Match Rate Is Not Reach: The Identity Metric That Has Been Lying to Your Budget

Post-privacy identity in 2026: what six years of reversals actually taught us about reaching people without a trail

Here’s the uncomfortable thing about the last six years of privacy theatre: the deadline everyone built for never arrived.

In 2020, Google promised to kill the third-party cookie in Chrome within two years. It moved that date to 2023, then to 2024, then to “sometime in 2025.” In July 2024 it said it would keep cookies but add a consent prompt. In April 2025 it dropped the prompt too. Then, on 17 October 2025, it retired ten of the Privacy Sandbox technologies it had spent six years building as the replacement — Topics, Protected Audience, Attribution Reporting, Private Aggregation, IP Protection, Related Website Sets, SDK Runtime, On-Device Personalisation, Select URL and Protected App Signals — citing, in the words of its own vice president, “low levels” of adoption.

So the thing at the centre of every conference deck since 2019 is still alive in the world’s largest browser. And your identity graph is still not doing what the vendor promised.

That’s not the story you were sold. But it’s the more useful one, because it forces a question the industry has been dodging: if the cookie didn’t die, why does reaching people keep getting harder?

Because the thing that broke was never the cookie. It was the assumption that you get to decide which browser holds the signal, which jurisdiction tolerates the lag, and which CFO signs off on a measurement story that can’t survive an audit.

The deadline that never arrived

Let’s get the sequence straight, because the sequence matters more than any single announcement.

Google announced the Privacy Sandbox in 2019. It delayed cookie deprecation repeatedly between 2020 and 2024. It abandoned the removal plan in July 2024 and abandoned the consolation prize — a standalone consent prompt for third-party cookies — in April 2025. Six months later, the Sandbox itself was dismantled: ten APIs retired, three kept, and those three survived only because they had escaped the advertising use case entirely. CHIPS for partitioned cookie storage. FedCM for federated sign-in. Private State Tokens for fraud defence. None of them helps you recognise a shopper.

What the industry read as a policy reversal was something more interesting: a platform admitting that a privacy-preserving ad stack nobody adopted isn’t a privacy standard. It’s a specification.

What actually broke, if not the cookie

Three things. None of them involve Google’s roadmap, and all of them sit outside your control.

Fraction one: the browsers you never controlled

While the industry waited on Chrome, roughly a fifth of global traffic had already been cookieless for years.

Safari has blocked third-party cookies by default since 2020. Firefox has isolated them per-site with Total Cookie Protection since 2022. Add Chrome and Edge — still permissive at 73.59% of global traffic — and the picture inverts: by StatCounter’s July 2026 figures, only 19.8% of worldwide browser traffic runs on a browser that blocks third-party cookies by default.

That number is the single most clarifying statistic in this whole debate, and it cuts against the panic narrative. The cookie didn’t die. It just stopped being universal. Which is worse for planning, because a signal that works for four-fifths of your audience is a signal you will keep building on, while quietly losing the fifth that most likely contains your highest-value customers — iPhone owners, privacy-literate buyers, the people who actually read consent banners.

And the mobile number is worse than the desktop one suggests. Every browser on iOS runs on Apple’s WebKit, so Chrome on an iPhone blocks exactly the way Safari does. StatCounter credits Safari with roughly a quarter of global mobile traffic. The real share of mobile sessions where third-party cookies fail is higher, because the app label undercounts the engine.

None of this is new. That’s the point. A fifth of your audience has been unreachable by cookie-based targeting for five years, and most campaign plans still treat that fifth as an edge case.

Fraction two: statutes that stopped being polite

For a while, privacy law was a European problem with a California footnote. Not anymore.

As of 1 January 2026, nineteen US states have comprehensive consumer privacy laws in force — that count becomes twenty if you include Florida’s narrowly scoped Digital Bill of Rights, which IAPP’s tracker and most law-firm reviews exclude as atypical. Either way, the substantive change isn’t the number. It’s that more than half the US population now sits under a state privacy regime, and the grace periods are evaporating.

