A marketing team may need to understand customer behavior without exposing each customer’s data. Privacy-enhancing technologies (PETs) are methods that make useful analysis possible while reducing how much personal information is collected, shared, or identifiable. The right method depends on the data, the intended insight, and who needs access. section 2.2.2 section 2.3.3
Common approaches protect data in different ways:
- Anonymization removes identifiers; k-anonymity groups records so each is indistinguishable from at least k − 1 others. Pseudonymization replaces identifying information with pseudonyms while retaining a basis for analysis. section 2.2.2
- Differential privacy adds statistical noise to support aggregate trend analysis while protecting individuals. section 2.3.3
- Federated learning trains models using data held on devices rather than centralizing raw data; model updates are shared instead. section 2.3.3
- Homomorphic encryption permits computation on encrypted data. Specific operations are advancing, but full-scale encrypted analysis is not yet mainstream. section 2.3.3
- Secure multiparty computation allows parties to analyze data together without revealing their respective inputs. section 2.3.3
PETs can serve different points in a marketing data journey. Federated learning and differential privacy can be layered for model training and aggregate insights; differential privacy can also support campaign testing. Anonymization, aggregation, and encryption can reduce risks when sharing data with partners. These choices complement—not replace—data minimization, consent, transparent controls, and governance. section 2.3.3 section 2.3.4 section 2.3.5 section 2.2.2
Measuring a campaign across channels
A retailer brings website, app, and connected-TV data into a data clean room. It hashes or protects identifiers before matching records, then analyzes the combined data to see how ad exposure and later activity contributed to purchases. The result can guide spending without sharing raw identifiers across parties. section 8.4
Table 8.5 Key limitations that clean rooms present for measurement
| Key limitations |
Explanation |
| Restricted external data |
Platforms like Google Ads and Facebook often limit impression-level data for privacy. |
| Technical complexity |
Requires hashing, encryption, and sometimes advanced match logic (deterministic/probabilistic). |
| Integration overhead |
Setting up secure data pipelines and ensuring consistent identifiers can be resource-intensive. |
Clean-room measurement illustrates an important trade-off: privacy-preserving matching can require complex identifiers, secure pipelines, and integration work. section 8.4
