Back to Blog
PPID Explained: Publisher-Provided IDs After Cookies
The Aditude Team
A PPID (publisher-provided identifier) is a user ID that a publisher creates, hashes and passes to Google Ad Manager 360. It lets the publisher run frequency capping, audience segments and sequential ad rotation on its own first-party data, including where third-party cookies or device IDs are unavailable. It must never contain raw personal data.
Third-party cookies are already blocked in Safari and Firefox, and mobile device IDs now depend on user consent. For publishers, that means a shrinking share of traffic carries an identifier buyers can recognize. A PPID is one of the most direct ways to put your own first-party relationship to work inside Google Ad Manager. This guide covers what a PPID is, what it unlocks, the rules, and how to set one up.
What is a PPID in Google Ad Manager?
A PPID is an identifier that you, the publisher, assign to a user and send with ad requests to Google Ad Manager. It usually comes from a login, subscription or account system. Before it leaves your servers, it is hashed or encrypted so that the value means nothing to Google on its own.
PPID is a Google Ad Manager 360 feature. It may not be switched on for your network by default, so check with your Google account manager before you build anything.
The key difference from a cookie is ownership. A third-party cookie is set by someone else and blocked by many browsers. A PPID is yours. You decide when it is created, how it is generated and when it changes.
What can publishers do with a PPID?
A PPID gives Ad Manager a stable way to recognize the same reader across visits and devices. According to Google's documentation, that supports:
Frequency capping. Stop showing the same ad to the same person ten times, which protects both user experience and advertiser value.
Audience segmentation and targeting. Build first-party audience segments and sell them to direct and programmatic buyers.
Sequential ad rotation. Tell a story across several creatives in a set order.
Cross-device delivery. A logged-in reader on phone and laptop can be treated as one person.
Coverage where other IDs are missing. PPIDs can be used in server-side requests and in environments without cookies or device IDs.
The practical result is better targeting on inventory that would otherwise look anonymous to buyers, which tends to support higher CPMs on that inventory.
Deterministic vs. probabilistic IDs: where does a PPID fit?
A PPID is a deterministic identifier. It is tied to a known event, usually a login, so when two requests share a PPID you know they come from the same account.
Probabilistic identity works the other way. It estimates that two requests probably belong to the same person based on signals such as IP address, device type and browsing patterns. It can reach more users, but it is less accurate and draws more scrutiny under privacy rules.
Identifier | Who creates it | Deterministic or probabilistic | Works without third-party cookies? | Main use |
Third-party cookie | Ad tech vendor | Deterministic per browser | No | Cross-site tracking and targeting |
PPID | Publisher | Deterministic | Yes | Frequency capping and first-party audiences in Google Ad Manager |
Prebid user ID module (for example UID2) | Identity provider, often from hashed email | Deterministic | Yes | Passing an addressable ID to header bidding demand |
Contextual signals | Publisher page content | Neither (no user ID) | Yes | Targeting by page topic, not by person |
Most publishers will use a mix. A PPID covers Google Ad Manager. User ID modules cover header bidding partners. Contextual signals cover readers who are not logged in.
What are the rules for a PPID?
Google's rules come down to one principle: the PPID must identify a user to you, and only to you. In practice:
Hash or encrypt it. Never send a raw email address, name, phone number or account number. The value must be meaningless to Google.
Keep it within length limits. Google recommends a maximum of 150 alphanumeric characters for the web tag.
Keep generation stable. If you change how PPIDs are generated, every user looks new and frequency caps and audience segments reset. Pick a method and stick with it.
Respect consent. Only set a PPID for users whose consent status allows it in their region.
Support deletion. Google accepts PPID deletion requests aligned with the IAB Tech Lab data deletion framework, so build a path to honor user deletion requests.
Some third-party guides list stricter requirements, such as a minimum length. Confirm any rule not in Google's own help pages with your account manager before you build to it.
How do you implement a PPID?
Implementation has three parts: create the ID, set it on every ad request, and turn the feature on in Ad Manager.
Create the ID. On login, generate a value from your user record, for example a salted SHA-256 hash of an internal account ID. Store it with the user session.
Set it on ad requests. Each environment has its own method:
Web: Google Publisher Tag, before the first ad request.
