Question 1

What does “identity management” mean in privacy compliance?

Accepted Answer

In privacy compliance, identity management means being able to recognize when different devices, apps, or data records relate to the same person — and using that capability to honor their rights.

If your organization can link a consumer’s phone, browser, app usage, or account information for advertising or analytics, regulators expect you to use that same linkage to enforce opt-outs. Identity management ensures that a single consumer request applies everywhere it should — not just in one browser or one system.

Question 2

Why is identity becoming more important under U.S. state privacy laws?

Accepted Answer

U.S. consumer privacy regulators, especially in California, are signaling that when a business uses personal data across devices, apps, or brands for revenue, opt-outs must be honored across those same contexts.

If a business can associate devices and profiles to drive advertising revenue, it must use that same capability to honor consumer opt-out rights. Opt-outs that only apply at the browser level, or only within one brand or app, can create compliance risk if data continues to be sold or shared elsewhere.

Privacy is no longer just about collecting a request. It’s about enforcing it consistently across your data ecosystem.

Question 3

Does identity management only apply when a user is logged in?

Accepted Answer

No. The expectation is based on your capability, not whether the consumer happens to be logged in at the moment. If you have the technical ability to associate a logged-out device with a known profile, that linkage must be used to honor opt-outs across contexts.
‍
If identity is used for advertising across states (logged in and logged out), it must be used for suppression across those same states.

If identity is used for advertising across states (logged in and logged out), it must be used for suppression across those same states.

Question 4

Do I need identity management if I already honor Global Privacy Control (GPC)?

Accepted Answer

Yes. GPC is an intake signal. It tells you a consumer wants to opt out. What matters legally is what happens next.

If GPC only stops activity in a single browser, but does not propagate across mobile apps, connected devices, internal systems, or third-party partners, the consumer’s right has not been fully effectuated. Identity management ensures that an opt-out signal follows the person, not just the browser.

Question 5

Isn’t blocking tags in our CMP enough?

Accepted Answer

No. Blocking scripts only stops future data collection in that environment. It does not address data already shared with third parties, and it does not notify partners to stop selling or sharing the consumer’s information.

State privacy laws require businesses to notify relevant third parties after a consumer opts out and direct them to comply. That requires direct signaling and integration, not just tag suppression.

Privacy laws are not cookie-blocking laws. They are sale and share control laws.

Question 6

If I deploy a “Do Not Sell” request through my CMP, am I covered?

Accepted Answer

Not necessarily. A consumer’s data typically exists in two forms: data tied to device identifiers and data tied to known identifiers like email or account ID. If you rely only on a CMP, you may suppress device-level activity but miss known data in backend systems. If you rely only on a webform, you may target known data but miss device-level activity.
‍
To fully effectuate a request, both types of data must be addressed in a coordinated way. That requires an identity layer connecting intake, enforcement, and downstream systems.

To fully effectuate a request, both types of data must be addressed in a coordinated way. That requires an identity layer connecting intake, enforcement, and downstream systems.

Question 7

How does Ketch establish identity across devices?

Accepted Answer

Ketch builds identity context using deterministic linkages. These are confirmed connections such as account IDs, hashed emails, device identifiers, or other persistent identifiers.

When an authentication event or trusted linkage occurs, Ketch stores that deterministic relationship and uses it to propagate privacy choices across devices and environments. There is no guessing involved.

Question 8

What is “deterministic” identity?

Accepted Answer

Deterministic identity refers to confirmed, high-confidence linkages between identifiers. For example, a specific device tied to a specific account.

Ketch does not rely on probabilistic matching to honor consumer rights. If a confirmed linkage exists, we use it. If a customer provides additional identity data from partners or internal systems, we can incorporate that as well.

Question 9

Does Ketch rely on probabilistic matching?

