Advertising identity & addressability: An identifier must be available, permitted and reliable to be addressable; iOS 14.5+ requires App Tracking Transparency permission for ad tracking in Australia; The Privacy Act 1988 applies to organisations with $3M+ turnover
Image: AdTech Market Guide

Identity & Addressability

Advertising identity and addressability

Understand what advertising identity can identify, when an audience is addressable, and how to check coverage, matching and privacy limits.

Advertising identity links an identifier to a browser, device, account, person or household for a defined advertising task.

Addressability is the ability to use an eligible signal for targeting or measurement in a particular placement. An identifier held by a provider does not make every impression addressable: the signal must be available, permitted, usable by the relevant systems and reliable enough for the task.

Start with the task and the counting unit

Reaching existing customers, limiting repeated ads, estimating reach and linking exposure to an outcome require different evidence.

A browser identifier can recognise activity in that browser; it does not establish that the same person used another device. A household link cannot show which resident saw an ad.

DecisionQuestion to settleLimit to record
Reach existing customersCan eligible customer records be matched to identifiers usable in the planned media?A matched record may have no eligible impression.
Limit frequencyAre exposures counted by browser, device, person or household?Unlinked devices may receive additional ads.
Report reachWhat counts as unique, and which inventory was observable?Unrecognised impressions may be absent from the unique count.
Link exposure and outcomeWhich permitted records and events can be joined?A match does not establish that the ad caused the outcome.

Understand the approaches

A directly observed account attribute, such as an email address, can serve as a match key for eligible records. This is commonly called deterministic matching. The resulting person-level link can still be incomplete or wrong: accounts may be shared, attributes change, and a provider may add inferred links elsewhere in its graph.

Probabilistic matching infers links from a pattern of signals. It may extend coverage beyond directly matched records, but its quality depends on the signals, population and validation method. A provider may combine direct and inferred links. Ask what share of the activated audience relies on each method rather than treating a label for the entire graph as an accuracy measure.

Identity is unnecessary when the targeting decision is simply to appear in relevant content or placements. Contextual targeting can answer that question without recognising the same person elsewhere. On its own, it cannot identify an existing customer or cap that person’s exposure across unrelated properties. Its implementation still needs a data review: an ad request or associated technology may carry information about a person or device.

Follow availability through delivery

For an Australian campaign, record the audience at each stage:

  1. Source:Which data created it, for what purpose, and subject to which choices?
  2. Match:How many input records were eligible, how many matched, and at what identity level?
  3. Activation:Which matched identifiers can the proposed publisher, seller and buying account use?
  4. Delivery:How many eligible opportunities and impressions occurred in the intended inventory?
  5. Measurement:Which exposures and outcomes can be observed and joined? What remains unknown?

A match rate may use all input records, eligible records or another provider-defined base. It is neither reachable audience nor delivered reach. Request the numerator, denominator, period, geography and exclusions behind each rate.

Platform rules also affect availability. In iOS 14.5, iPadOS 14.5 and tvOS 14.5 or later, Apple requires user permission through the App Tracking Transparency framework to track users or access their device’s advertising identifier. Covered tracking includes linking app data with data from other companies’ properties for targeted advertising or advertising measurement.

Chrome’s third-party cookies should not be described as universally removed: Google stated in October 2025 that Chrome would maintain its existing approach to user choice for them.

Key Privacy Changes in Apple and Google Ecosystems (2024–2025)

  • iOS 14.5 / iPadOS 14.5 / tvOS 14.5+Apple introduced App Tracking Transparency (ATT); user consent required for tracking and accessing advertising identifiers
  • October 2025Google confirmed Chrome would maintain its existing approach to third-party cookies, based on user choice rather than universal removal
  • OngoingIAB Tech Lab continues developing ID-less solutions and guidance for post-cookie environments

Assess the Australian data use

The privacy assessment depends on the data and its use, not the name given to an identifier.

The Privacy Act 1988 applies to Australian Government agencies and organisations with annual turnover above $3 million, as well as some other organisations.

It includes 13 Australian Privacy Principles that apply to covered private-sector organisations and most Australian Government agencies, collectively known as APP entities.

Whether a campaign’s participants and data flows fall within these rules is a matter for the organisation’s privacy assessment.

Australian Privacy Act 1988: Key Coverage Criteria

Applicable organisations
Private-sector entities with annual turnover > $3 million
Includes government agencies
Most Australian Government agencies are covered
Applies to
All handling of personal information, including tracking pixels and identifiers
Governing principles
13 Australian Privacy Principles (APPs)

Check app disclosures and tracking

Privacy Nutrition Labels show some data types an app collects and whether the information is used to track people or is linked to their identity or device. Developers provide privacy-practice information in App Store Connect when submitting new apps or updates.

Third-party code, including advertising and analytics SDKs, must be described in a privacy manifest: what data it collects, how it is used and whether it tracks users. Xcode combines the manifests into a report for the app’s Privacy Nutrition Label.

Apple’s definition of tracking includes an SDK combining an app’s data with data from other companies’ apps for advertising or measurement, even if the app operator does not use the SDK for those purposes.

Make a bounded decision

State the campaign requirement and whether its unit is a person, household, device or placement.

Request a report showing eligible inputs, matches, usable opportunities, delivered impressions and unknowns. Establish who receives identifiers and how changed or withdrawn choices are handled.

Use identity where its permitted coverage and demonstrated quality support the task. Where they do not, consider placement or content targeting and evaluate it on its own terms. Reassess when inventory, permissions or graph links change.

In this guide

  1. Contextual targeting versus identity-based targetingCompare contextual and identity-based targeting by the decision each can support, its coverage limits and the evidence to request.
  2. Comparing deterministic and probabilistic audience matchingCompare direct and inferred audience matches using eligibility, match coverage, validation quality and the cost of wrong links.
  3. Checking the limits of cross-device identity claimsAudit cross-device identity claims by identity level, inventory coverage, graph quality, platform permissions and reporting gaps.

More from Identity & Addressability