reach, match rate and unique people should never be used interchangeably.

5. Platforms for Audience Management

5.1 Data-management platforms

A data-management platform (DMP) traditionally organises cookie, device and segment data for advertising activation, often with an emphasis on anonymous or pseudonymous audiences. DMPs remain useful in certain environments, but their role has been affected by browser restrictions and the decline of third-party identifiers.

5.2 Customer data platforms

A CDP generally ingests data from an organisation’s own systems, resolves customer records, maintains profiles and makes audiences available to approved channels. A CDP may connect commerce, CRM, service, website and app events.

A CDP is not simply a database or a consent-management tool. Its value depends on identity rules, data quality, permissions, event schemas, activation connectors and governance. A robust implementation records the source and timestamp of events, separates observed attributes from modelled attributes, and prevents activation where consent or purpose conditions are absent.

A typical audience workflow is:

1. Collect event data with clear notice and appropriate choice mechanisms.
2. Validate, standardise and classify fields.
3. Resolve records using approved deterministic or probabilistic rules.
4. Apply consent, purpose and suppression policies.
5. Build an audience using explicit inclusion and exclusion criteria.
6. Activate through approved media or customer channels.
7. Measure outcomes while respecting attribution and privacy constraints.
8. Retain, refresh or delete records according to policy.

5.3 Data clean rooms

A data clean room is a controlled environment in which parties compare or analyse data without freely exchanging raw person-level records. A retailer and an advertiser may seek to understand overlap, measure campaign outcomes or plan audiences inside the room.

Common controls include pseudonymisation, access restrictions, query thresholds, aggregation, output review, encryption and contractual limitations. Clean rooms reduce exposure but do not eliminate risk. Re-identification may remain possible when datasets are small or combined with external information. A clean room is therefore a governance and technical arrangement, not a guarantee of anonymity.

6. Cohorts and Post-Cookie Strategies

A cohort groups users according to shared characteristics or behaviour without exposing an individual-level identifier to the advertiser. Cohorts may be based on recent content interest, broad purchase intent, subscription status or an on-device model.

Cohort approaches can reduce individual tracking, but privacy depends on cohort size, construction, stability, sensitivity and transparency. A very small cohort may reveal sensitive information. A cohort built from extensive hidden tracking may provide little substantive privacy improvement. Effective controls include minimum group thresholds, suppression of sensitive categories, expiration, user controls and restrictions on combining cohorts.

A post-cookie strategy should be diversified rather than replaced by a single “universal ID.” A practical portfolio may include:

• authenticated first-party relationships where users understand the value exchange;
• contextual and semantic targeting;
• consented publisher and retail-media audiences;
• broad geographic or content signals;
• cohort and on-device approaches;
• clean-room measurement and collaboration;
• aggregated conversion modelling and experimentation;
• strong frequency management and suppression lists.

The appropriate mix depends on the campaign objective. Prospecting may rely more on context, publisher partnerships and broad modelling, while retention may use consented first-party purchase and service data.

7. Consent, Governance and Responsible Activation

Privacy governance should be designed before activation, not added after a campaign has been built. Key principles include purpose limitation, data minimisation, accuracy, storage limitation, security, accountability and respect for individual rights. Applicable rules vary by jurisdiction, but organisations commonly need to address consent, legitimate interests where relevant, access, deletion, objection, sensitive data restrictions and cross-border transfers.

Consent should be informed, specific, freely given and capable of withdrawal where the law requires consent. A consent signal is not meaningful if the interface manipulates users into acceptance or if partners cannot honour the resulting choice. Consent records should include the time, purpose, version of notice and participating vendors where necessary.

Important governance controls include:

• a data inventory and source register;
• purpose and lawful-basis mapping;
• vendor due diligence;
• retention and deletion schedules;
• access control and encryption;
• sensitive-category restrictions;
• audience approval and suppression rules;
• incident response procedures;
• bias and performance testing;
• audit logs for activation and data sharing.

