The advertising industry has spent years trying to work out what comes after the third-party cookie. The search has produced universal IDs, clean rooms, hashed-email solutions, contextual targeting systems and an expanding collection of privacy-focused technologies, all designed to preserve some of the targeting capabilities advertisers became accustomed to during the cookie era.
A development from IAB Tech Lab in September suggests that one of the more important answers may be much simpler: publishers already have valuable identity data of their own.
Key takeaways
- In September 2026, IAB Tech Lab finalized Open PAIR 1.1, a protocol that lets advertisers and publishers match their first-party audiences without sharing customer data.
- The new version adds a Prebid module, bringing privacy-safe matching into mainstream programmatic infrastructure.
- An authenticated, consented audience is harder to commoditize than anonymous reach. It reduces uncertainty, and uncertainty has a price.
- For publishers, the incentive shifts from pure scale to building a relationship with the visitor after they arrive.
What Open PAIR 1.1 is
On September 14, IAB Tech Lab finalized Open PAIR 1.1, the latest version of its Publisher Advertiser Identity Reconciliation protocol. PAIR is designed to allow advertisers and publishers to match their authenticated first-party audiences without either side having to disclose its underlying customer data to the other. The new version also brings the technology closer to mainstream programmatic advertising through improved integration with Prebid.
On the surface, this is an identity and privacy story. Commercially, however, it raises a more interesting question about the value of digital traffic. If advertisers can safely identify parts of a publisher's audience using their own first-party customer data, an authenticated audience may become substantially more valuable than otherwise similar anonymous inventory.
Who owns the intelligence about the user
For much of the programmatic era, publishers have sold access to users while much of the intelligence about those users has existed elsewhere in the advertising ecosystem. A publisher supplied the page and the impression, while cookies, data brokers, ad platforms and identity systems helped advertisers determine whether the person behind that impression was worth reaching.
That model worked particularly well when users could be recognized relatively easily across different websites. An advertiser did not necessarily need a deep relationship with every publisher because targeting technology could follow audiences around the open web.
First-party data changes that balance.
Two finance publishers, one market
Consider two finance publishers, each reaching roughly one million people a month in the same market. One receives most of its audience through search and social referrals. Visitors read an article, perhaps view another page and leave. The publisher may know which content was consumed and collect the usual technical and behavioral signals, but most of those users remain anonymous.
The second publisher has spent years building a registered audience. Readers have accounts, subscribe to newsletters, save articles, use financial tools and return regularly. Subject to the appropriate consent and privacy requirements, that publisher has a much clearer understanding of the people using its product.
From a basic media-buying perspective, both publishers may appear to offer similar inventory. They operate in the same vertical, reach similar markets and might even report comparable demographics and engagement.
To an advertiser with first-party customer data, however, they can be very different propositions.
PAIR is intended to make that difference usable.
How matching works without sharing data
Suppose an insurance company has a database of customers and prospects who have established a direct relationship with the company. A financial publisher has its own authenticated audience. There will inevitably be some overlap between those groups.
The advertiser would like to reach the relevant portion of its audience when those people visit the publisher, but neither company should have to hand the other its customer database to discover who matches.
Open PAIR provides a standardized mechanism for reconciling those audiences while protecting the underlying identifiers. IAB Tech Lab describes the protocol as a way for advertisers and publishers to activate their first-party data securely, using encrypted identifiers and privacy-preserving matching rather than the unrestricted exchange of personal information.
The addition of Prebid support in Open PAIR 1.1 is particularly important because it moves this from an interesting identity concept toward something publishers can use within existing programmatic infrastructure. Prebid is already deeply embedded in how open-web publishers manage and sell inventory, so interoperability reduces the amount of bespoke technology required to make first-party matching commercially useful.
Why authenticated audiences are harder to commoditize
The technical development points toward a larger economic change.
Programmatic advertising has been extremely effective at making inventory comparable. An impression can be described through a relatively standardized set of characteristics (geography, device, format, context, audience signals and price), and buyers can evaluate millions of those opportunities automatically.
That efficiency has also made large amounts of inventory interchangeable. If several publishers appear capable of reaching roughly the same audience, buyers can compare price and performance and move budgets accordingly.
A genuinely authenticated first-party audience is harder to commoditize because it comes from a relationship that belongs to the publisher.
- A specialist business publication may have executives who have maintained accounts for years.
- A financial comparison service may have users who repeatedly research mortgages or insurance products.
- A travel platform may know which registered users regularly search for particular destinations.
- A marketplace may understand the purchasing behavior of customers who return every month.
Those relationships cannot simply be recreated by buying another third-party audience segment.
What a matched audience is worth
This is where the economics become interesting.
Imagine that a publisher tells an advertiser it can reach 500,000 finance users in Germany. That is useful information, but it still leaves considerable uncertainty about exactly who those users are.
Now imagine the publisher can say that it has 200,000 authenticated finance users in Germany and, through a privacy-safe match, the advertiser knows that a meaningful portion overlaps with an audience it specifically wants to reach.
