State of Data 2023

Data Clean Rooms & the Democratization of

Data in the Privacy-Centric Ecosystem

SPONSORED BY:

January 24, 2023

1
Table of Contents

Foreword 3

Five Things You Need to Know 4

Executive Summary 5

Privacy-Preserving Technology: Adoption and Usage 7

Data Clean Rooms: Hurdles and Opportunities for Growth 17

Privacy-Preserving Technology: Considerations and Best Practices 27

Data Clean Rooms: Understanding the Benefits and Use Cases 33
Appendix 36
Data Clean Room Privacy Controls and Methods to Protect Consumer Data
Evaluation Phase: Additional Factors for Consideration
Methodology
Respondent Profile
About IAB
About the IAB Measurement, Addressability, and Data Center
About Ipsos
About Our Sponsors
A Perspective From TransUnion

2
Foreword

As the digital ad industry continues to suffer from signal loss and the A survey of 200 data decision-makers at brands, agencies and
evolution of state-level privacy legislation, the demand for privacy- publishers, and 20 in-depth interviews reveals that the industry is leveraging
preserving technology that enables critical, data-driven advertising has DCRs primarily for data privacy protection, especially when shared with
never been greater. external partners.

As part of our sixth annual State of Data initiative, IAB has Although some companies leverage the capabilities that DCRs offer beyond
commissioned Ipsos to examine how data clean rooms (DCRs) and other privacy, most are not using the advanced measurement capabilities​. In fact,
privacy-preserving technology, including customer data platforms (CDPs), most data leaders are only scratching the surface with their current use
consent management platforms (CMPs), data management platforms of DCRs and are missing an opportunity to leverage the technology’s
(DMPs), and identity solutions are being managed and activated. IAB most powerful advanced measurement capabilities.
sought to identify the challenges that ad buyers and sellers are facing
when leveraging these technologies. This report, the IAB State of Data 2023: Data Clean Rooms and the
Democratization of Data in the Privacy-Centric Ecosystem provides ad
DCRs* specifically have risen as an essential technology by enabling buyers and sellers, as well as providers of privacy-preserving technology,
privacy-compliant data matching and sophisticated cookie-agnostic actionable insights regarding onboarding and adoption, use cases,
measurement capabilities across the buy- and sell-sides, and therefore challenges, and opportunities moving forward with DCRs and other privacy-
mitigating concerns that data decision-makers have had with other preserving technology.
privacy-preserving technology.
The insights from this report will help determine the standards required to
The introduction of five new state-level, data privacy regulations in 2023 evolve the space by determining the data inputs and outputs, as well as the
combined with the continued protection of consumer data by leading logistical and technical requirements that will ultimately inform the IAB Tech
technology platforms only further raises the value of DCRs. Indeed, Lab 2023 DCR initiative.
Gartner predicts that by 2023 80% of advertisers spending more than $1
billion annually on media will use DCRs. This report reveals how we came to these conclusions and provides an action
plan on how to prepare for and leverage DCRs.

*DCRs: Secure privacy environments that allow multiple parties to collaborate using proprietary data in
compliance with privacy regulations, while allowing each participant to maintain privacy and control of its data.

Source: Gartner per Adweek, 3/16/22 3

Five Things You Need to Know

1. In the world of privacy-preserving technology, data clean rooms (DCRs) have become an essential
collaboration tool for audience insights, measurement, and data activation in a privacy-centric
ecosystem.

2. While users are primarily leveraging DCRs to mitigate privacy risks and to activate audiences, they’re
not tapping the full potential of the technology’s advanced measurement capabilities.

3. Although DCRs offer innovative, privacy-preserving use cases, they are not a turnkey technology—they
require significant investments in talent, financial resources, and setup, including data infrastructure
and connectivity as well as onboarding.

4. DCR requires investments that create a high barrier to entry which puts smaller industry players
including agencies, brands, and publishers at a disadvantage.

5. It is incumbent upon all data providers, including walled gardens, to make their data interoperable so
advertisers can measure full campaign effectiveness and ROI.

4
Executive Summary

The increased use of DCRs suggests clear

marketplace value in an evolving privacy- DCR adoption is not turnkey. Onboarding and
1 centric portfolio. But the industry has not
2 activation require significant investment in time,
money, and human capital.
tapped into the technology’s full potential.

• Two-thirds (64%) of companies leveraging privacy- • Nearly half of DCR users (49%) have six or more
preserving technology are using DCRs. This increases employees dedicated to the technology—nearly one-
to 85% when including those that are considering the third (30%) have a minimum of 11 people.
technology. Most companies use the technology for vital
tasks including privacy protection and controls, match • Respondents cited time-frames of months to up to two
rates, and interoperability. years to get up and running with the technology.

• Nearly half of DCR users are leveraging the technology • Investment requires six-figure annual budgets:
for data privacy actions. However, each of the following • Nearly two-thirds (62%) of users spent a minimum
advanced measurement functions are utilized by less of $200K on the technology in 2022, with a
than one-third of users: attribution, ROI/ROAS quarter (23%) spending upwards of $500K.
measurement, media or marketing mix modeling,
propensity modeling, and predictive analysis. • A 29% increase is expected in 2023.

• This creates an unfair market disadvantage for small

agencies, brands, and publishers that don’t have the
resources to meet these investments.

