User identity is usually treated as a switch that is either on or off. Either we know who the person is, or we do not – addressable or worthless.
That is the wrong mental model.
Identity in the bid request is not a switch. It is a ladder. And almost every publisher I talk to gets it wrong in one of two ways: Either they try to haul every single impression up to the top rung – by enabling twenty ID modules and hoping for the best – or they write off the bottom rungs as junk. Both approaches leave money on the table.
In part 3 I left you with a claim: A user ID is only worth what the buyer can use it for. This is the article where I prove it – with our own numbers. We climb the four rungs of identity, look at who on the buy side can actually use each one, and arrive at the part most people skip: why your own first-party data is the strongest rung of them all.
A few terms before we climb:
*Prebid builds that array for you: Each module places its ID in bidRequest.userId, and Prebid converts it to the standardized userIdAsEids → user.ext.eids, which the adapters actually read.
Think of identity as a ladder. Each rung tells the buyer a little more about who they are bidding on – and each rung is worth more than the one below it.
Visualization generated with claude.ai
Rung 0 – Anonymous. No ID at all. Users without consent, privacy browsers, first-time visitors. You are not identifying a person – you are describing the page. That is contextual targeting, and it is the floor, not the failure (more on that later). At STEP we run this traffic through our contextual data instead of flying blind.
Rung 1 – Pseudonymous. A first-party random ID – the classic is SharedID: free, run by Prebid and stored on your own domain. It does not tell the buyer who the user is, but it lets them recognize the same browser across visits (frequency capping, light retargeting). Broad scale, low precision.
Rung 2 – Graph-linked. A shared ID that works across sites – the most widespread in Europe is ID5. It is cookieless by design: It calls an API and returns an encrypted ID that a consortium of SSPs and DSPs can decrypt and match. A large share of European open exchange value sits here, precisely because so much Safari and Firefox traffic has no third-party cookie to fall back on.
Rung 3 – Known. Deterministic identity: UID2 (a consent-based token of hashed email for logged-in users), LiveRamp's RampID or your own identifiers passed via PubProvidedID. This is the premium rung – real, consenting, stable people – and it is what drives private deals.
Do not try to get every single impression up to rung 3. You cannot, and chasing it everywhere just makes your page heavier. Climb the ladder where it pays off.
Once the modules have done their work, all the rungs show up in one place – in the EIDs array:
"user": {
"ext": {
"eids": [
{ "source": "sharedid.org",
"uids": [{ "id": "f81d4fae-7dec-11d0", "atype": 1 }] },
{ "source": "id5-sync.com",
"uids": [{ "id": "ID5-Zb9s7Q...", "atype": 1, "ext": { "linkType": 2 } }] },
{ "source": "uidapi.com",
"uids": [{ "id": "Ax7Bd9f2...token", "atype": 3 }] }
]
}
}
Three rungs, one array. A DSP reads down the list and uses the best ID it recognizes; the ones it does not know, it ignores. That is the quiet elegance of the EID format – you offer several rungs at once and let each buyer take the one it can actually use.
Here is the part the identity conversation usually skips.
The strongest signal in the bid request is often not a third-party ID at all. It is the data you already own.
Every vendor on rungs 1 through 3 is effectively renting you recognition. ID5, UID2, LiveRamp – certainly useful, but you depend on their sync, their matching and their buy-side integrations. You inherit their match rate, their coverage gaps and their roadmap. And a third-party ID describes your user as someone else's data point.
Your first-party data has none of those problems. If you run a CDP or DMP – or just a disciplined client-side key-value setup – you can describe the user based on data you collected yourself, in context and with consent. Logged-in subscriber. Has read three EV reviews this week. In the market for a mortgage. You send it straight into the request:
// Publisher-ejede signaler, sendt direkte – ingen tredjepart involveret
pbjs.setConfig({
ortb2: {
user: {
data: [{
name: "stepnetwork.dk", // datakilden er *dig*
segment: [
{ id: "subscriber" },
{ id: "auto-intender" }
]
}]
}
}
});
// ...og/eller som GAM key-values til direct & PMP-demand
googletag.pubads().setTargeting("audience", ["subscriber", "auto-intender"]);
This data is more valid – you know exactly how it was collected and what consent sits behind it – and more available, because there is no match-rate loss between you and the buyer. You are not asking a DSP "do you happen to recognize this token?" You are telling it, in your own words, who this is.
Third-party IDs absolutely have their place: They give you scale and cross-site reach that your own data cannot. But for premium inventory and premium audiences, they are a supporting layer – not the foundation.
If you do not own the data, you are renting your own audience back from the people you sell to.
Different rungs belong in different sales channels – this is taken straight from part 3's playbook on conditional data sharing:
You do not broadcast your best audience data for free to the entire open market. You package it and sell it to the buyers willing to pay for it.
Every rung above 0 depends on one thing – consent.
Without it, Prebid does not store an ID and does not even send one along, and the GDPR enforcement module strips user.ext.eids from the request entirely. No Purpose 1 (storage), no Purpose 4 (personalized ads) – and the whole ladder collapses to rung 0. (The full walkthrough of consent and TCF is part 5, so I will keep it short here.)
I promised you our own numbers. Across a good 3.3 billion impressions, roughly one in five (~20%) ran in "limited ads" mode – legitimate interest, no full consent. Across all monetized demand, those impressions earn about 27% less.
But the average hides the real story. Split it by demand channel and a gradient emerges – ordered here from the demand most dependent on third-party identity to the least:
Visualization generated with claude.ai
The pure open auction – the demand leaning hardest on third-party user data – loses 60% of its value the moment consent disappears. Move down toward negotiated, relationship-based demand and the penalty shrinks quickly: PMP and header bidding around a quarter, guaranteed and sponsorships down to single-digit percentages. Preferred deals actually increase – because that demand is priced on the relationship and the context you provide, not on whether a third party can still recognize the user.*
Direct and guaranteed line items barely notice consent. They are priced on your inventory and your audience – not on a rented ID.
Consent does not just cost you ads. It costs you the most precisely where you control the least.
*That preferred deals increase rather than just holding steady is probably down to several factors, but digging into the data, it appears connected to the way our sales team works to optimize our inventory as effectively as possible.
Strip away the JSON, and here is the commercial reality:
Your consent rate and your login rate set the ceiling for how much of your inventory can climb the ladder at all. They are not a tedious compliance duty – they are an input to your revenue.
The same split shows up across browsers – and Safari is our second largest with around 38% of traffic, so this is no niche. On the pure open auction, Safari earns about 33% less than Chrome – the classic third-party cookie tax. But on header bidding, that gap collapses to roughly 13%, because the alternative IDs (rung 2) are doing exactly their job. The plumbing pays for itself.
Visualization generated with claude.ai
And the resilient money – as our own numbers show – is the money tied to data you own and route yourself: logins, a CDP/DMP, direct deals, PMPs. Renting recognition on the open market is exactly the part that collapses when the signal dries up.
Context is the floor, not the failure. Your own data is the strongest rung. Third-party IDs are the useful, rented part in the middle – and never the whole strategy.
Identity in the bid request is not a switch, it is a ladder:
Climb it where it pays off, sell each rung in the channel that values it, and remember that the rung most people underutilize is the one they already own: their first-party data. Third-party IDs rent you reach. Your own data is the relationship. And as our consent numbers show: When the signal disappears, it is the rented value that collapses first.
This is the fourth article in the nine-part series What is actually hiding in a bid request?
Let us help you get the most out of your display campaigns.
