A data clean room is a sealed computing environment in which two companies match their customer lists, and each learns only agreed totals, such as how many customers they share, never the other's names. It is used mostly in advertising, when a brand and an advertising platform want to combine what they know without handing over personal data.
Why is it needed? A brand knows who its customers are. A large website, app or marketplace knows who its shoppers are and what they see. Combining the two would help both. But giving away a customer list breaks the customer's trust, and often the law. Under India's DPDP Act, a company may use personal data only for the purpose the person agreed to. This rule applies from 13 May 2027.
A clean room solves this with rules that both companies sign up to. Each company uploads its list, with phone numbers or email addresses converted into hashes, scrambled codes made by a one-way formula. The clean room matches the hashes inside a protected environment. Neither company can download the other's rows. Each may run only queries that both have approved in advance. The answers are totals, not lists. And a total is shown only if it covers enough people, for example at least 100, so that no single person can be picked out. Some clean rooms also use confidential computing, in which even the cloud provider cannot read the data while it is being processed.
Consider a baby-care brand that sells nappies and lotions on its own website, and also on a large online marketplace. It has 3 lakh customers from its website. It wants to know how many of them also shop on the marketplace, and whether advertising to them there would bring more sales. Both companies upload hashed phone numbers to a clean room. The clean room reports one number: 1.1 lakh people are on both lists. The marketplace then shows the brand's advertisement to those 1.1 lakh shoppers. The marketplace learns only that they are on the brand's list, nothing more. After four weeks, the clean room reports that 9,000 of them bought the brand's products on the marketplace. The brand never sees a single name.
Clean rooms became important for two reasons. First, privacy laws have tightened. Second, two major browsers restrict the third-party cookie, which joins a person's identities across websites. Safari blocks all third-party cookies by default. Firefox blocks the cookies of known tracking companies by default. It also keeps every other third-party cookie separate for each website, so the cookie cannot follow a person to other sites. Chrome, the most used browser in India, still allows third-party cookies, because Google decided in April 2025 to keep them. Clean rooms are the privacy-era version of data onboarding. Advertisers use them with their demand-side platform, and drug makers use them in healthcare advertising to measure advertisements without seeing anyone's health records.