Targeting can produce discriminatory outcomes even when protected characteristics are not directly used. Proxy variables such as location, language, consumption patterns or inferred socioeconomic status may reproduce exclusion. Teams should test delivery, price, opportunity and frequency across relevant groups, while recognising that measurement itself must be privacy-preserving and legally appropriate.

8. Measurement and Strategic Evaluation

Audience strategies should be evaluated on more than click-through rate. Relevant dimensions include incremental reach, conversion lift, cost per incremental outcome, frequency, quality of inventory, customer value, privacy risk and operational complexity.

A simple incremental-lift measure is:

Here, p_T is the outcome rate in the treatment group and p_C is the outcome rate in a comparable control group. The measure assumes that treatment and control are sufficiently comparable and that exposure is assigned or adjusted in a way that supports causal interpretation. If p_T = 0.030 and p_C = 0.020, lift is 50%. This does not mean that every exposed user converted because of the advertisement; it means the treatment rate was 50% higher than the control rate under the study design.

Holdout experiments, geo-experiments, conversion lift studies and media-mix modelling can complement platform-reported attribution. Last-touch attribution is especially weak when audiences are exposed through multiple channels and when identity loss prevents complete observation. Measurement design should specify the estimand, treatment, control, observation window, exclusions and uncertainty before results are interpreted.

9. Illustrative Case: A Consent-First Retail Audience Strategy

Background

A fictional national home-furnishing retailer relied on third-party retargeting and purchased lifestyle segments. Browser restrictions reduced addressable reach, while customers expressed concern about repeated product advertisements and unclear data practices.

Problem

The retailer needed to increase online sales and repeat purchases without building a hidden cross-site profile. Its customer data was divided among commerce, loyalty, mobile-app and customer-service systems. The marketing team also lacked reliable suppression of recent purchasers.

Analysis

An audit found that loyalty and transaction data were high-value first-party sources, but consent purposes differed across channels. Product-view events were abundant but noisy. A vendor’s “home renovator” segment had attractive scale but weak provenance and could not demonstrate stable incremental performance.

Approach

The retailer implemented the following plan:

1. It created a consent and purpose register for loyalty, app, website and email events.
2. A CDP standardised customer and transaction events and used a stable account key where permitted.
3. Recent purchasers were suppressed from acquisition campaigns and moved into post-purchase journeys.
4. Contextual campaigns were placed beside renovation, design and moving-related content.
5. A publisher partnership supplied consented broad-interest audiences without transferring raw customer records.
6. A clean-room analysis measured overlap and aggregate sales outcomes.
7. A randomised holdout group tested incremental lift.
8. Frequency caps and short audience-expiration periods reduced repetitive advertising.

Outcome

The retailer achieved lower observable retargeting reach but improved governance, reduced unnecessary impressions and obtained a clearer estimate of incremental sales. The clean-room and holdout results showed that some broad contextual placements performed as well as the previous third-party segment after frequency and creative quality were improved. The case does not suggest that contextual advertising always dominates behavioural targeting; rather, it demonstrates that a smaller, better-governed signal portfolio can produce more defensible decisions.

Learning Points

First, addressability is not the same as effectiveness. Second, first-party data requires purpose and consent management. Third, identity resolution should support a defined business question rather than attempt to track everything. Finally, experimentation is essential because platform-reported performance can overstate the value of an audience.

10. Best-Practice Framework for Post-Cookie Planning

A practical planning sequence is:

Define the objective. Distinguish acquisition, retention, frequency control, measurement or customer experience.

Classify the signal. Mark each field as observed, declared, inferred or predicted.

Assess provenance. Record source, permission, freshness, accuracy and contractual restrictions.

Select the least intrusive effective method. Use context or aggregation where individual-level data is unnecessary.

Design identity deliberately. Prefer stable, consented keys; document probabilistic confidence and avoid unjustified claims about people.

Build governance into activation. Apply purpose, consent, suppression, retention and security rules at the point of use.

