Cross-Channel Identity Resolution Accuracy in a Post-Cookie Environment

A marketer looks at a conversion and cannot say, with any real confidence, which channel earned it. That failure is an identity gap: the tracking systems built to measure marketing were designed to recognize devices and browser sessions, never the person holding the phone or sitting at the desk.

Third-party cookies illustrate the problem cleanly. A cookie identifies a browser, not a human being. One customer who checks a product on a work desktop at noon, follows up on a phone during lunch, and finishes the purchase on a laptop that night is counted as three unrelated visitors in any dashboard built on cookie data. Multiplied across a customer base, the attribution model ends up counting sessions, not people.

This gap did not start with Chrome. Safari has restricted third-party cookies since 2017, and Firefox has done the same since 2019. A large share of U.S. web traffic was already effectively cookieless years before anyone started talking about "cookie deprecation" as a future event. The browser-level restrictions came first, and the headlines came later.

Chrome's own path closed off what might have been a middle option. On April 22, 2025, Google announced it would not add a separate consent prompt for third-party cookies in Chrome. Then, on October 17, 2025, Google announced the retirement of most of the Privacy Sandbox APIs, the browser-native replacement system that had been positioned as the industry's bridge to a cookieless future, closing off that bridge.

What's left is a choice between two paths, not three. You can keep relying on third-party cookies, which are regulated and already non-functional across most non-Chrome browsers, or you can build first-party identity resolution. A single customer journey today might cross a social ad, a retail media placement, a loyalty email, a branded search, and a conversation with an AI assistant before anyone buys anything. None of those five touchpoints knows, by default, that it belongs to the same person as the other four. The data exists at every step. What's missing is the thread that ties it together, and that thread is a question of identity, not a question of collecting more data.

What identity resolution does

Identity resolution is the practice of connecting fragmented signals across devices, channels, and sessions into one persistent profile for a real person. It works by matching identifiers, things like email addresses, device IDs, login credentials, and behavioral signals, across every touchpoint and unifying them into a single record, usually managed inside a customer data platform or an identity graph. How that matching happens determines both how accurate the result is and how many people it actually covers.

There are two core methods, and they pull in opposite directions.

Deterministic matching connects profiles using exact, known identifiers: email addresses, phone numbers, login credentials, customer IDs. Because the match rests on confirmed data rather than a guess, accuracy runs high. Braze's identity resolution guide describes deterministic matching as producing a precise, trustworthy link between records. The limitation is coverage. Deterministic matching only works where the brand already holds a verified identifier: authenticated sessions, logged-in users, and contacts already matched in a CRM. Anyone who browses anonymously falls outside its reach.

Probabilistic matching takes the opposite bet. It uses statistical models to infer connections from behavioral signals: device fingerprints, IP addresses, browsing patterns, location data, timing. Because it doesn't need a confirmed identifier, it reaches people who have never shared anything identifying at all, which extends coverage well past authenticated sessions. A MiQ case study found a 64% increase in reach across cookieless identifiers using probabilistic methods. The cost is inference error. Braze states that some of the connections probabilistic matching infers will be wrong, and even a small mismatch rate at a single channel compounds once five channels get stitched into one multi-touch model.

Deterministic matching and probabilistic matching trade accuracy for reach in a fixed structural relationship, regardless of which vendor is chosen. Deterministic matching gives high accuracy on a limited set of known people. Probabilistic matching gives broad reach at an accuracy level that varies and is hard to pin down. Neither one, used alone, satisfies both demands at once.

Hybrid Approaches and Identity Graphs

Most working identity resolution systems today combine both methods. Deterministic matching forms the trusted foundation, and probabilistic matching extends coverage into the unauthenticated sessions deterministic matching can't touch. Braze describes this hybrid approach as prioritizing exact matches first, wherever a verified identifier exists, then applying probabilistic inference to connect whatever anonymous sessions remain.

The identity graph is what turns this into something durable rather than a one-time match. It maps the relationships between every known identifier tied to a person, email, device ID, loyalty ID, postal address, so each new touchpoint resolves against a record that's already been built. A new session doesn't need to re-prove who the customer is from scratch. It checks against the accumulated graph instead.

Intent IQ's 2026 framing for this model calls it "Composable Identity," built around activating first-party data directly inside a data cloud, in Intent IQ's case in collaboration with Snowflake, so a privacy-compliant identity record gets maintained without sensitive data moving between systems. Clean rooms extend the same logic into second- and third-party matching: Google Ads Data Hub, Amazon Marketing Cloud, and Meta Advanced Analytics all let matching happen on encrypted identifiers inside a governed environment, returning only aggregated results. Personal data stays out of the resolution layer, but cross-platform signals still get connected.

A newer development is changing how conflicts between the two methods get resolved. AI agents now handle disagreements between a probabilistic match and a deterministic match in near real time, applying confidence-weighted logic instead of waiting for a nightly batch job to run a static hierarchy rule. That's a real shift from how identity resolution worked even a short time ago.

Intent IQ's work with Involved Media and TransUnion on a higher education client resolved users on Safari and iOS through an identity graph and produced a 41% lift in conversion performance for that campaign.

Vendor accuracy claims versus what independent audits find

Vendor accuracy numbers and independently audited accuracy numbers for the same methods often land far apart, and the gap is wide enough that any single accuracy figure needs to be read alongside who measured it and how.

A Truthset study run for CIMM and Go Addressable, cited by FreeWheel, found IP-to-postal-address link accuracy to be very low. That figure applies to one specific probabilistic signal, IP-to-postal matching, but it represents the kind of independent audit the identity resolution industry rarely produces on its own.