The advertiser is no longer buying only the probability that the right person will see the ad. It has a much stronger signal that the audience is relevant.
Would that inventory be worth twice as much as anonymous traffic? Three times as much? Five times?
There is not enough market evidence to support a universal multiplier, and it would be misleading to pretend otherwise. The value will vary enormously depending on the vertical, the quality of the publisher, the strength of the audience match, user consent, engagement and, ultimately, whether the campaign performs.
Authentication by itself does not make an impression valuable. A logged-in user with little commercial relevance is still a user with little commercial relevance.
What authentication can do is reduce uncertainty, and uncertainty has always had a price in advertising.
This is particularly important in performance-driven verticals. An insurance advertiser may care about whether a publisher reaches people actively researching coverage. A lender may care about users who have demonstrated interest in a particular financial product. A B2B advertiser may value a smaller authenticated professional audience far more highly than a much larger pool of anonymous visitors.
As advertisers become better at connecting their own first-party data with publisher audiences, the difference between those types of inventory becomes easier to measure.
From scale to relationships
That could have important consequences for publishers because it changes the incentive behind audience growth.
For years, digital publishing has largely rewarded scale. More visitors produced more pageviews, more pageviews created more ad impressions, and more impressions created more inventory to monetize.
There is now a stronger argument for publishers to invest in the relationship after the visitor arrives:
- Can the publisher persuade the reader to create an account?
- Is there a reason to return?
- Is the newsletter valuable enough to subscribe to?
- Does the product provide tools, saved preferences or other functionality that makes authentication worthwhile?
A publisher that succeeds at this is not simply increasing engagement. It is gradually converting anonymous traffic into an identifiable first-party audience that may have greater advertising value.
That distinction is becoming increasingly relevant as advertisers themselves accumulate more first-party data. Retailers have customer accounts and purchase histories. Banks have customers and prospects. Travel companies have loyalty programs. Subscription businesses know their members. Ecommerce businesses know who has purchased, browsed or abandoned a basket.
Those advertisers do not necessarily need another company to tell them who their valuable customers are. They already know a great deal about them. What they need is a privacy-safe way to find relevant parts of those audiences when they appear elsewhere.
That is why the next stage of identity may look less like rebuilding the third-party cookie and more like connecting direct relationships that already exist.
The limits of the model
There are limits to this model. Authentication rates differ significantly between publishers, and many websites have little reason to require users to log in. Publishers also need to offer consumers a genuine reason to identify themselves rather than creating registration barriers simply to improve advertising monetization. Privacy and consent requirements remain fundamental, and first-party data does not become exempt from regulation simply because it was collected directly.
Nor will anonymous inventory disappear. The open web contains enormous amounts of valuable context and attention that do not require an authenticated identity to be useful to advertisers.
The more likely outcome is that the market becomes better at distinguishing between different qualities of supply.
A publisher with anonymous reach is selling one product. A publisher with a direct, consented relationship with its audience can potentially sell something more precise. If the advertiser can reconcile that audience against its own first-party data and measure better results, the market has a rational basis for assigning a premium to it.
What it means for traffic marketplaces
This has implications beyond traditional programmatic advertising and is particularly relevant to traffic marketplaces.
Advertisers buying traffic have historically compared opportunities using fairly broad characteristics: vertical, GEO, source, volume, pricing model and expected performance. Those will continue to matter, but they do not tell the whole story.
Two publishers offering "finance traffic in Spain" may be selling fundamentally different things if one provides mostly anonymous visits while the other has an authenticated, returning audience with clear first-party signals.
For Traffberry, that distinction is important because a traffic marketplace becomes more useful when buyers can understand not only how much traffic is available, but what kind of relationship the publisher has with that traffic. It is the same shift we described in how conversational ads describe traffic by intent and in what AI buying agents need to evaluate supply.
As the market develops, information about authentication, first-party data, consent, audience engagement and direct publisher relationships could become increasingly relevant when advertisers evaluate media opportunities. Publishers that have invested in building real audiences should have a way to make that quality visible rather than competing with every other source purely on volume and price. On Traffberry, they can post a listing that describes their audience, and buyers can browse traffic offers by GEO, vertical and format.
Open PAIR 1.1 will not suddenly make every authenticated impression more expensive, and it will not settle the industry's identity problem by itself. What it does show is where a meaningful part of the market is heading.
The advertising industry spent years trying to reconstruct identity after the third-party cookie. Publishers, meanwhile, were building direct relationships with users all along.
Those relationships may now become one of the most valuable things they have to sell.
Sources
- IAB Tech Lab: Publisher Advertiser Identity Reconciliation (PAIR), v1.1 finalized
- IAB Tech Lab: PAIR 1.1 protocol and new Prebid module released
- IAB Tech Lab: Tech Lab releases PAIR protocol for the industry
- GitHub: PAIR protocol specification