Source-linked AI summary
Bridging the Gap: A Longitudinal Analysis of Extended Identifiers in the Post-Cookie Era
Michael Smith, Riley Grossman, Krzysztof Franaszek, Antonio Torres-Agüero, Pritam Sen, Cristian Borcea, Yi Chen
TL;DR
As third-party cookies are restricted, EIDs offer a way to link users across domains and devices, but evidence about their adoption and reliability remains limited. This study analyzes real-world EID use in client-side header bidding and finds widespread, growing adoption alongside accuracy, fairness, and privacy concerns.
Problem
Third-party-cookie restrictions have increased reliance on EIDs for linking users across domains and devices, requiring evidence about their real-world adoption and characteristics.
Method
The study analyzes HTTP Archive header bidding requests collected from January 2022 to May 2025 between websites and six widely used SSPs.
Results
EID adoption rose from 28.92% of visited websites in January 2022 to 83.76% in May 2025, while 17 of 18 providers failed to identify a self-reported crawler as bot traffic and 12 created persistent cross-context EIDs.
Takeaways & Limitations
EIDs are not yet mature as a trustworthy alternative identity solution because inconsistent identifiers, bot misclassification, and persistent or non-consensual transmission create auction fairness and privacy concerns.
Takeaways & Limitations
The findings are definitively limited to automated-crawler visits in a simulated Chrome browser and may not generalize to real-user visits or browsers with stronger tracking restrictions.
Abstract
from arXiv · showhide
As third-party cookies fade because of browser restrictions, the online advertising ecosystem is turning to extended identifiers (EIDs) as an alternative. EIDs are persistent user identifiers, such as hashed email addresses, that are employed to link users across domains and devices. This paper presents a 41-month longitudinal study examining EID usage in over 145 million HTTP header bidding requests sent to six major supply-side platforms (SSPs) from 616,539 websites. Our findings show that EIDs are widely used and are becoming increasingly prevalent in the digital advertising ecosystem, reaching 83.76% of studied websites by May 2025. Our analysis of the 18 popular EID providers that account for 99.42% of all transmitted EIDs in our dataset raises concerns about the readiness of EIDs as an alternative to third-party cookie tracking. In terms of accuracy, only one identity provider consistently recognizes and identifies that the visitor is a self-identified bot crawler, and many providers regularly transmit multiple EIDs for the same visitor. We also identify privacy concerns with EIDs, as 12 of the providers create persistent EIDs that can identify the same user across visits, websites, devices, and months. Finally, we found that 16 providers transmit EIDs on EU websites without user consent.
1 Introduction
This paper examines how extended identifiers (EIDs) are replacing or extending third-party-cookie-based tracking in real-time advertising. A 41-month study finds rapidly increasing adoption alongside accuracy, fairness, and privacy concerns.
- EID concept: EIDs use first-party signals such as hashed email addresses to create persistent identifiers promoted as privacy-preserving cookie alternatives.Identity providers control access to encrypted identifiers, unlike cookies that are accessible to many third parties through cookie syncing.
- Tracking scope: EIDs also support cross-device and cross-browser tracking through deterministic or probabilistic ID bridging.Probabilistic bridging can rely on device or browser characteristics similar to fingerprinting, raising accuracy and privacy concerns.
- Adoption: EIDs increased from 28.92% of visited websites in January 2022 to 83.76% in May 2025.Prevalence continued rising substantially after Google abandoned its third-party-cookie deprecation plans in July 2024.
- Accuracy: All but one of 18 identity providers inconsistently transmit EIDs and sometimes send multiple EIDs for one visitor.Different identities sent to competing SSPs may give advertisers inconsistent beliefs about users and contribute to unfair auctions.
- Accuracy and privacy: Only one provider identifies the self-reporting crawler as bot traffic, while 12 providers generate persistent EIDs across websites, devices, and months.The remaining providers may enable advertisers to bid on bot impressions, and persistent identifiers raise additional privacy and accuracy concerns.
- Privacy: Sixteen of 18 providers transmit EIDs on EU websites without user consent.This finding raises concerns about alignment with privacy requirements and the claimed privacy-preserving role of EIDs.
2 Related Work
Related work establishes that users can be linked across devices and contexts through probabilistic matching, fingerprinting, and first-party signals. These techniques provide the technical background for understanding EID generation and its privacy implications.
- Research gap: Earlier research compared EIDs with cookies and discussed Web-privacy implications, but adoption-rate evidence remained scarce and proprietary.The paper positions its study as addressing the lack of prior academic analysis of EID adoption and provider behavior.
- Cross-device tracking: Prior studies demonstrate probabilistic user matching across devices using IP addresses, cookies, and user accounts.Related work also reports cross-device ad targeting based on interactions with Alexa devices tied to the same Amazon account.
- Fingerprinting: Fingerprinting can infer user identities when deterministic signals such as logins are unavailable.Prior research has both measured fingerprinting prevalence and documented its ability to identify users and support targeted advertising.