Apps: the Google Mobile Ads SDK for iOS and Android.
Video: the IMA SDK.
Enable and verify. Confirm PPID is active on your network, then check ad requests to make sure the value is present and stable across page views.
A minimal web example:
googletag.cmd.push(function () {
// hashedUserId comes from your server, never a raw email
googletag.pubads().setPublisherProvidedId(hashedUserId);
googletag.enableServices();
});
Set the PPID before enableServices() so it rides on the first request of the page.
How does a PPID work with Prebid and other identity solutions?
A PPID is a Google Ad Manager signal. It does not automatically reach the demand partners bidding through Prebid. To make logged-in users addressable in header bidding, you also need to pass an identifier through Prebid's user ID modules or first-party data configuration.
The two work side by side. The same login event that creates your PPID can feed a Prebid user ID module, so Google demand and header bidding demand both see a recognizable audience. Running that through Prebid Server or a managed wrapper like Cloud Wrapper keeps the configuration in one place instead of spread across page code. For the setup basics, see our Prebid.js guide.
What are the limits of a PPID?
It only covers logged-in or known users. Anonymous readers still need contextual or other signals.
Some reports do not support it. Google notes that PPID is not supported in Ad Manager reach reporting or conversion tracking.
Inactive IDs can expire. Google may remove PPIDs after periods of inactivity.
It is Google-only. Other buyers do not see it unless you pass an ID through another channel.
Frequently asked questions
Is a PPID personal data under GDPR?
A hashed PPID is still likely to count as personal data under GDPR, because you can link it back to a person. Treat it as personal data: process it only with a valid legal basis, honor consent signals, and support deletion requests. Confirm your approach with your legal team.
Do I need Ad Manager 360 to use PPID?
Yes. PPID is a Google Ad Manager 360 feature and may need to be enabled by your account manager.
What happens to my PPID if a user logs out?
Stop sending it. Without a login, you no longer have a deterministic link to that user, so requests should fall back to whatever consented signals remain.
Can I use the same PPID across web and app?
Yes, if both sign in to the same account system and generate the PPID the same way. That is what enables cross-device frequency capping.
A PPID (publisher-provided identifier) is a user ID that a publisher creates, hashes and passes to Google Ad Manager 360. It lets the publisher run frequency capping, audience segments and sequential ad rotation on its own first-party data, including where third-party cookies or device IDs are unavailable. It must never contain raw personal data.
Third-party cookies are already blocked in Safari and Firefox, and mobile device IDs now depend on user consent. For publishers, that means a shrinking share of traffic carries an identifier buyers can recognize. A PPID is one of the most direct ways to put your own first-party relationship to work inside Google Ad Manager. This guide covers what a PPID is, what it unlocks, the rules, and how to set one up.
What is a PPID in Google Ad Manager?
A PPID is an identifier that you, the publisher, assign to a user and send with ad requests to Google Ad Manager. It usually comes from a login, subscription or account system. Before it leaves your servers, it is hashed or encrypted so that the value means nothing to Google on its own.
PPID is a Google Ad Manager 360 feature. It may not be switched on for your network by default, so check with your Google account manager before you build anything.
The key difference from a cookie is ownership. A third-party cookie is set by someone else and blocked by many browsers. A PPID is yours. You decide when it is created, how it is generated and when it changes.
What can publishers do with a PPID?
A PPID gives Ad Manager a stable way to recognize the same reader across visits and devices. According to Google's documentation, that supports:
Frequency capping. Stop showing the same ad to the same person ten times, which protects both user experience and advertiser value.
Audience segmentation and targeting. Build first-party audience segments and sell them to direct and programmatic buyers.
Sequential ad rotation. Tell a story across several creatives in a set order.
Cross-device delivery. A logged-in reader on phone and laptop can be treated as one person.
Coverage where other IDs are missing. PPIDs can be used in server-side requests and in environments without cookies or device IDs.
The practical result is better targeting on inventory that would otherwise look anonymous to buyers, which tends to support higher CPMs on that inventory.
Deterministic vs. probabilistic IDs: where does a PPID fit?
A PPID is a deterministic identifier. It is tied to a known event, usually a login, so when two requests share a PPID you know they come from the same account.