Test incrementality. Use control groups or other credible designs rather than relying only on attributed conversions.

Monitor equity and failure. Check overexposure, exclusion, model drift, sensitive inference and vendor compliance.

Refresh the portfolio. Post-cookie strategy is a continuing operating model, not a one-time technology purchase.

Contemporary Developments

Several developments are reshaping the field. Retail media networks are converting transaction and loyalty data into advertising products, creating both valuable measurement opportunities and risks of market concentration. Connected television and digital audio are developing household and content-based approaches, but measurement remains fragmented. On-device processing and privacy-enhancing technologies seek to reduce the transfer of raw data. Synthetic data and federated analytics may support development and measurement, although synthetic outputs can preserve or amplify biases in the source data.

Generative AI can assist with taxonomy creation, semantic classification, privacy documentation and anomaly detection. It should not be allowed to make unreviewed eligibility decisions about sensitive audiences. Human oversight, training-data review, explainability and security remain necessary. The strategic direction is therefore not “data versus no data,” but accountable use of the minimum data required for a legitimate objective.

Chapter Summary

Audience data is composed of observations, attributes and inferences associated with people, devices, accounts, households or contexts. First-party data offers direct provenance and relationship value; second-party data enables controlled partnerships; and third-party data may provide scale but requires careful verification. Contextual targeting derives relevance from content and environment, whereas behavioural targeting uses observed actions over time. Predictive targeting estimates outcomes but does not establish causation.

Identity systems range from deterministic account links to probabilistic graphs. Match rate measures successful matching under defined rules, but it does not prove accuracy or legal permission. CDPs organise consented first-party data and activation, while clean rooms support controlled collaboration and measurement without unrestricted raw-data exchange. Cohorts can reduce individual-level exposure, but their privacy depends on construction, size, sensitivity and controls.

A post-cookie strategy should combine consented first-party relationships, contextual signals, publisher and retail partnerships, cohorts, aggregated measurement and experimentation. Effective practice requires purpose limitation, data minimisation, security, fairness testing, vendor governance and credible incrementality analysis. The key professional capability is not merely finding audiences; it is designing audience systems that are effective, explainable, proportionate and trustworthy.

Key Terms

Audience data: Information, events or inferences used to describe or reach an audience.

First-party data: Data collected directly by an organisation through its own interactions.

Second-party data: Another organisation’s first-party data shared through a direct partnership.

Third-party data: Data obtained from an external provider that did not collect it through the advertiser’s direct relationship.

Contextual targeting: Selecting advertising based primarily on the content or environment of an impression.

Behavioural targeting: Selecting advertising using observed actions over time.

Predictive targeting: Using a model to estimate the likelihood of a future event.

Identifier: A technical handle used to recognise an account, device, browser or other entity.

Deterministic matching: Linking records through a known common key.

Probabilistic matching: Estimating a match from shared signals and statistical confidence.

Identity graph: A structured representation of relationships among identifiers and entities.

Match rate: The percentage of eligible submitted records that satisfy a defined matching rule.

Customer data platform (CDP): A system that integrates customer data, resolves profiles and supports governed activation.

Data-management platform (DMP): A platform historically used to organise and activate largely anonymous or pseudonymous audience data.

Data clean room: A controlled environment for analysing or matching data while limiting raw-data exposure.

Cohort: A group of users classified by shared characteristics without necessarily exposing an individual identifier.

Consent: A voluntary, informed and specific permission for defined processing where required.

Incremental lift: The difference in outcome associated with treatment relative to a comparable control, often expressed proportionally.

Data minimisation: Limiting collection and use to what is necessary for a defined purpose.

Purpose limitation: Restricting data use to communicated and authorised purposes.

Review Questions

Short Answer Questions

1. What is the principal difference between first-party and third-party data?
2. How does contextual targeting differ from behavioural targeting?
3. Distinguish deterministic from probabilistic identity matching.
4. What is a data clean room?
5. Why does a high match rate not necessarily indicate accurate identity resolution?