- First-party cookies: First-party cookies are identity signals that EID providers may use to generate identifiers.Prior work shows that cloaking or first-party embedding can let third-party trackers use such cookies for tracking beyond the visited domain.
3 Method
The study measures real-world EID adoption through client-side header-bidding requests collected by the HTTP Archive. It extracts and aggregates EIDs across six SSPs while accounting for provider-specific request formats and redundant requests.
- Data source: The study uses HTTP Archive header-bidding requests to investigate EID adoption and sharing in real-world advertising traffic.Header-bidding requests include user identifiers because user identity affects bid prices.
- Crawl scope: Monthly automated Chrome crawls cover home and secondary pages from over 16 million websites, though the website sample is not consistent over time.The sample is drawn from websites most visited by real Chrome users in each year.
- Collection scope: From January 2022 to May 2025, the analysis collects client-side requests between websites and six high-volume SSPs.Server-side RTB requests are not visible to the crawler, so the study focuses on client-side header bidding.
- EID extraction: EIDs are extracted by manually evaluating SSP request formats and using the corresponding Prebid adapters.The resulting code records whether requests contain EIDs, their number and values, and their generating provider.
- EID extraction: Provider-specific EID lists are located using published adapter code and manual inspection of raw requests.This resolves how each SSP encodes incoming requests and links EIDs to their providers.
- Request aggregation: Requests are aggregated because one visit can generate multiple redundant requests to each SSP.Aggregation prevents repeated transmission of the same EID across multiple ad slots from being counted as separate webpage-visit observations.
4 Results and Analysis
Across 145,363,816 requests from 616,539 websites, EID prevalence increased substantially through May 2025 while providers exhibited inconsistent identity transmission, bot-recognition failures, and persistent identifiers. These findings raise concerns about EID accuracy and privacy as an alternative to third-party cookies.
- EID prevalence: 83.76% of visited websites transmitted at least one EID by May 2025, up from 28.92% in January 2022.Prevalence dipped after July 2024 but then rose to an all-time high by the end of data collection.
- EID prevalence: EIDs became more prevalent across both desktop and mobile visits, with 53.48% of desktop and 49.39% of mobile visits containing EIDs in matched observations.The authors suggest generation and ID bridging may be more difficult on mobile devices.
- Provider behavior: 18 identity providers accounted for 99.42% of transmitted EIDs, concentrating the provider-behavior analysis on the ecosystem’s dominant providers.Only 18 of 731 providers produced EIDs for at least 1% of webpage visits.
- Provider behavior: 18.1% of visits involving multiple SSPs received multiple EIDs from an identity provider, compared with 4.18% when EIDs went to one SSP.Different identities across SSPs may lead advertisers to hold different beliefs about a user during an auction.
- Provider behavior: Only Flashtalking explicitly identified the crawler as a bot, while many providers failed to recognize the self-declared bot traffic.Assigning EIDs to bot traffic could cause advertisers to pay for impressions they believe reach real or known users.
- Provider behavior: 12 of 18 providers did not always generate new EIDs per visit, yielding 151,900 persistent EIDs transmitted across 20.59 visits and 19.54 websites on average.26.82% of persistent EIDs represented both mobile and desktop visitors.
5 Discussion and Conclusions
EID adoption has increased substantially, but the study finds that current implementations raise concerns about accuracy, fairness, privacy, and consent. The authors call for greater transparency, auditing, and regulatory compliance while noting that the findings are bounded by crawler-based, client-side observations.
- EID adoption increased substantially and did not abate after Google abandoned third-party cookie deprecation plans in July 2024.
- 17 of 18 identity providers failed to identify the self-reported crawler as bot traffic, while providers also frequently transmitted multiple or different EIDs for one visitor.These behaviors may introduce inaccuracies and unfairness into auctions and may cause advertisers to pay unknowingly for bot traffic.
- 16 of 18 providers transmitted EIDs on EU websites without user consent, and 12 providers reused the same EID across visits, websites, and devices.The authors associate these practices with concerns about consent and cross-site or cross-device tracking.
- The study’s findings definitively reflect automated crawler visits in simulated Chrome browsers, not real-user visits or other browser and behavioral settings.The authors recommend evaluating real-user visits, browsers such as Safari, and behaviors such as account login.
- The analysis covers manually extracted EIDs in client-side header bidding requests sent to six SSPs, so other SSPs and inventory-selling contexts may differ.The authors specifically identify server-side and direct-sold auctions as areas for future research.
- The authors call for standards requiring transparency about identity signals, audits of ID bridging, and compliance with relevant privacy regulations.They propose involving identity providers only when websites determine that compliance requirements are met.
B EID Prevalence by SSP
EID prevalence increased over time across the six observed SSPs, both in the share of requests containing at least one EID and in the average number of distinct EIDs per request, although request-level trends were noisy.
- EID prevalence increased over time across all six observed SSPs in both request-level measures.The measures are the percentage of requests containing at least one EID and the average number of distinct EIDs transmitted per request.
