Cookieless isn't anonymous
Chrome kept third-party cookies, yet ads still recognise you. How Unified ID 2.0 turns the email you log in with into a token, what genuinely improved, and what didn't.
Chrome decided to keep third-party cookies. Safari and Firefox block them, and apps never had them. Yet ads still recognise you. The reason is the email you typed into a login form.
What a cookie was
A note that a company you never visited stored in your browser and read on every site that ran its code. Strangers following you around the web. Clear your cookies, and you were a new person.
What replaced it
Take Unified ID 2.0 (UID2), an open-source framework started by The Trade Desk:
- You log in to a site or an app with your email.
- The email is normalised and hashed. The same email always gives the same hash.
- An operator adds a secret salt and turns it into your UID2. The Trade Desk runs the public operator, others run private ones inside sealed enclaves.
- The ad request doesn’t carry your UID2 itself, but an encrypted token. Its value is new every time, and it’s refreshed about hourly. Only companies that joined the framework get the keys to read it.
- You can opt out on a public portal, and no new tokens are issued for you.
In Europe and the UK a separate framework, EUID, runs on GDPR and consent rules.
What genuinely improved
- No strangers: only participants who signed up can read the token.
- A stolen token goes stale quickly.
- Opt-out is real and enforced at the source.
- There’s no central database of emails: each participant keeps only its own data.
What didn’t
You’re still recognisable. That’s the deal.
A hash isn’t anonymity. Same email, same hash, on every site that sees it. The FTC said it plainly in 2024: hashing doesn’t make data anonymous.
And it reaches further than a cookie ever did. A cookie lived in one browser. Your email follows you to your phone, your laptop and your smart TV. Clearing your cookies doesn’t help, because your login is the key.
Who wins
This model works best for publishers whose users log in. That’s mostly large platforms. A small site without accounts has nothing to hash. So the move away from cookies quietly favours the biggest players, the opposite of what a lot of the privacy talk promised.
Having worked on a unified ID integration myself, I think the mechanism is better engineered than cookies ever were. But “privacy-preserving” describes the mechanism, not the outcome. Cookieless isn’t anonymous. It’s governed identity, and the people being identified deserve to hear it said that way.
Which would you rather have: a cookie you can delete, or an ID tied to an email you’d have to change?
