An identity graph is a large database that links the devices, email addresses, phone numbers and postal addresses that belong to the same real person, across many companies and websites. Advertisers use it to recognise their own customers on other companies' websites and apps. The largest identity graphs cover most adults in the United States, and they are built and sold mainly there.
The graph is built from many sources. These include logins on news and shopping websites, loyalty programmes, magazine subscriptions, warranty cards and data bought from other companies. Each source supplies pairs, such as "this email address logged in on this phone". The graph joins the pairs into one record per person, and often one record per household. There are two ways to join them. Deterministic matching joins records only when they share an exact identifier, such as the same email address. Probabilistic matching guesses from patterns, for example two devices that use the same home internet connection every night. Deterministic matches are more accurate, but there are fewer of them.
Personal details are not sent in plain form. Before a company sends its list, it converts each email address into a hash, a scrambled code made by a one-way formula. The same email always gives the same hash, and the formula cannot be run backwards. So the graph company matches hashes, not names. But hashing does not make the data anonymous. Anyone who already has an email address can hash it and find the matching record.
Imagine a pet-supply retailer in the United States with 2 million loyalty members. It wants to show advertisements to them while they read news websites. It sends the hashed email addresses to the identity graph company. The graph matches 1.3 million of them, and links each one to that person's phone, laptop and home internet connection. When one of those devices opens a news website, the website offers its advertising space in an auction that lasts a fraction of a second. This is real-time bidding. The retailer's demand-side platform (DSP) recognises the device from the graph and bids. The member sees a pet-food offer. The same graph can find the household's smart TV, for addressable TV advertising.
Why is this mainly an American business? The United States has a long history of companies buying and selling consumer data, and has no single national privacy law as strict as India's DPDP Act. Under such laws, a company needs a clear legal basis, such as consent, to share personal data.
The same kind of data also has uses outside advertising. Risk companies use it to check whether a person is real, in synthetic identity fraud detection. Inside one company, a customer data platform does a smaller version of the same job. Safari blocks all third-party cookies by default. Firefox blocks the cookies of known tracking companies by default. It also keeps every other third-party cookie separate for each website, so the cookie cannot follow a person to other sites. Chrome, the most used browser, still allows third-party cookies, because Google decided in April 2025 to keep them. Because Safari and Firefox restrict these cookies, identity graphs now depend more on logins and email addresses.