5
Executive Summary

Although some companies are finding success Multiple factors are crucial for consideration
3 using DCRs in innovative ways, most are citing 4 when evaluating, implementing, and maintaining
significant challenges. DCRs and other privacy-preserving technology.

• Qualitative results showed that users are executing more • Data maturity, tracking capabilities, resource burden,
complex tasks including lookalike and propensity model interconnectivity, and complexity need to be considered
creation, shopper transaction pattern development, and when identifying technology use cases and developing
closed-loop attribution. a sequential data strategy.

• However, more than half of DCR users (52%) cite • Companies must be agile and prepared for ongoing
leveraging results/proving ROI as a challenge. About uncertainty caused by multiple state-level privacy
one-third of DCR users are also facing data legislation and continuous loss of data signals driven
interoperability / customization (39%), internal resource by actions from big tech companies and platforms.
(38%), and privacy (32%) challenges when using DCRs.
• Companies should support, contribute to, and consider
adopting industry privacy standards and privacy
controls for risk mitigation, including re-identification
and data leakage.

6
Privacy-Preserving
Technology:
Adoption and Usage
The privacy-preserving technology marketplace serves multiple functions

By using a combination of technologies, organizations can collect, analyze, measure, and activate data, as well as securely share
data and insights to relevant internal and external parties.

Customer Data • Unifies customer data from disparate sources into one platform to provide a single customer view
Platforms: CDPs • Combines internal and external customer demographic, behavioral, and historical data for real-time purchase analysis and prediction

Consent Management • Protects users’ data privacy by allowing website owners to have total control over cookies, trackers, and user consent in one , fully automated solution
Platforms: CMPs • Enables website owners to be compliant with global data privacy laws

Data Clean Rooms: • Secure privacy environments that allow multiple parties to collaborate using proprietary data in compliance with privacy regulations, while allowing each
DCRs participant to maintain privacy and control of its data

Data Management • Collects and stores large amounts of structured and unstructured data from online and offline sources, including first -party and third-party data
Platforms: DMPs • Organizes and segments data into different customer types, such as location, income, and browsing behavior that can be used f or marketing messaging

Identity Solutions • Data management processes that link customer records across multiple devices and sites to a unique identity —providing companies with a cohesive approach
to capturing, measuring, and drawing insights on individual users

Sources: TechTarget, Clickguard, TechTarget; The Clean Room Consortium

8
Most privacy-preserving technologies have seen widespread adoption

Along with DMPs and CDPs (see Select Technology Used by U.S. Marketers
right), nine in ten marketers are
testing or considering at least one Data management platforms (DMPs) 78%
ID solution (data not shown).
Advertising platforms 74%
The changes in the privacy
landscape have seen companies Customer data platforms (CDPs) 72%
respond by investing in privacy-
preserving technology that allow
Account-based marketing platforms 69%
them to mitigate risk while being
able to collaborate with partners.
Artificial intelligence (AI) 67%

Content management platforms 57%

Digital asset management 48%

Marketing analytics/measurement tools 42%

Sources: Loyalty Research Center via eMarketer, April 2022; MMA & BCG, April 2022
9
Among privacy-preserving technology users, two-thirds use data clean rooms (DCRs)

DCR Use by Company Type

Currently use
57%
64% 67% 67%
Considering

Previously used, but

not currently using
29%
21% 19% 16%
Not Considering
8%
10% 11% 10%
5% 4% 9%
3%
Total Agencies Brands Publishers

What is your experience with each of the following? – Data clean rooms
Base: Total (n=203) – Agencies (n=70), Brands (n=70), Publishers (n=63)
10
DCR adoption has accelerated in the last two years

While the majority (61%) of Length of Technology Use

DCR adoption has occurred in (Sorted high to low by 2 years or less)
the last 2 years, DMP, CDP, 2 years or less 3+ years
CMP, and identity-solution
69%
adoption mostly occurred over
three years ago. 61% 60%

52% 52%

42% 42%
35% 35%
28%

Data clean rooms Identity solutions Consent Customer data Data management
(DCRs) management platforms (CDPs) platforms (DMPs)
platforms (CMPs)

How long have you/your clients been using the following?

Base: DCR users (n=129), Identity solution users (n=88), CMP users (n=71), CDP users (n=161), DMP users (n=151)
11
Despite its relative nascency, satisfaction with DCRs is comparable to the more
established technologies

Additionally, 60%+ of privacy- Avg. % Very/Somewhat Satisfied With Technology

preserving technology users are
satisfied with the technology across
the board—suggesting a recognition 69%
of the overall marketplace’s value. 67%
66%
64%
60%

Identity solutions Data clean rooms Consent Data management Customer data
(DCRs) management platforms (DMPs) platforms (CDPs)
platforms (CMPs)

How satisfied are you with your/your client’s technology’s ability to provide the following? - Top 2 Box Summary
Base: Identity solution users (n=88), DCR users (n=129), CMP users (n=71), DMP users (n=151), CDP users (n=161)
12
DCRs are becoming essential for privacy-compliant data matching, activation, and
measurement

By 2023, 80% of advertisers spending more than $1 billion annually on

media will use DCRs.*

Current users expect to increase their DCR spend by 29% this year (2023).