Probabilistic identity works the other way. It estimates that two requests probably belong to the same person based on signals such as IP address, device type and browsing patterns. It can reach more users, but it is less accurate and draws more scrutiny under privacy rules.
Identifier | Who creates it | Deterministic or probabilistic | Works without third-party cookies? | Main use |
Third-party cookie | Ad tech vendor | Deterministic per browser | No | Cross-site tracking and targeting |
PPID | Publisher | Deterministic | Yes | Frequency capping and first-party audiences in Google Ad Manager |
Prebid user ID module (for example UID2) | Identity provider, often from hashed email | Deterministic | Yes | Passing an addressable ID to header bidding demand |
Contextual signals | Publisher page content | Neither (no user ID) | Yes | Targeting by page topic, not by person |
Most publishers will use a mix. A PPID covers Google Ad Manager. User ID modules cover header bidding partners. Contextual signals cover readers who are not logged in.
What are the rules for a PPID?
Google's rules come down to one principle: the PPID must identify a user to you, and only to you. In practice:
Hash or encrypt it. Never send a raw email address, name, phone number or account number. The value must be meaningless to Google.
Keep it within length limits. Google recommends a maximum of 150 alphanumeric characters for the web tag.
Keep generation stable. If you change how PPIDs are generated, every user looks new and frequency caps and audience segments reset. Pick a method and stick with it.
Respect consent. Only set a PPID for users whose consent status allows it in their region.
Support deletion. Google accepts PPID deletion requests aligned with the IAB Tech Lab data deletion framework, so build a path to honor user deletion requests.
Some third-party guides list stricter requirements, such as a minimum length. Confirm any rule not in Google's own help pages with your account manager before you build to it.
How do you implement a PPID?
Implementation has three parts: create the ID, set it on every ad request, and turn the feature on in Ad Manager.
Create the ID. On login, generate a value from your user record, for example a salted SHA-256 hash of an internal account ID. Store it with the user session.
Set it on ad requests. Each environment has its own method:
Web: Google Publisher Tag, before the first ad request.
Apps: the Google Mobile Ads SDK for iOS and Android.
Video: the IMA SDK.
Enable and verify. Confirm PPID is active on your network, then check ad requests to make sure the value is present and stable across page views.
A minimal web example:
googletag.cmd.push(function () {
// hashedUserId comes from your server, never a raw email
googletag.pubads().setPublisherProvidedId(hashedUserId);
googletag.enableServices();
});
Set the PPID before enableServices() so it rides on the first request of the page.
How does a PPID work with Prebid and other identity solutions?
A PPID is a Google Ad Manager signal. It does not automatically reach the demand partners bidding through Prebid. To make logged-in users addressable in header bidding, you also need to pass an identifier through Prebid's user ID modules or first-party data configuration.
The two work side by side. The same login event that creates your PPID can feed a Prebid user ID module, so Google demand and header bidding demand both see a recognizable audience. Running that through Prebid Server or a managed wrapper like Cloud Wrapper keeps the configuration in one place instead of spread across page code. For the setup basics, see our Prebid.js guide.
What are the limits of a PPID?
It only covers logged-in or known users. Anonymous readers still need contextual or other signals.
Some reports do not support it. Google notes that PPID is not supported in Ad Manager reach reporting or conversion tracking.
Inactive IDs can expire. Google may remove PPIDs after periods of inactivity.
It is Google-only. Other buyers do not see it unless you pass an ID through another channel.
Frequently asked questions
Is a PPID personal data under GDPR?
A hashed PPID is still likely to count as personal data under GDPR, because you can link it back to a person. Treat it as personal data: process it only with a valid legal basis, honor consent signals, and support deletion requests. Confirm your approach with your legal team.
Do I need Ad Manager 360 to use PPID?
Yes. PPID is a Google Ad Manager 360 feature and may need to be enabled by your account manager.
What happens to my PPID if a user logs out?
Stop sending it. Without a login, you no longer have a deterministic link to that user, so requests should fall back to whatever consented signals remain.
Can I use the same PPID across web and app?
Yes, if both sign in to the same account system and generate the PPID the same way. That is what enables cross-device frequency capping.