Long Answer Questions

1. Evaluate the strategic advantages and limitations of first-, second- and third-party data for a national advertising campaign.
2. Explain how a CDP, identity graph and consent-management process may work together in audience activation.
3. Discuss the privacy and effectiveness trade-offs between behavioural, contextual and cohort-based targeting.
4. Explain why incrementality testing is important when evaluating audience performance.
5. Develop a governance framework for a retailer using loyalty data in programmatic advertising.

Analytical / Application Questions

1. An advertiser submits 120,000 eligible records and receives 78,000 valid matches. Calculate the match rate and explain why the result should not be interpreted as the number of unique people reached.
2. Design a post-cookie audience strategy for a subscription publisher whose users include both authenticated subscribers and anonymous readers. Justify the role of first-party, contextual, cohort and clean-room methods.
3. A campaign produces a 3.0% conversion rate in the treatment group and 2.0% in the control group. Calculate incremental lift and identify two methodological conditions that must be considered before claiming causal effectiveness.

Multiple Choice Questions with Answers

Question 1

Which statement best describes first-party data?

A. Data collected directly through an organisation’s own customer interactions

B. Data purchased from an unrelated broker without a direct relationship

C. Data created only from anonymous contextual keywords

D. Data that is always exempt from privacy regulation

Correct Answer: A. Data collected directly through an organisation’s own customer interactions

Question 2

Which targeting method primarily uses the content or environment surrounding an impression?

A. Behavioural retargeting

B. Contextual targeting

C. Deterministic identity matching

D. Frequency suppression

Correct Answer: B. Contextual targeting

Question 3

What is a defining characteristic of deterministic matching?

A. It estimates identity from general browsing patterns

B. It links records using a known common key

C. It removes the need for consent

D. It always identifies a physical person

Correct Answer: B. It links records using a known common key

Question 4

A clean room is primarily designed to:

A. Publish raw customer records to all participating advertisers

B. Permit controlled analysis while limiting raw-data exposure

C. Guarantee that all data is anonymous in every circumstance

D. Replace all forms of audience measurement

Correct Answer: B. Permit controlled analysis while limiting raw-data exposure

Question 5

An advertiser submits 80,000 eligible records and 52,000 are matched. What is the match rate?

A. 52%

B. 60%

C. 65%

D. 80%

Correct Answer: C. 65%

Question 6

Which statement about a high match rate is most accurate?

A. It proves that every matched record represents a unique person

B. It proves that the data was collected with valid consent

C. It demonstrates successful matching under the defined rules but not necessarily accuracy or permission

D. It guarantees incremental advertising performance

Correct Answer: C. It demonstrates successful matching under the defined rules but not necessarily accuracy or permission

Question 7

A treatment group converts at 3.0% and a control group at 2.0%. What is the incremental lift?

A. 1%

B. 20%

C. 33.3%

D. 50%

Correct Answer: D. 50%

Question 8

Which is the strongest reason to use contextual targeting in a post-cookie strategy?

A. It necessarily identifies the user across every device

B. It can derive relevance from content without requiring a persistent individual profile

C. It eliminates all brand-safety risks

D. It always outperforms behavioural targeting

Correct Answer: B. It can derive relevance from content without requiring a persistent individual profile

Question 9

Which statement best describes a cohort?

A. A group classified by shared characteristics without necessarily exposing an individual identifier

B. A legally verified identity document

C. A guaranteed list of unique households

D. A raw database of all website visitors

Correct Answer: A. A group classified by shared characteristics without necessarily exposing an individual identifier

Question 10

Why is incrementality testing valuable in audience evaluation?

A. It measures only the number of impressions delivered

B. It helps estimate outcomes caused by advertising rather than merely attributed to it

C. It guarantees that a model has no bias

D. It removes the need for a control group

Correct Answer: B. It helps estimate outcomes caused by advertising rather than merely attributed to it