Source: Gartner per Adweek, 3/16/22

13
Users are selecting DCRs for privacy protection, data controls, and interoperability

The vast majority (79-86%) of Importance of Key Criteria When Selecting a Third-Party DCR
DCR users seek the
technology for vital and
complex functionality, including Confidentiality and security of data / IP through
various privacy protocols 86%
privacy protection and
controls, match rates, and
interoperability. Privacy by design: privacy throughout the whole
83%
engineering process

Availability of enrichment partners: assuring

data matching with third-party partners 81%

Distributed data interoperability: controling

partner data access and use 79%

Flexible identity for matching with different

identity solutions 79%

Inability to re-identify or reverse engineer 60%

When choosing third party data clean rooms, how important are the following to you / your client? - Top 2 Box Summary (Very/Somewhat Important)
Base: DCR users (n=129)
14
Currently, DCR users are primarily leveraging the technology to address privacy
concerns and activate audiences

DCR Use Cases

Data anonymization 47%

Data privacy & compliance 47%

Data normalizing and cleaning 41%

Data transformation and enrichment 40%

Attribution: offline, online, MTA 26%

ROI / ROAS measurement 23%

Media or market mix modeling 17%

Propensity modeling & predictive
17%
analysis

Please select all of the reasons you/your client are using the following technology. – Data clean rooms
Base: DCR users (n=129)
15
Missed opportunity: Less than one-third of DCR users are tapping into advanced
measurement

DCR users are likely not yet leveraging attribution,

ROI/ROAS measurement, media or marketing mix
DCR Use Cases
modeling, and propensity modeling use cases as
early-stage adoption has focused on privacy and Data anonymization 47%
audience activation. This represents an opportunity
for DCR users to capitalize on the technology’s Data privacy & compliance 47%
most powerful capabilities critical for operating in
the evolving data landscape. Data normalizing and cleaning 41%

Data transformation and enrichment 40%

Attribution: offline, online, MTA 26%

ROI / ROAS measurement 23%

Media or market mix modeling 17%

Propensity modeling & predictive
17%
analysis

Please select all of the reasons you/your client are using the following technology. – Data clean rooms
Base: DCR users (n=129)
16
Data Clean Rooms:
Hurdles and
Opportunities for Growth
DCRs offer opportunities for innovative, privacy-preserving use cases

Select DCR Innovative Use Cases

❑ Privacy-compliant audience and
transactional data activation

❑ Advanced attribution and cross-

channel measurement

❑ Predictive modeling and market

mix modeling
❑ Enrichment of transactional data
with behavioral signals
❑ Audience insights and propensity
models

18
However, DCRs require significant investment in human talent

Half of DCR users (49%) have six or more employees

at their companies who are users, builders, facilitators, # of Employees Using / Building /
or purchasers of DCRs, with nearly one-third (30%) Facilitating / Purchasing DCRs
leveraging a minimum of 11 people.
31% 30%
It is crucial that DCR talent have privacy expertise,
including encryption technology, data security, and other
privacy-enhancing technologies such as differential
privacy*, k-anonymity*, etc. 19%
15%

3%

None 1-2 3-5 6-10 11+

*For definition see page 37 of the Appendix.

How many full-time employees are employed at your company who are users / purchasers / builders / facilitators of the following? – Data clean rooms
Base: DCR users (n=129) 19
DCR setup is lengthy and complex

Complex DCR Setup Process

❑ Review privacy and governance
settings internally and with external
partners
❑ Evaluation of data use cases and
ownership rights
❑ Setup data onboarding procedures
❑ Establish connections with multiple
external and internal partners
❑ Configure and maintain dataset
filtering and queries

20
DCR costs create a high barrier to entry—a challenge for smaller industry players

Nearly two-thirds (62%) of DCR users spent 2022 DCR Spend

a minimum of $200K on the technology, with
a quarter (23%) spending $500K+.
39%
Those spending $100M+ annually in media
are 29% more likely to be DCR users than
those spending <$100M (data not shown).
25%

13%
10%

<$200K $200K-$499K $500K-$749K $750K+

How much did you / your client’s organization spend or invest on each of the following technology in 2022? – Data clean rooms
Please provide your best estimate for your / your client’s percent +/- for projected 2023 in the following. – Data clean rooms
Base: DCR users (n=129) 21
Additionally, using DCRs with other privacy-preserving technology can drive annual
costs above $2M

Companies recognize the importance Average 2022 Costs by Technology ($K)

of using DCRs in conjunction with
other privacy-preserving technology. $437K $433K $429K
For example, eight in ten DCR users $377K $376K
are using CDPs (84%) and DMPs
(81%), and half are using identity
solutions (55%) and CMPs (45%).
Thus, DCR users are likely
experiencing compounded costs.

Customer data Identity solutions Data management Consent Data clean rooms
platforms (CDPs) platforms (DMPs) management (DCRs)
platforms (CMPs)

What is your experience with each of the following?

