Advertising Identifiers in 2026: A Practical Guide to What Still Works

For six years the industry planned around a single event. Chrome would remove third-party cookies, something would replace them, and everyone would migrate together.

Neither half happened. Google abandoned cookie deprecation and then retired the remaining Privacy Sandbox APIs in October 2025, including Topics, Protected Audience, and Attribution Reporting, with removal from Chrome running through mid-2026. Third-party cookies remain in Chrome with no removal date. Safari, Firefox, and Brave continue to block them by default.

The outcome is not a transition but a permanent state. No single identifier works everywhere, and planning as though one will is the most expensive mistake available in this area. This guide covers what each identifier type actually does, where it works, and where it does not.

THIRD-PARTY COOKIES

Still functioning in Chrome, still blocked in Safari, Firefox, and Brave.

They remain useful for reach in Chrome-dominant environments and useless everywhere else, which means any strategy resting on them covers a majority of traffic in some markets and a minority in others. They are also the identifier most exposed to future policy change, since nothing prevents Google revisiting the decision.

Treat them as a declining asset that has not declined on schedule.

MOBILE ADVERTISING IDENTIFIERS

The IDFA on Apple devices and the Google Advertising ID on Android. Device-level, resettable, and subject to user permission, which on Apple devices means an app must request consent before accessing one at all.

MAIDs map cleanly to mobile app and mobile web inventory and are the most common carrier of audience segments in programmatic buying. Their limitation is scope. They describe a device, not a household or a person, and they do not exist in connected TV or desktop environments.

They also churn. Devices are reset, replaced, and reassigned, which is why segments built on long lookback windows contain identifiers that no longer appear in live traffic.

HASHED EMAIL AND THE UNIVERSAL IDs BUILT ON IT

This is where most of the last five years of industry investment has gone.

Universal or alternative IDs take an email address, usually captured at login, hash it, and use it as a stable identifier that works across sites and devices. The main examples are Unified ID 2.0, backed by The Trade Desk, RampID from LiveRamp, and ID5, alongside a longer list including Panorama and publisher-provided IDs.

They divide roughly into two kinds. Deterministic IDs rest on an observed login, which makes them precise where authentication exists and absent where it does not. Dynamic or probabilistic IDs infer a link from available signals and become more stable as deterministic signals reinforce them, trading precision for coverage.

Adoption is real. Survey work published by ID5, itself an identity vendor, reported that 91% of respondents were using or planning to test alternative solutions, with alternative IDs used by 67% for otherwise non-addressable traffic. The same research showed private marketplaces, clean rooms, and publisher user IDs each used by around half of respondents, which describes an industry stacking several approaches rather than selecting one.

The constraint is authentication. A hashed email identifier exists only where someone logged in, so coverage tracks the share of a publisher's audience that signs in, which varies enormously by category and market.

THE EUROPEAN PICTURE IS DIFFERENT

Most coverage of this topic is written from a United States perspective, where authenticated environments are more common and the regulatory position is looser.

Europe has its own identifier ecosystem, including European Unified ID, NetID, FirstID, and Utiq, the last backed by several major European telecommunications operators. These exist partly because a US-designed identifier does not automatically satisfy European requirements.

The practical consequence is that a European buyer should establish the lawful basis and the data transfer arrangements for any identifier before relying on it, rather than assuming a US-originated solution carries a European answer. Worth asking specifically how a consent withdrawal at publisher level travels through to the identity graph, since that is the point where a chain of intermediaries is most likely to lose the signal.

IP ADDRESSES AND HOUSEHOLD SIGNALS

The IP address became the default match key in connected TV because no device identifier exists in that impression.

That default is now under justified scrutiny. Research published by CIMM and Go Addressable in late 2025 found IP addresses matched postal records around thirteen percent of the time and email around sixteen percent, and concluded IP should not serve as the primary method for identifying a household.

The useful distinction is between using IP as an identity anchor, which is what that research tested and found wanting, and using it as a supplementary household signal to extend reach into environments without a device identifier. The first is unsupportable. The second is reasonable, provided the claim being made is bounded accordingly.

CTV DEVICE IDENTIFIERS

Connected TV devices carry their own identifiers, including IFA-type identifiers on various platforms, though availability and consistency vary by manufacturer and operating system.

Where present, they are more reliable than an IP-based inference. Where absent, the household connection is the fallback, with the limitations above.

WHAT THIS MEANS IN PRACTICE

Three conclusions follow from the landscape rather than from any vendor's preference.

The first is that reach requires more than one identifier type. A file pairing a device identifier with a household signal activates across more surfaces than one carrying either alone, and the practical question for any data source is how many identifier types travel with it.

The second is that coverage claims should be read by environment and by market. An identifier strong in authenticated US publishing may be thin in European mobile app inventory, and a single global figure conceals that entirely.

The third is that the identity layer's weaknesses propagate. If measurement rests on a single identifier, every limitation in that identifier flows into the attribution result, and the campaign is judged on a number that inherits all of them.

‍