Protecting privacy in the cookieless era — what is ID bridging and how to protect yourself

Since the beginning of the 2020s, we’ve been promised a cookieless future — one where third-party cookies, the cornerstone of surveillance tracking and the linchpin of targeted advertising, no longer exist. While Google’s plan to phase out third-party cookies may have been delayed, there is little doubt, at least in our minds, that sooner or later, we’ll all say au revoir to them.

Why? Privacy regulators around the world, particularly in the EU, are putting increasing pressure on publishers to obtain “freely given” consent from users. Multiple companies, including, more recently, the “unfiltered” social media app BeReal, have faced privacy complaints over how they nudge users into agreeing to tracking with their consent pop-ups. In other words, the definition of consent is becoming increasingly narrow, and both users and regulators are growing frustrated with intrusive pop-ups. The “pay or consent” model, where users are given a simulacre of a choice between paying for content or consenting to nearly all of their data being harvested, is also getting pushback from the regulators. For all its worth, the third-party cookie may not be on its death bed yet, but it’s sailing into the sunset.

In the long run, it seems more than likely that publishers will have to adopt new methods of tracking — ones that both satisfy regulators (ensuring consent is freely given) and feel fair to users, who are tired of navigating the quagmire of dark patterns.

Using hashed email address to track — the reality of tomorrow

One of such methods that has been mentioned as one of the most likely alternatives to the cookie is identification through Persistent User ID. True to its name, this method presumes that there is one or a combination of persistent or long-lasting characteristics specific to one user. While cookies have a limited lifespan, are specific to one browser, and can be cleared anytime (research shows that 58% users delete their cookies regularly, and 40% do so every month), persistent identifiers like hashed email addresses do not have any of these drawbacks. Also, unlike cookies, you can’t track someone’s email address without them first giving it to you. From a regulatory standpoint, this is safer for advertisers, as the user’s consent is clearly given, reducing the risk of privacy-related issues. So, what is hashing exactly?

Email hashing involves transforming a user’s email address into a fixed-length string of characters (a hash) that in theory should be borderline impossible to reverse-engineer. Unlike traditional email addresses, the hashed version of an email cannot be read or understood by anyone who does not have access to the specific algorithm and secret keys used for hashing. This makes it more secure and private than if the email addresses were passed around in plain text.

However, hashing, while providing a layer of obfuscation, does not necessarily make user data fully anonymous or protect privacy as securely as it might seem. This is because hashing still creates a unique signature that can be used to identify individuals across platforms. As the Federal Trade Commission (FTC) pointed out in a 2024 statement, “hashes aren’t ‘anonymous’ and can still be used to identify users,” which means they should not be considered a foolproof method for preserving privacy.

The FTC has repeatedly pointed out that while hashing makes data harder to read, it doesn’t remove the possibility of linking it back to a specific person. Even when email addresses are hashed to hide the original data, the resulting hash is still a unique, persistent identifier. While the hash might look like a random string to most people, it can often be matched with other datasets or reversed, especially if the same hashing method and data are used consistently. Past data breaches make this easier for bad actors. With so many stolen datasets from big breaches floating around online, hackers can use these records to figure out or match hashed emails with the real people behind them, exposing sensitive information and identities.

ID Bridging

The use of hashed email addresses for user tracking can also play a significant role in what’s known as “ID bridging.” ID bridging refers to the practice of linking a user’s activity across multiple platforms or devices by using a persistent identifier like a hashed email address.

Its rise in popularity is directly related to the looming deprecation of cookies. While the third-party cookies are currently in limbo, their eventual demise still seems imminent, largely due to regulatory pressure.

There are two primary methods of ID bridging: deterministic and probabilistic matching. Probabilistic matching involves using complex algorithms to analyze signals like IP addresses, device types, and browsing behavior. While this method can link profiles based on patterns, it is less precise as it relies on statistical inference rather than direct identifiers. On the other hand, deterministic matching, which is often based on hashed emails, offers a more accurate method of identification. For the purpose of this article, we are focusing on email-based identification, but other data — such as mobile numbers and key demographic details — can also be used for deterministic matching. Deterministic matching techniques are especially effective for targeted advertising since they are highly accurate (usually above 80% accurate). But precisely because deterministic matching shows such high effectiveness in merging distinct data of one user across multiple online services, it raises privacy concerns, especially since the user is likely unaware of the full extent of this tracking. How ethical or permissible this method is from the privacy standpoint is a question for a separate debate.

Bottom line, this method ensures that the user’s activity can be accurately linked across different platforms, provided the user logs in on multiple browsers or devices.

Protecting yourself against privacy risks associated with ID bridging

There are several ways to help protect your personal information from being linked across platforms using this new tracking method, which is probably the future of tracking if not the present.

• The most straightforward and at the same time time-consuming way would be to create separate email accounts for different purposes, such as using one for shopping, another for social media, and yet another for newsletters. For instance, you might have three distinct inboxes (or more) — one for personal use, one for work, and one for online sign-ups.

• There are arguably simpler, ready-made solutions, however. One of them is using an email alias service. The email alias service allows you to create unique email addresses without needing to create entirely new accounts. Put simply, an alias is a forwarding email address that acts as a proxy for your real inbox. For instance, you could use a separate alias for each online store, newsletter, or app. If you no longer wish to receive a specific newsletter or start getting spam from an alias, you can easily disable or delete the alias. Doing so will not affect any emails you’ve already received through it. Addy.io, SimpleLogin are some of the most popular alias service providers on the market.

• Alternatively, you can use a temporary mail account. This is ideal for one-time interactions, like signing for promotions, downloading free trials, or taking part in online giveaways. A temp mail service generates a temporary inbox along with a unique email address, which lasts only as long as you need it. Unlike an alias, which forwards emails to your real inbox, a temp mail is entirely separate and does not connect to your personal email. Once the temp mail has served its purpose, you can delete the address, which will lead to the deletion of the temp mail inbox with all the mail sent to it. That means that unless you’ve saved your mail elsewhere, you will lose all your correspondence. However, it also ensures a higher level of anonymity and privacy for brief online interactions. Services like Guerrilla Mail, 10 Minute Mail are some of the examples of such services.

AdGuard now offers such a solution within our new AdGuard Mail email management tool. Unlike most mail services on the market, AdGuard Mail is a one-in-two solution, combining the functionality of email aliases and temporary email addresses for maximum convenience and flexibility.