How much did you / your client’s organization spend or invest on each of the following technology in 2022?
Base: DCR users (n=129), CDP users (n=161), Identity solution users (n=88), DMP users (n=151), CMP users (n=71)
22
And, sub-par match rates threaten the overall efficacy of DCRs

Ongoing signal loss and the evolution of

state-level privacy legislation will likely Average Match Rates by DCR Type
further challenge match rates—putting
additional pressure on the DCR 52%
marketplace to improve.
45%
41% 39%

DCR that we manage DCR owned and DCR managed by DCR owned and
and control managed by a walled neutral, third-party managed by another
garden organization (non-
walled garden)

On average, what data match rates are you / your client seeing for the following?
Base: Neutral, third-party DCR users (n=59), In-House managed DCR users (n=69), Walled garden DCR users (n=59), Users of DCRs managed by other organizations (n=61)
23
Sub-par match rates are driven by a multitude of factors

Sub-Par Match Rate Drivers

❑ Identity fragmentation

❑ Platform bifurcation

❑ Inconsistent data inputs

❑ Data obfuscation

24
Due to the complexities, a significant percentage of DCR users cite ongoing challenges

DCR Challenges

Leveraging results / proving ROI 52%

Data interoperability /
39%
customization

Internal resource challenges 38%

Privacy 32%

Data quality 21%

Economic and competitive

9%
pressures

What are or have been your / your client's challenges when using the following? – Data clean rooms
Base: DCR users & previous DCR users (n=149)
25
Recap: Five Things You Need to Know

1. DCRs have become an essential technology in the privacy-centric ecosystem.

2. DCR users have yet to tap the full potential of technology’s advanced measurement
capabilities.

3. DCRs are not turnkey technology, requiring significant investments in talent, cost, and setup,
including data infrastructure and connectivity as well as onboarding.

4. High DCR investments disadvantage smaller industry players.

5. All data providers, including walled gardens, need to make their data interoperable for
measurement and ROI.

26
Privacy-Preserving
Technology:
Considerations and
Best Practices
Privacy-Preserving Technology: Interconnectivity Map

28
Evaluation Phase: Key considerations

1. Cost and Time: It can take significant time, effort, and cost to 3. Data Accuracy and Scalability: Prior to implementation, it is
set up and maintain a DCR or other privacy-preserving essential to ensure that the data intended for use is accurate,
technology. Timing is dependent on (but not limited to) the reliable, and scalable. This helps mitigate the risks of potential
following factors: financial loss and performance gaps.
a. The number of data points
b. The number of data sources 4. Human Capital and Talent: Implementation and
c. How complex the data assets are maintenance requires a wide talent pool with subject-matter
d. The desired level of security expertise including data privacy, security, governance,
e. The infrastructure and resources needed to support it analytics, and marketing. Long-term success requires hiring
and retaining top talent in these areas with the skills and
2. Accessibility and Security: Data access and analysis capabilities to adapt and evolve over time.
requires strict protocols and procedures to ensure security
and privacy. Data cleanup can be time consuming—
especially if companies need to access the data frequently or See pages 38-39 of the appendix for lists of
have large volumes of data to analyze. Additionally, there can detailed factors for each of these four considerations.
be multiple levels of approval, as well as detailed
documentation required for implementation.

29
Implementation and Maintenance Phase(s): Best practices

1. Define clear scope and purpose: Establish and prioritize use 6. Review partner data privacy and security practices: Investigate
cases based on technology and business needs, financial impact, and understand platform partners’ data privacy and security
data maturity, and operational complexity. protocols.
2. Establish strict access controls: Determine and maintain access 7. Consider the level of customer support offered: Partners
technology controls to ensure only authorized personnel can should offer documentation, training resources, and responsive
access the data being processed. Physical access controls, login customer service.
credentials, and background checks may be included.
8. Clean and standardize your data: Make sure to clean and
3. Follow strict data handling procedures: Ensure that data is kept standardize your data before integrating it into any platform to
secure and confidential in the technology by establishing protocols ensure that it is accurate and consistent.
for encryption and secured data transfers.
9. Establish KPIs/success criteria: Determine measurable, desired
4. Regularly review and audit: Perform regular reviews and audits outcomes to evaluate the performance of the technology for your
to ensure that the technology is operating effectively and is use cases.
compliant with all laws and regulations.
10. Stay up to date on evolving privacy compliance requirements:
5. Consider data accuracy and maturity: Choose partners with Work with legal and compliance professionals internally and
track records that accurately and comprehensively resolve externally to understand the potential impact of the changes on
identities. your technology practices.

30
Continued Maintenance: Risks from evolving privacy legislation and platform changes

The data landscape is facing ongoing privacy challenges, from five new 2. Increased transparency and choice for consumers:
state-level laws coming into effect in 2023, to actions from platforms Companies will need to be more transparent about their data
resulting in industry signal loss, to pressure from consumer privacy- collection and practices while giving consumers more control over
preserving advocates forcing companies to evaluate their practices to their personal data. This includes the right to opt out of the
ensure they respect individuals’ rights to their personal data. collection and use of their data for advertising purposes. High opt-
out rates can potentially threaten the efficacy and effectiveness of
There are two main risks to the advertising industry that are companies' advertising and marketing efforts.
crucial regarding the privacy-preserving technology landscape:
Overall, companies need to be prepared for evolving changes to data
1. Restrictions on the collection and use of personal data: activation, collection, and measurement as the data and privacy
Privacy regulations such as the five new state-level laws in landscape continues to evolve. It is crucial to ensure that all data
California, Virginia, Colorado, Connecticut, and Utah, Apple’s App handling activities in DCRs and other privacy-preserving technologies
Tracking Transparency (ATT) initiatives, and the impending roll-out comply with relevant privacy regulations and adapt to data loss—
of Google’s Privacy Sandbox places limits on the types of data that otherwise companies risk significant fines or reputational damage. It is
companies can collect, as well as how they can use and share that imperative that companies collaborate with both internal and external
data. This will continue to change the way that companies target partners across functions and develop strategies for mitigating risk.
ads, as they can no longer rely on certain types of data to do so.