Colorado and Connecticut let their cure periods expire on 1 January 2025. Minnesota’s mandatory right to cure expired on 31 January 2026. Rhode Island, effective New Year’s Day 2026, never had one.

A cure period is the difference between a warning letter and a fine. When it disappears, “we’re working on it” stops being a compliance strategy — and a vendor who calls their identifier “privacy-safe” without a documented lawful basis stops being a solution and starts being a liability. California made that concrete in July 2025 with a $1.55 million CCPA settlement against a health-information publisher whose cookie banner was found ineffective and whose opt-out requests went unhonoured.

Fraction three: the back door that led to a regulator

In December 2024, Google told advertisers that from 16 February 2025 it would no longer prohibit device fingerprinting — a technique it had banned in 2019 and described at the time as something that “subverts user choice and is wrong.”

The UK Information Commissioner’s Office did not mince words. It called the change “irresponsible,” noted that fingerprinting isn’t a fair means of tracking because users can’t easily consent to it, can’t wipe it by clearing site data, and can’t see it happening — then made the practical point that matters more than the moral one: fingerprinting falls squarely inside consent requirements under the Privacy and Electronic Communications Regulations. “Based on our understanding of how fingerprinting techniques are currently used for advertising,” the ICO wrote, “this is a high bar to meet.”

Read that again, because it quietly demolishes the most popular workaround of the last two years. The pitch was that fingerprinting replaces the cookie without the consent problem. The regulator’s answer is that fingerprinting is the consent problem, only harder to audit and therefore easier to litigate.

The 49% problem

Now the number that explains why so little changed on the surface.

Adobe has tracked cookie dependency since 2022. In its 2023 survey — 2,667 marketing and customer-experience leaders across eight countries — 75% said they still relied heavily on third-party cookies, and 45% were spending at least half their budget on cookie-based activity. More than three-quarters expected the loss of cookies to hurt their business.

By the 2024 wave — 2,841 respondents across seven countries, fielded in late February and early March — dependency had fallen to 49%. Down from 75% two years earlier. That is a genuine, substantial migration, achieved without a single cookie ever being switched off.

Two caveats, because Adobe sells a customer data platform and its research has a house interest in the answer. First, 49% still means roughly half an industry leaning on a signal that fails on a fifth of the web. Second, the migration happened on the industry’s own schedule, which is why it happened slowly and unevenly: the leaders moved, the long tail waited, and the deadline that was supposed to force the issue dissolved.

The lesson is uncomfortable for anyone selling urgency. Deadlines move. Browser defaults don’t.

Four substitutes, one clear winner

Strip away the branding and there are only four ways to reach someone without a cross-site trail. Their adoption levels differ wildly, and the differences are instructive.

First-party data: necessary, not sufficient

This is the one everybody has already done, or says they have. IAB’s State of Data 2024 — 500-plus respondents across brands, agencies and publishers, fielded with BWG Strategy between November 2023 and February 2024 — found that 71% were growing or planning to grow their first-party datasets, up from 41% two years earlier. Contact data led at 84%, followed by device, transaction, content-consumption and location data.

But first-party data has a ceiling no amount of investment raises: it only covers people who already gave you something. For most consumer brands, that’s a minority of traffic. For B2B, the numbers are bleak — independent testing of a dozen visitor-identification platforms in 2026 put person-level match rates at 5% to 20% of US traffic, with company-level identification at 30% to 65%. Vendor claims of 60% to 80% at person level are usually measuring a denominator that excludes everyone they couldn’t match.

Clean rooms: real infrastructure now

Data clean rooms have crossed from pilot to plumbing. Two separate surveys landed on the same 66% figure and they should not be conflated: IAB and BWG Strategy found in February 2024 that 66% of US data and advertising professionals had adopted clean rooms because of privacy legislation or signal loss; Skai and the Path to Purchase Institute found in 2025 that 66% of retail-media organisations use them in some capacity. Same number, different populations, different years, no overlap.

What changed more meaningfully is standardisation. IAB Tech Lab published clean-room guidance in July 2024, finalised the ADMaP attribution-matching protocol in February 2025, and finalised PAIR v1.1 — the publisher-advertiser identity reconciliation protocol Google donated — in July 2025. Interoperability standards are what turn a vendor feature into infrastructure, because they let two parties match audiences without either one owning the join.