Accepted Answer

No. Ketch’s enforcement logic is deterministic. If customers choose to ingest probabilistic identity data from their partners, we can support that input — but our system does not depend on probabilistic inference to effectuate opt-outs, nor do we recommend it. For example, probabilistic matching may result in effectuating an opt-out across more data than is necessary. For privacy rights, accuracy and confirmed linkage matter.

Question 10

Can we use our existing identity provider or graph?

Accepted Answer

Yes. Ketch can ingest identity linkages from your existing identity partners or internal graph, including providers such as LiveRamp, Lotame, Epsilon, clean rooms, retail media networks, or your own systems. We work with the identity capabilities you already have and ensure they are applied consistently for privacy enforcement.

Question 11

Do we need a large amount of logged-in traffic for this to work?

Accepted Answer

No. Even a single authentication event can establish durable linkages between devices and profiles. Many organizations also maintain identity relationships through partners or backend systems.

The regulatory obligation is not about volume. It is about capability. If you have the ability to associate identities, you are expected to use that ability to honor rights.

Question 12

We’re not a streaming company. Do we need identity management?

Accepted Answer

Any organization that operates across web, mobile apps, connected devices, or digital advertising platforms may already be recognizing consumers across those touchpoints. Regulators expect that the same connections used for advertising are also used to enforce opt-outs, no matter the industry.

Question 13

Do other privacy vendors offer identity management?

Accepted Answer

Many privacy vendors focus on collecting requests or managing consent at the browser level. Where they often fall short is in connecting that intake to a persistent, cross-device identity layer.

Consent is often stored in two separate places: in a database when a user is logged in, and in the browser when they are not. If those two states are not unified, opt-outs may only apply in the context where they were submitted. That can leave gaps across devices, apps, brands, or downstream advertising partners.

As a result, businesses frequently have to build their own identity logic to bridge intake, CMP behavior, backend systems, and partner signaling. Without that additional engineering, enforcement can become fragmented.

Ketch was built to unify identity linkage, opt-out propagation, and third-party signaling by design — reducing the risk of partial suppression across environments.

OneTrust has identity management: No. Customers like Disney, Paramount, and WB had to build their own identity logic on top of OneTrust to support cross-device and failed miserably. It was not native capability.

If it were turnkey, it wouldn’t have required custom engineering — and it wouldn’t be a headline issue. We have former OneTrust engineers that work at Ketch can also confirm, OneTrust does not support cross-device.

Transcend has identity management: No. Transcend stores consent at the account level when a user is logged in. When a user is logged out, consent is stored ONLY in the browser.

Their architecture does not propagate consent from known IDs to anonymous devices unless the user authenticates. Ketch stores deterministic linkages and can propagate across states — logged in or not.

Question 14

Why should I choose Ketch for identity management?

Accepted Answer

Ketch treats privacy as a unified identity and data control plane; not just a banner, form, or workflow tool.

We connect intake, identity resolution, suppression, and partner notification so that a single consumer request can apply across known and device-level data, across brands and apps, and across downstream third parties.

For legal and privacy leaders, that means greater confidence that opt-outs are being fully effectuated — not partially applied.

Cross-device and cross-browser compliance

The importance of unified identity management

Achieve cross-platform compliance with Ketch

Build the identity graph for each consumer

Propagate choices across every device and browser

Enforce consumer choices wherever their data lives

Case in point: identity is the foundation of real privacy

When identity signals conflict, lack of resolution is a compliance failure

Product features

Unified identity graph

Cross-device consent synchronization

Seamless integration with martech & adtech

Real-time data synchronization

Identity resolution across anonymous and authenticated states

Comprehensive Audit Trails & Reporting

Manage identifiers intelligently with Ketch

Power privacy enforcement with real-time identity synchronization

Define, prioritize, and unify identifiers your way

The latest in privacy compliance and more

Ketch Data Permissioning for Media Companies

Disney CCPA Settlement: A Technical Compliance Guide for Privacy Leaders (2026)

Identity Management FAQs

Ready to simplify your privacy compliance?
Get started.