31
Continued Maintenance: Key industry standards for risk mitigation

Standards can be extremely beneficial for companies by ensuring the consistency and reliability of products, processes, and s ervices—resulting in improved quality and
reduced costs. They can also facilitate interoperability that allows for seamless integration of various systems and devices. Standards can aid a company in complying
with regulations and industry standards, as well as enhancing its reputation and credibility. IAB and IAB Tech Lab advise the industry to prepare for new U.S. state-level
privacy signaling changes, and encourage companies to support, contribute to, and consider adopting the following standards. Moreover, if your company hasn’t
started solving the privacy challenges coming this year, it’s time to start ringing the alarm bells.

1. Global Privacy Platform (GPP) The Global Privacy Platform helps the 3. Taxonomies: As part of ongoing efforts to put privacy-by-design principles
industry solve for the challenges that come with the need to address into practice, IAB and the IAB Tech Lab introduced and continuously
differing and evolving privacy regulations worldwide. The GPP enables update the following taxonomies to provide the industry with common
user consent signals to be communicated throughout the digital ad supply nomenclature for audience segment names and content labels to improve
chain and provides the protocol to help consolidate the management of comparability of data across different providers: Transparency Center,
different consent signals from multiple global privacy jurisdictions. It has Content Taxonomy, and Audience Taxonomy.
the capabilities to read GPP signals—TCF, U.S. State signals, Global
Privacy Control (GPC)—and apply to identities. 4. Privacy Enhancing Technologies (PETs): Deploy privacy guaranteeing
technologies like differential privacy* and multi-party computation to keep
2. IAB Multi-State Privacy Agreement (MSPA) The IAB Multi-State Privacy DCR transactions private and to avoid sharing/transferring sensitive
Agreement is an industry contractual framework intended to aid information. IAB Tech Lab’s PETs initiative focuses on use case
advertisers, publishers, agencies, and ad tech intermediaries in complying definitions, API standards for PETs between pairs/groups of digital ads
with five state privacy laws that are becoming effective in 2023 (California, ecosystem participants and stewarding open-source initiatives.
Virginia, Colorado, Connecticut, Utah). Note: The MSPA is not a “model
contract” or a template agreement; instead, it is a set of privacy-protective
terms that spring into place among a network of signatories and that follow
the data as it flows through the digital ad supply chain.
For more information about how to get involved or
learn more about IAB and IAB Tech Lab initiatives,
please email [email protected].

*For definition see page 37 of the Appendix.

32
Data Clean Rooms:
Understanding the
Benefits and Use Cases
IAB Perspective: The benefits of DCRs in the privacy-preserving technology landscape

The primary benefit of a data clean room (DCR) is that it enables data to As illuminated in IAB’s State of Data 2022 (Part II): Preparing For The
be shared anonymously with other parties without the risk of breaching New Addressability Landscape report, consumer trust is vital to
that data's privacy or exposing it to potential external breaches. This providing companies the access data they need to monetize their
makes DCRs a particularly valuable technology for companies across businesses and create better consumer experiences, products, and
the advertising ecosystem given the increased industry sensitivity on services. DCRs can help companies be accountable by demonstrating
how companies are collecting and using consumer data. their commitment to protecting consumers’ sensitive information.

This report shows that DCRs’ anonymization capabilities enable When considering a DCR, it is imperative to carefully evaluate
companies to derive advanced consumer insights and conduct and weigh the pros and cons of the technology implementation
segmentation analyses without concern over the potential risks to data and maintenance, and then select partner(s) best suited to meet
that may be considered sensitive, such as PII, device IDs, and other your needs.
geographic, behavioral, audience, or contextual data. Companies can
also further enrich their data with other sources for audience insights Since DCR investment requires six-figure annual budgets, DCRs may
and measurement through use of a DCR. not be opportune approach for all companies. Companies can protect
sensitive data using other methods such as de-identification or
It is incumbent upon DCR owners to determine the level of differential aggregation; however, while these methods can be less expensive,
privacy mechanisms and controls needed to secure the data and they are ultimately more time-consuming.
mitigate re-identification of PII. For details on DCR privacy controls and
methods to protect consumer data, see page 37 of the appendix. In summation, while DCRs may not be suitable for all companies, they
can be an effective solution for those that need to share data with
external parties on a regular basis.

34
Use Case Framework: Develop a conditional sequence data approach

When evaluating DCR use cases, it is optimal to take a Overarching Use Cases
conditional sequence data approach.* Outline the various use
cases sequences based on your hypothesis which will branch out 1. Audience insights and segmentation: Collaboration in a DCR
based on the business needs, operational lift, cost, and data between the buy- and sell-sides of the digital advertising industry
maturity. By doing so, companies can identify how to achieve both allows both parties to comingle their first-party data and improve data
short-term and long-term success and achieve incremental value enrichment to understand advanced consumer insights, such as
from their DCR adoptions. behavioral and contextual signals, in a privacy-compliant way.