The gap isn’t adoption. It’s coverage: fewer than half of US retail media networks — 48%, per Mars United Commerce data from Q2 2025 — actually offer clean-room capability. Retail media is the natural home for this, running on logged-in purchase data, and EMARKETER forecasts it will absorb $69.33 billion in US ad spend in 2026, up from $58.79 billion. Yet half the networks can’t host the collaboration their clients now expect.

Contextual: the quiet overperformer

Here’s where the received wisdom fails hardest.

The industry assumption for a decade was that behavioural targeting crushed contextual on performance, and that the surveillance apparatus justified the advantage. Integral Ad Science and Tobii tested it with eye tracking — 676 respondents, one advertiser (HP), the same creative placed in matching and non-matching content. The in-context ad was the first element people noticed: 0.4 seconds versus 1.0. Purchase intent rose 14%. Brand favourability rose 5%. Aided recall came in at 84% against 42%. Unaided recall was 73% against 18% — a four-fold gap.

Treat that with the scepticism it deserves. It’s a lab study from 2022, not a field experiment, with one brand in one category, published by a company whose product is contextual targeting. It doesn’t prove contextual beats behavioural in your account.

But it does prove something the industry has been unwilling to concede: relevance to the page is a real signal, not a consolation prize. And unlike behavioural data, it needs no consent banner, no match table and no clean room, because it processes the article rather than the person. That’s why it’s the cheapest of the four substitutes and the one most likely to survive the next regulatory turn.

Modelled identity: the arithmetic of the gap

The fourth route is the least glamorous and the most defensible: stop trying to identify the individual, and infer the aggregate.

Marketing mix modelling has quietly become the adult in the room. In TransUnion and EMARKETER’s September 2025 survey of 196 US brand and agency marketers, 46.9% planned to increase MMM investment over the next twelve months, and 27.6% named it the most reliable measurement methodology available — ahead of multi-touch attribution. More than half, 52%, were already running incrementality tests and experiments.

Compare that to the identity-graph story, where the headline number is always a match rate and never a lift.

Match rate is not reach

Which brings us to the metric that has done the most damage to marketing budgets in the last five years.

A match rate tells you what proportion of a record set your system can recognise. It says nothing about what share of your audience those records represent, and nothing at all about whether recognising them changed anything.

The spread is enormous, and almost all of it is denominator choice. LiveRamp itself concedes that single-identifier approaches such as cookies or hashed emails plateau around 50%. Then there’s the vendor benchmark: 99.5% on full PII with complete address data, independently scored by Comscore CustomIQ in Q1 2026 against roughly 6,000 Total Home Panels. That’s a legitimate number, and LiveRamp earned it. It also, by construction, measures how well a system recognises records it already holds full postal addresses for — the population you least needed help identifying.

The practical question is never “what’s your match rate.” It’s “what share of my total addressable audience does this reach, and what does the unreached remainder cost me.” Ask the second question and most identity pitches collapse into a much smaller, more honest claim: we help you recognise your known customers more reliably.

That’s worth paying for. It isn’t worth rebuilding your measurement architecture around.

Measurement is where the budget actually moved

The most consequential shift of the last two years didn’t happen in identity. It happened in proof.

The BCG and Google global measurement study — 3,140 respondents, 2025 — found 79% adoption for MMM, 86% for incrementality testing and 81% for attribution. Then it found that only 46% of organisations use all three together. And only 40% completely trust the measurement they have.

Read those three numbers as a system and the diagnosis writes itself. Everyone owns the tools. Almost nobody integrates them. And a majority don’t believe the output.

The validation gap

The sharpest evidence of that distrust is what teams do with the models they’ve built. Ask how many validate their MMM against a controlled test and the room goes quiet. Ask how many have ever killed a channel because a holdout said the lift wasn’t real and you’ll hear the same silence.