- Request-level trends were noisier than trends aggregated to visit or website level because one crawler visit can generate multiple requests with EIDs included in only some requests.
C Relationship Between New Adopters and Average Number of EIDs
Declines in the average number of EID providers used by publishers coincided with new websites adopting EIDs from relatively few providers, while provider usage later increased among those adopters.
- September 2023 and April 2025 declines may reflect many new websites adopting EIDs from a small number of providers.The average includes only publishers using at least one EID provider, making it sensitive to a surge of new adopters using one or two providers.
- Newly adopting websites used 1.69 and 1.71 EID providers on average in September 2023 and April 2025, compared with 2.21 and 3.05 among all websites.
- The September 2023 decline was short term, with average provider usage rising again the following month and reaching a new dataset high by May 2024.Websites that adopted EIDs in September 2023 used EIDs from 2.81 providers on average by May 2024, a 64% increase.
D Persistent Identifiers by Identity Providers
Persistent EIDs varied substantially across identity providers: Audigent transmitted the most persistent identifiers and a large persistent share, while no provider transmitted only persistent EIDs.
- Audigent transmitted 71,263 persistent EIDs, representing 63.94% of its total transmitted EIDs.
- No provider transmitted only persistent EIDs, while Neustar, Yahoo, and The Trade Desk transmitted very few persistent EIDs.The Trade Desk transmitted two persistent EIDs, less than 0.0001% of its total transmitted EIDs.
E Distribution of EID Occurrences
Most EID values appear on only one webpage visit, while a small set of documented placeholders accounts for the highest-frequency transmissions. The distribution supports treating cross-visit values as persistent identifiers rather than random strings or defaults.
- 21,691,017 distinct EID values are transmitted on exactly one webpage visit, matching a privacy-preserving per-visit design.Repeated transmissions within one visit are counted once.
- ID5’s “0” is transmitted 1,503,865 times, while Flashtalking’s “Bot” is transmitted 440,504 times.Flashtalking explicitly identifies the crawler as automated traffic; both values are documented placeholders.
- Values transmitted across separate stateless webpage visits are analyzed as persistent EIDs, not random strings.If providers emitted random strings, repeated values across such visits would lack an explanation.
F Extracting EIDs from Header Bidding Requests
The study extracts EIDs from differently encoded header bidding requests by identifying each SSP’s format and recovering provider-associated values without inference once the format is known. The six SSPs use query parameters, JSON arrays, and nested JSON structures with provider naming conventions that vary by SSP.
- EIDs are recovered from each request after determining its encoding format, without inference once the format is known.The procedure uses SSP-specific request formats and stores the transmitted EIDs with their generating providers.
- The six SSPs encode EIDs as individual query parameters, JSON arrays, or nested JSON objects at different depths.Magnite and GumGum use provider-specific parameters; Sonobi and Yieldmo use an eids array; Amazon Ads and Index Exchange nest EIDs in JSON.
- Magnite keys EIDs by source domain, whereas GumGum keys them by the provider’s product name.Both use one query parameter per provider, but their parameter naming conventions differ.
- Amazon Ads stores the ids list inside JSON in the vm parameter, while Index Exchange stores user.eids inside JSON in the r parameter.These representations illustrate nested JSON encoding rather than standalone EID query parameters.
- Sonobi and Yieldmo carry provider identifiers in JSON arrays within the eids query parameter.Sonobi’s example includes the id5-sync.com null placeholder 0, while Yieldmo’s example carries a single identifier.
G Robustness to Changes in the Crawled Website List
Because the HTTP Archive crawl list changes over time, the study repeats prevalence analyses on websites observed in both January 2022 and May 2025. The fixed-subset results preserve the reported growth in EID usage.
- The fixed subset contains 24,881 desktop and 26,321 mobile websites present in both the first and last observation months.This controls for changes in the HTTP Archive’s crawl-list composition.
- 77.00% of desktop visits and 76.92% of mobile visits transmitted at least one EID by May 2025, up from 21.76% and 21.06%.The corresponding average number of EIDs per visit rose from 1.71 to 4.32 on desktop and from 2.25 to 5.31 on mobile.
- The fixed-subset analysis reaches the same overall conclusions as the full-dataset prevalence analysis.It shows a smaller initial post-deprecation decline but continued growth in EID usage.
H Case Study of ID5 Policy Change Allowing EIDs to be Transmitted without Consent
ID5’s transmission policy changed sharply over time: it shifted from nearly all non-null EIDs to exclusively null EIDs, then returned to nearly all non-null EIDs. The reasons for these reversals are unclear, and the changes applied uniformly across websites.
- 99.98% of ID5 transmissions were non-null at the start of 2022, but null EIDs reached 100% by September 2022.The shift began in August 2022.
- 99.97% of ID5 transmissions were non-null again from June 2024 onward, despite no explicit user consent.This reversal persisted through the end of the dataset.
- The reasons for ID5’s August 2022 consent requirement and June 2024 reversal are unclear.The policy change was applied uniformly across all websites regardless of location.