Data monetization in a privacy-preserving environment is a 2. Media campaign measurement and attribution: By matching
core capability for retailers in DCRs. This allows for the customer and performance data, DCRs enable companies to measure
democratization of data to improve personalization, enhance cross-media performance and develop attribution and measurement
audience insights, and offers a comprehensive view of models for optimization. DCR users can conduct a variety of analyses:
measurement and outcomes. consumer journey, audience overlap, and reach and frequency, as
well as mix modeling and scenario planning with the use of artificial
In the future, as DCRs evolve and become more sophisticated, intelligence (AI) and machine learning (ML).
additional use cases will be unlocked and offer companies across
the ecosystem more flexible, sophisticated, interoperable, and 3. Audience modeling and activation: Advertisers can use DCRs for
scalable opportunities. scalable audience activation by creating probabilistic or look-a-like
audiences for targeting in a privacy-first ecosystem. Publishers and
retailers can uncover and create audiences that ad buyers may find
more appealing. DCR collaboration capabilities open the possibilities
for improved data enrichment to understand consumer insights such
and behavioral and contextual signals.

*Conditional sequence data approach: a non-linear sequence where the next

steps are based on if conditions from previous steps are met.
35
Appendix
DCR Privacy Controls and Methods to Protect Consumer Data

It is incumbent upon DCR owners to determine the level of differential privacy mechanisms and controls needed to secure the
data and mitigate re-identification of PII.

Basic
Encryption Mathematical algorithms used to encrypt secure identity records to prevent reengineering/re-
identification of customer information.

Redaction Threshold Reduces the exposure of sensitive information by removing or redacting specific data points.

Mathematical frameworks for withholding information and limiting ability to infer data about
Differential Privacy Systems individuals when sharing information by describing the patterns of groups.

K-Min / Anonymity The grouping of a set of data records so that each record is indistinguishable requiring a minimal
size of records to minimize re-identification.

Random Metric Perturbation A technique used to add noise to machine learning (ML) models typically by adding random
values in the data set.

Statistical Anonymization Reduces the disclosure risk in micro-data files via a process of masking or perturbing sensitive
data while still allowing for statistical analysis to be performed.

Random Noise Injection Obfuscates or renders data streams statistically invalid by adding noise and randomly perturbing
Advanced the values of the data input to prevent models from becoming too reliant on specific patterns.

37
Evaluation Phase: Additional factors for consideration (1 of 2)

Cost and Time Accessibility and Security

1. Initial setup and deployment: Upfront costs associated with getting the 1. Location-specific features: If your business operates in multiple
technology up and running. locations, the technology should support location-specific features such as
localized customer management.
2. Ongoing maintenance: Costs needed to keep the technology running
smoothly including updates, patches, and technical support. 2. Access control: Consider the technology’s access control measures such
as authentication and authorization protocols.
3. Licensing: Upfront costs associated with licensing the technology.
3. Data security: Make sure each technology has strong data security
4. Hosting: Costs to consider if the technology is hosted on a third-party server. measures in place including encryption of sensitive data and secure
servers.
5. Customization: Costs to consider if the technology is needed to be
customized to fit the specific needs of your business. 4. Compliance: Make sure the technology is compliant with relevant
regulations such as GDPR, CPRA, COPPA, HIPPA, etc.
6. Integration: Costs to consider if the technology needs to be integrated with
other systems or software. 5. Security updates and patches: Confirm that each technology regularly
releases security updates and patches to address new threats.
7. Training: Costs to consider if employees need to be trained on how to use
the technology. 6. Data backup and recovery: Technologies should have robust data
backup and recovery process in place to protect against data loss.
8. Scalability: Costs to consider if the technology needs to be scaled up as
your company’s business grows. 7. Support: Technologies should provide timely and reliable support in the
event of a security breach or other issue.
9. Service fees: Additional costs for services provided with the purchasing,
licensing, or additional support personnel by platform company.

38
Evaluation Phase: Additional factors for consideration (2 of 2)

Data Accuracy and Scalability (Technology Requirements) Human Capital and Talent
1. Data quality: Data quality tools and processes should be in place to ensure 1. Skills and expertise: Bring together leaders with varying skillsets (data,
that the data is accurate, complete, and consistent, including tools for data technology, marketing, and privacy). Ensure your company is also hiring
cleansing, deduplication, and data validation. and retaining people with privacy technology expertise.

2. Data governance: The presence of a data governance framework is vital to 2. Training and development: Provide ongoing training and development
ensure that data is properly managed, secured, and compliant with relevant opportunities to ensure that the team has the necessary skills to support
regulations and standards. the technology. This may include formal training programs, as well as
opportunities for on-the-job learning and professional development.
3. Scalability: Technologies need to scale up or down to support companies’
changing needs, including the ability to handle large amounts of data and a 3. Team size and structure: The size and structure of the team supporting
high volume of concurrent users or transactions. the technology should be appropriate for the scale and complexity of the
technology. This may involve having a dedicated team or a hybrid team
4. Performance: Fast query and data processing times are important to that supports multiple platforms.
ensure that users can access the data they need quickly and efficiently.
4. Staff retention: High staff turnover can be disruptive and costly, so it is
5. Integration: The ability to easily integrate with other systems and tools such important to have strategies in place to retain key team members. This
as extract, transform, and load (ETL) tools, analytics platforms, and data may include competitive salaries, benefits, and opportunities for career
visualization tools. advancement.