This is the gap that post-privacy identity was supposed to fill and didn’t, because identity was never the binding constraint. The binding constraint was causal evidence. And causal evidence is available without a single identifier: geo holdouts, matched-market tests, household-level suppression, phased rollouts. None of them need to know who anyone is.

That’s the quiet irony of the whole decade. The industry spent six years and several hundred million dollars building ways to prove the same person saw the ad and bought the thing, when a randomised holdout in three cities would have answered the question more cheaply, more credibly, and with no privacy exposure at all.

The concentration nobody budgets for

There’s a structural reason the walled gardens keep winning this argument, and it has nothing to do with technology quality.

EMARKETER’s April 2026 forecast has Meta overtaking Google in digital ad revenue for the first time — $243.46 billion against $239.54 billion globally, with Amazon third at $82.07 billion. Together the three take 62.3% of worldwide digital ad spend, and that share is projected to keep rising through 2028. The analyst explanation is blunt: first-party data, AI integration and audience reach, advantages smaller platforms and traditional media “can’t replicate in comparable cost or speed.”

Sit with that. The entire open-web identity project — clean rooms, alternative IDs, cohort APIs, modelled conversion — was an attempt to give independent publishers and advertisers parity with platforms that own the login relationship. Six years later, the platforms with consent built into the product are pulling further ahead.

If your strategy assumes identity infrastructure will close that gap, you’re betting against the forecast.

A governance checklist that survives the next reversal

Given that the roadmap has changed four times in six years, build for reversals rather than for the current one. Five things hold up regardless of what any platform announces next.

Document the lawful basis, not the label. For every identifier in your stack, write down what it is, what it’s derived from, which consent or legitimate-interest basis applies, and how a user revokes it. If a vendor can’t supply that in writing, the tool isn’t ready for a market without cure periods.

Assume the strictest browser, not the average one. Size every audience by browser capability before you commit to a reach target. A plan that only works if iOS users are addressable is a plan with a one-third hole in it.

Prefer mechanisms that process content over mechanisms that process people. Contextual and cohort approaches need no match table, no consent banner and no cross-site trail. They cost less, they break less often, and they don’t create a vendor whose business model depends on your audience being identifiable.

Make holdouts non-negotiable. Every major channel decision should carry a control group. Incrementality testing is the one discipline in this entire stack that improves with tighter privacy rather than degrading.

Treat clean rooms as infrastructure, not magic. They need match keys, minimum cohort sizes, differential privacy, retention rules and an audit trail. The IAB Tech Lab protocols exist precisely because a badly governed clean room is a data leak with better marketing.

What this means for the next twelve months

Three predictions, with the reasoning attached.

The cookie will still be alive at the end of 2026, and so will the argument about it. Nothing in Google’s behaviour since 2020 suggests a fifth attempt. What will change is that cookie-based measurement becomes progressively less trustworthy not through policy but through silent degradation: consent fatigue, ad-blocking, browser partitioning, and more of your traffic arriving on engines that already block.

Contextual and cohort strategies will absorb budget from identity vendors, not because the philosophy won, but because the economics did. When 40% of organisations don’t trust their own measurement, the tools that need the least infrastructure and the smallest leap of faith win the renewal conversation.

And clean rooms will consolidate hard. Half of retail media networks can’t offer them, standardisation has arrived, and the platforms giving them away free — Amazon opened AMC to all Sponsored Ads advertisers in September 2025 — will squeeze the independent vendors that priced them as premium middleware. Infrastructure businesses with real moats survive. Feature businesses with good decks don’t.

The takeaway

Post-privacy identity was never about finding a better tracker. It was about accepting that recognition and following are different activities, and that you can do the first without the second.

The cookie survived, which means the industry never had to learn that lesson under duress. It’s learning it anyway, more slowly and more expensively, because the pressure came from consent banners, state attorneys general and browsers rather than from a deadline. The four substitutes are all real, all useful, and all narrower than the pitch: first-party data that covers your known customers, clean rooms that let partners match without exposing, contextual signals that need no permission at all, and models that infer what you can no longer observe.

None of them follows anyone. That’s the feature, not the compromise.

The best identity graph is still the one you earned — and the trail you never needed.