The New Jersey Institute of Technology recently published a research paper on the behavior of extended identifiers (EIDs) within the ad tech ecosystem. We’d like to offer our interpretation of the study’s observations about ID5 and provide additional insight into our technology and what may have led to these results.
EIDs are part of OpenRTB, a standardized protocol developed by the Interactive Advertising Bureau (IAB) to create a common ad tech ecosystem language. EIDs are used by publishers as an alternative means of connecting advertisers to audiences in addition to, or in lieu of, typical IDs passed during a bid request (the exchange- and buyer-specific IDs for a given user). While publishers can use proprietary EIDs, they frequently partner with identity companies to take advantage of larger scale and integrations.
Why ID5 sends different EIDs for a single visitor to SSPs: This is by design. We encrypt our IDs for each partner we integrate with to maximize user privacy and, upon decryption, enable resolution to a pseudonymous identifier.
Why ID5 doesn’t use persistent EIDs: Not generating persistent EIDs is also for user privacy protection. When we say IDs are encrypted per partner, that includes publishers as well. A persistent ID, an ID that remains constant across websites, is trackable across domains. For example, if a company set up a crawler to listen to the bidstream, they’d be able to accurately monitor a user’s behavior across sites. By encrypting per partner and not transmitting the same EID across sites, we substantially reduce the privacy risk while still enabling partners to decrypt IDs to pseudonymous identifiers.
How ID5 handles bot detection: We have several mechanisms in place to recognize bots, and our ID generation logic evaluates several scenarios during bot classification, e.g., flagged domains or IPs. When a bot is identified, we assign it a bot-specific tag embedded in our encrypted ID. While this is not visible in bidstream EIDs, when our partners decrypt a bot-flagged ID, they know to ignore it.
Regarding NJIT’s crawler, due to our data minimization and privacy protection practices, we retain data for a maximum of 100 days before deleting or aggregating it. As a result, we can't verify whether we recognized the crawler as a bot, as the measurement period ended in 2025.
How ID5 approaches regional compliance: The researchers tested GDPR compliance by using country code top-level domains, e.g., “.fr” for France vs. “.com.” However, the researchers also note that their crawler used U.S. IPs and did not mention using a VPN to simulate traffic patterns as if they were actually coming from the countries in question. Because anyone anywhere can buy a domain with a specific country code, we do not apply compliance criteria based on domain. Instead, we geolocate traffic and apply the compliance stance that best fits the region where we believe the traffic is coming from.
Transparency is crucial to building trust in advertising, and studies like this show that third parties are willing to hold the industry accountable through data-driven research. However, as the researchers themselves note, “without decryption access, [they] cannot confirm how frequently the different transmitted EIDs resolve to the same user.” While we can’t speak for how other identity solutions operate, without a license to decrypt our ID, the researchers were limited to surface-level data.
We’re grateful that this research indicates that our solutions are operating as intended. Papers like this generate conversation about privacy standards and increase scrutiny into whether or not companies that claim to uphold user rights are actually doing so. This increases due diligence throughout the ecosystem for companies to understand what governance standards their partners have in place. This ultimately pushes the industry forward, creating a more secure, trustworthy advertising industry. We look forward to seeing more research and continuing the conversation!