6. Support: Documentation, training resources, and customer support are 5. Collaboration and communication: The team should have strong
crucial to help users effectively use and maintain the technology. collaboration and communication skills to work effectively together and
with other stakeholders, such as users, vendors, and senior
management.

6. Culture and values: The team's culture and values should align with
those of the company and support the overall goals and objectives of the
platform. This can help create a positive and productive work
environment.

39
Methodology

Partnered With Ipsos

IAB commissioned Ipsos to co-create and execute a quantitative and qualitative analysis to
examine how data clean rooms (DCRs) and other privacy-preserving technology including
customer data platforms (CDPs), consent management platforms (CMPs), data management
platforms (DMPs), and identity solutions are being managed and activated.

Quantitative Sample Generated and Execution Qualitative Sample Generated and Execution
• 15-minute anonymous online survey, n=203 • 30-minute interviews with 20 industry leaders, with
• Ipsos leveraged NewtonX B2B sample methodology to representatives across the following company types: brands,
recruit verified data decision-makers who are engaged agencies, publishers, and retailers/retail media networks
with privacy-preserving technology across the following • Fielded: November-December 2022
company types:
• Brands
• Publishers/Retailers
• Agencies
• Fielded: November 11 to 23, 2022

40
Respondent Profile

34%
Agencies
2022 Ad Spend

$1B+ 32%
Publishers Company
$750M to just under $1B Type
$500M to just under $750M

$100M to just under $500M

34%
$50M to just under $100M Brands
$10M to just under $50M

$5M just under $10M

5%
$1M to just under $5M Strategist/ 8%
Other C-Suite
< $1M
13%
0% 10% 20% 30%
Manager

2022 ad spend for primary brand / account Job 26%

Position SVP

48%
Director

41
About IAB

The Interactive Advertising Bureau empowers the media and marketing

industries to thrive in the digital economy. Its membership comprises more
than 700 leading media companies, brands, agencies, and the technology
firms responsible for selling, delivering, and optimizing digital ad marketing
campaigns. The trade group fields critical research on interactive advertising,
while also educating brands, agencies, and the wider business community on
the importance of digital marketing. In affiliation with the IAB Tech Lab, IAB
develops technical standards and solutions. IAB is committed to professional
development and elevating the knowledge, skills, expertise, and diversity of
the workforce across the industry. Through the work of its public policy office
in Washington, D.C., the trade association advocates for its members and
promotes the value of the interactive advertising industry to legislators and
policymakers. Founded in 1996, IAB is headquartered in New York City.

42
About the IAB Measurement, Addressability & Data Center

The collection and use of data to reach audiences and measure

online advertising campaigns is central to powering the digital
advertising ecosystem. IAB’s Measurement, Addressability &
Data Center aims to provide essential industry guidance and IAB Measurement, Addressability & Data Center Board Member Companies:
education on solutions amid changes in underlying technology,
privacy regulations in a constantly evolving ecosystem.
• Develop measurement and addressability standards, best
practices, and guidelines for digital media.
• Identify requirements for improving data assets for brand
suitability, brand safety, transparency, and trust.
• Provide updated standard IAB Terms & Conditions to allow
companies to transact more efficiently.
• Deliver guidance on new addressability and measurement
solutions of known and unknown audiences and/or changes
in the marketplace.
• Accelerate the development of effective emerging markets,
such as retail media networks, data clean rooms, etc.

43
About Ipsos

Ipsos is the third largest market research company in the world,

present in 90 markets and employing more than 18,000 people.

Our research professionals, analysts, and scientists have built

unique multi-specialist capabilities that provide powerful insights into
the actions, opinions, and motivations of citizens, consumers,
patients, customers or employees. Our 75 business solutions are
based on primary data coming from our surveys, social media
monitoring, and qualitative or observational techniques. Game Changers
“Game Changers” – our tagline – summarises our ambition to help In our world of rapid change, the need for reliable information to make
our 5,000 clients to navigate more easily our deeply changing world. confident decisions has never been greater.

At Ipsos we believe our clients need more than a data supplier, they need a
Founded in France in 1975, Ipsos is listed on the Euronext Paris
partner who can produce accurate and relevant information and turn it into
since July 1st, 1999. The company is part of the SBF 120 and the actionable truth.
Mid-60 index and is eligible for the Deferred Settlement Service
(SRD). This is why our passionately curious experts not only provide the most precise
measurement, but shape it to provide True Understanding of Society, Markets
ISIN code FR0000073298, Reuters ISOS.PA, Bloomberg IPS:FP and People.
www.ipsos.com
To do this, we use the best of science, technology and know-how and apply
the principles of security, simplicity, speed and substance to everything we do.

So that our clients can act faster, smarter, and bolder.