The Truthset number and the accuracy figures vendors publish may not measure the same thing. IP-to-postal matching is one probabilistic technique among several; deterministic email-hash matching under a framework like UID2 works on a different mechanism. The size of the divergence between the two shows that the specific method behind an accuracy claim changes the result more than the headline number attached to it.

That divergence matters most once errors start compounding. A modest mismatch rate at the level of a single channel doesn't stay modest once a model stitches together five channels into one attribution picture. The distortion that reaches the budget decision at the end isn't proportional to the error that started it. A marketer reallocating spend off a multi-touch model built on inferred identity is working from a number that has already absorbed and amplified whatever inaccuracy existed at each individual touchpoint.

The honest way to state where accuracy actually stands: deterministic matching approaches certainty when the identifier is confirmed, but it only covers the contacts a brand already knows. Probabilistic accuracy is a range, not a number, and that range shifts with the sophistication of the algorithm, the quality of the underlying data, and which specific signal is being matched. Treating either method as a fixed accuracy percentage misrepresents how both actually behave.

First-Party Data Quality and the Accuracy Spectrum

The accuracy any organization gets from identity resolution is capped by the first-party data it already has, because deterministic matching can only reach as far as the verified identifiers a brand actually holds. Everything built on top of that foundation, hybrid matching, identity graphs, clean room collaboration, inherits that same ceiling.

Braze frames zero-party and first-party data, information customers share directly or that a brand collects through its own platforms, as the real basis for identity resolution that holds up over time. Most brands only know a fraction of their customer base at that level of certainty. The rest of the customer journey happens in anonymous sessions, and those sessions need probabilistic methods to resolve at all, carrying every limitation that comes with them.

Building that foundation is a sequence, not a single purchase. Hashmeta's implementation roadmap lays it out in two stages. Foundation building comes first, deploying a CDP, standing up consent management, and establishing data quality practices, followed by resolution deployment, which activates the actual matching, configures the identity graph, and sets up quality metrics to track it. Skipping the first stage to get to the second produces a resolution system with nothing solid underneath it.

The practical effect appears directly in accuracy. Organizations with rich authenticated touchpoints, loyalty programs, subscription logins, transactional email, have more deterministic anchors to work from, so probabilistic matching extends a reliable base. Organizations without those anchors end up relying on inference for nearly everything, with the wide accuracy range that comes with it.

Walled gardens like Google, Meta, and Amazon don't face this problem the same way, because their targeting and measurement run on first-party data collected from logged-in users at scale. That's exactly why a brand trying to measure performance across the open web can't match walled-garden attribution accuracy without building an equivalent first-party identity layer of its own. First-party data breadth is a strategic infrastructure decision an organization makes well before it ever evaluates a vendor, not a feature it buys after the fact.

Consent-Chain Integrity and Regulatory Enforcement

A match can be technically accurate and still be unusable, because the consent behind it has gone stale or never met the bar regulators now enforce. That distinction determines what data is even allowed to feed an identity graph, affecting every accuracy number discussed so far.

Enforcement has already moved. The CNIL issued substantial fines against Google and Shein in September 2025, reaffirming that refusing consent has to be exactly as easy as accepting it, and that cookies dropped on a device before consent is given count as a violation on their own. Regulators are acting faster than most identity systems are cleaning out old records.

Universal ID graphs build up entries over years, and many of the entries sitting in graphs active in 2026 trace back to consent notices that wouldn't pass today's standards. The discipline of pruning stale entries and re-checking consent against current rules has been inconsistent across the industry, which leaves graphs carrying weight they shouldn't still be carrying.

The accuracy consequence follows directly from that: the match rate an organization can legally act on is lower than the match rate its graph is technically capable of producing, because some share of those matches rest on consent that wouldn't hold up to scrutiny. Vendors that operate as data processors under signed contracts handle this more defensibly than the old model of cookies firing freely to ad networks. That defensibility only holds, though, if the vendor's own consent-chain governance can actually be audited. Regulatory pressure doesn't just test whether a match is technically correct. It narrows how much of that technical accuracy an organization is allowed to use.

The vendor and infrastructure landscape for organizations choosing a resolution approach

The identity resolution market has consolidated quickly around a small group of large infrastructure providers, and that consolidation hasn't settled the accuracy and auditability questions raised in the sections above. If anything, it's made those questions harder for an individual organization to check on its own.

Consolidation at the top of the market is visible in recent deal activity. In May 2026, LiveRamp agreed to be acquired by Publicis Groupe, with the deal expected to close before the end of 2026. LiveRamp was also named a Leader in IDC's 2025 worldwide MarketScape assessment for data clean room technology used in advertising and marketing. Clean room players and identity graph providers are increasingly the same companies, so the architectural choices described earlier in this piece, deterministic foundations, probabilistic extension, clean room matching, graph maintenance, are decisions made inside a shrinking set of platforms.

That shrinking field makes the questions raised earlier more urgent: what method is behind a given accuracy claim, how current is the consent attached to each entry in the graph, and how much of an organization's own first-party data foundation is doing the real work that the vendor's tooling depends on. Salesforce's 2026 State of Marketing research found that only one in four marketers is completely satisfied with how they're unifying data, a gap that lines up with everything the rest of this piece has laid out: the tools for resolving identity across channels keep improving, but the accuracy any single organization gets out of them still depends on the first-party foundation, the consent governance, and the specific matching methods it chooses to build on.