Ultimately, success comes down to a simple truth:
You act better when you are sure.
44
About our Sponsors

Principal Sponsor
TransUnion is a global information and insights company with over 12,000 associates operating in more than 30 countries. We make trust possible by
ensuring each person is reliably represented in the marketplace. We do this with a Tru™ picture of each person: an actionable view of consumers
stewarded with care. Through our acquisitions and technology investment we have developed innovative solutions that extend be yond our strong
foundation in core credit into areas such as marketing, fraud, risk, and advanced analytics. As a result, consumers and businesses can transact with
confidence and achieve great things. We call this Information for Good® — and it leads to economic opportunity, great experiences, and personal
empowerment for millions of people around the world.

Platinum Sponsor
Dstillery, the custom audience solutions company, empowers brands and agencies to reach their best customers across the programmatic web. Backed
by our award-winning data science, Dstillery has earned 16 patents (and counting) for the AI technology that powers our precise, scalable solutions. Our
newest innovation, ID-free Custom AI, is a privacy-by-design behavioral targeting solution that performs on par with cookies — without user tracking.
Our ID-based premier product, Custom AI Audiences, is a just-for-your-brand targeting solution that continuously scores hundreds of millions of users to
deliver the best audiences for your brand.
To learn more, visit us at www.dstillery.com or follow us on LinkedIn.

Premier Sponsor
Adstra is the new model for the data-driven enterprise. Adstra comprises a comprehensive suite of transparent identity and data solutions that are
portable, futureproofed, and offered via a subscription-based model that liberates brands to realize the maximum value from thei r data. As the first
Enterprise Identity Platform, Adstra enables the flexibility to activate identity management and data capabilities within your existing technology
environments. In addition, Adstra connects brands with authenticated audiences tailored to specific business objectives. No other data provider bridges
the gaps between PII and anonymized data with the same speed, flexibility, cost-effectiveness, and frictionless portability across all media.

Title Sponsor
Comscore is a trusted partner for planning, transacting, and evaluating media across platforms. With a data footprint that combines di gital, linear TV,
over-the-top, and theatrical viewership intelligence with advanced audience insights, Comscore allows media buyers and sellers to quantify their
multiscreen behavior and make business decisions with confidence. A proven leader in measuring digital and TV audiences and a dvertising at scale,
Comscore is the industry’s emerging, third-party source for reliable and comprehensive cross-platform measurement.

45
A Perspective from TransUnion: Becoming a Data Leader
Sponsored Content​

In 2023, marketers face the difficult question of how to shore up their Second, identify the data types and sources that you need to fulfill your key outcomes.
consumer engagement and acquisition strategies in the face of privacy As an example, if optimizing marketing contribution to revenue is the goal of a large
regulation and data deprecation. The need for improved privacy controls has consumer goods company, the marketing team will need to consider a variety of owned
driven the rise of data clean rooms (DCRs). The loss of data signals and partner media and sales channel data sources, both offline and online.
associated with cookies and mobile ad IDs has forced us to re-evaluate how
we collect, enrich, activate, and measure consumer data. So how should we The team should start by thoroughly evaluating the consumer data it has—or can access
adapt to these new and developing paradigms in the data-driven marketing —across its first-, second-, and third-party data sources spanning these channels. By
world? beginning its journey with a multi-faceted data strategy (across multiple potential data
partners) at its core, the team greatly increases its chance of success of not only
Our clients are addressing the consumer privacy and data loss challenges in a measuring across channels, but also seeing the incremental contribution of each. This is
few different ways like leveraging back-to-basics contextual targeting, key to effective marketing optimization.
developing partnerships across the rapidly growing connected TV and retail
media spaces, or unlocking new sources of second-party data by collaborating Finally, it’s time to apply consumer data to use cases in a privacy-focused way, and that
with trade and ecosystem partners. means implementing the right infrastructure and a clear data taxonomy. Too often,
evaluating privacy technology before identifying use cases and data leads to
Those that seize the opportunity to test, learn, and adapt to the consumer data unnecessary work. Data leaders, and data and technology partners should walk through
challenges we all face will become the data leaders of tomorrow. These a clear set of requirements and concerns that data owners and users have, such as the
leaders will be busy in 2023 building and executing an addressable marketing risk of re-identification. Additionally, data controllers can help their partners use only the
strategy rooted in privacy, with clearly defined use cases and data data they need, for example by running a travel-oriented campaign based on an
requirements at its core. anonymized cohort of consumers with similar destination interest. Trusted partners will
candidly discuss how to mitigate and manage their concerns.
As many marketers have learned, technology is only as valuable as what you
put into it. Clear use cases must precede investments in next-generation Successful data leaders in our privacy-focused and increasingly data deprived world will
marketing technology like DCRs. First, take inventory and define the navigate these intertwined parameters of privacy requirements, use cases, and data, and
challenges you face, such as increasing customer acquisition costs, bring the strength of their organizations to bear.
decreasing addressable audience reach, and/or the inability to measure
incremental ROI across channels. Linking these pain points to a specific action
Written by
and a potential set of outcomes will help provide a path. Brett House
Written by
Sam Shapiro-Kline
Glob al Vice President,
Director of Growth,
Marketing Solutions,
TransUnion
TransUnion

46
Thank You!
Research & Insights
• Chris Bruderle, Vice President, Industry Insights & Content Strategy ([email protected])
• Meredith Guiness, Senior Manager ([email protected])

Measurement, Addressability & Data Center

• Jeffrey Bustos, Vice President ([email protected])
• Angelina Eng, Vice President ([email protected])