One consumer, four devices, three identifiers, zero idea they’ve been stitched together. That is identity resolution at work, and regulators have stopped treating it as a technical footnote. If your agency or brand runs cross-device measurement, retargeting or creator attribution, the law now cares about the graph behind the dashboard. This checklist shows what to verify before your next flight.
Why regulators care about the graph, not the cookie
Cross-device tools link phones, tablets, laptops and connected TVs to one person. Some do it deterministically, through a login or hashed email. Others do it probabilistically, using IP addresses, timing and behavior patterns. Either way, you are building a profile that follows someone across contexts.
The FTC saw this early. Its staff report on cross-device tracking acknowledged that tracking often happens without consumers’ knowledge and that people have limited ways to control it. It urged companies to disclose tracking truthfully, offer choices, get affirmative express consent for sensitive topics and precise geolocation, and keep reasonable security.
That is guidance, not statute. But it is the baseline a regulator will hold up when something goes wrong, and the newer rules are sharper.
Opt-out rights attach to the person, not the browser. If your identity vendor honors a signal on one device and ignores it on the other three, you have a compliance gap, not a technical limitation.
The three legal regimes that bite hardest
EU and UK: consent for the device, then lawful basis for the profile
In the UK, PECR applies to any technology that stores or accesses information on a user’s device. The ICO lists cookies, tracking pixels, link decoration, web storage, fingerprinting, and scripts and tags. It also says the rules cover mobile apps and connected devices, and that UK GDPR applies on top where the data is personal.
Read that list again. Fingerprinting, a common probabilistic input, sits in the same bucket as cookies. “We don’t use cookies” is not a defense.
France’s CNIL has gone further on cross-device specifics. According to a Sheppard Mullin summary of the updated CNIL recommendations, multi-device consent applies narrowly to logged-in users. The choice a user makes on one device can carry to another only when they are logged in. Consent and opt-out must both be cross-device, and users must be told up front that their choice will travel with them.
California: signals and the whole technology stack
California is where the operational pressure is highest. California is where the operational pressure is highest, and the state’s privacy agency has moved toward formal rulemaking on opt-out preference signals, with Global Privacy Control (GPC) as the lead example. Staff also expect guidance on whether cookie IDs, IP addresses, device identifiers and browser identifiers should be associated for opt-out purposes.
That last point is the identity resolution question in regulatory form. If your vendor links those identifiers into one profile, a GPC signal arriving on one of them may need to suppress the lot.
The same advisory reports that California’s Opt Me Out Act (AB 566) will require browsers to offer GPC functionality beginning January 1, 2027. Expect far more signals hitting your stack, not fewer.
The cross-device tool compliance checklist
Use this in vendor diligence and again at every renewal. Treat any “we’ll get back to you” as a red flag.
- Map the match method. Ask whether the vendor uses deterministic matching, probabilistic matching or both. Get the identifier list in writing: hashed emails, IPs, device IDs, fingerprint signals. You cannot assess lawful basis for data you cannot name.
- Confirm consent capture at the source. Who collects consent, on which property, and what does the notice say about linking devices? If the vendor relies on a publisher’s consent string, ask how it is verified.
- Test signal propagation. Send a GPC signal from one browser and check whether the linked profile is suppressed across devices. California enforcers have signaled that businesses must verify their implementations work in practice, so run the test yourself and keep the evidence.
- Check signal timing. Per the same advisory, researchers flagged cases where advertising and analytics tags load before consent tools. Audit your tag firing order.
- Demand symmetrical opt-out. If opting in is one click, opting out must be as easy and must apply across every linked device.
- Treat sensitive categories as a hard stop. The FTC report calls for affirmative express consent for sensitive topics and precise geolocation. Exclude health, financial and children’s segments from graph-based targeting unless consent is documented.
- Verify data broker status. Many identity providers are registered data brokers. Confirm registration and ask how they handle deletion requests.
- Review security and retention. A graph is a concentrated cache of linked data. Ask about encryption, access controls and deletion schedules.
Your vendor’s status is your risk
Data brokers face real operational changes. California is also tightening the rules for data brokers, with new deletion-request processing duties and independent audit requirements on the way. The cost and compliance burden will land on your vendors first, then show up in your contract pricing or your service levels.
Add contract language that makes the vendor responsible for honoring deletion and opt-out requests within a fixed window, and gives you audit rights. Build in notice of any regulatory inquiry. For a broader vendor framework, see our guide to media vendor diligence.
Multistate enforcement raises the stakes. The advisory says California is coordinating investigations with Colorado and Connecticut, so a single weak implementation can attract attention in several places at once.
What this means for creator and influencer programs
Why does this matter if you mostly buy creator content? Because the data trail follows the campaign. Creator links, discount codes, pixels and whitelisted ads all feed identity graphs. A creator’s audience may be matched to ad profiles, then used for lookalike targeting, then pulled into attribution reports.
Three places to look:
- Attribution. Cross-device attribution can inflate or misassign credit, which is why attribution abuse controls belong in the same review.
- Retention. Keep performance records long enough to defend your results, but no longer than your privacy notice promises. Our piece on performance data retention covers the balance.
- Cross-border flows. If graph data moves between regions, check the transfer mechanism. We cover the mechanics in GDPR transfer rules.
Minors deserve a separate flag. If any campaign content or sourcing involves under-18 audiences or creators, review minor consent gaps before you let a graph touch the data.
Where teams usually slip
Most failures are boring. A consent banner updated on the website but not in the app. A suppression list that lives in the CRM but never reaches the demand-side platform. A vendor deck that says “privacy-first” with no technical documentation behind it.
Assign one named owner for signal handling. Document the test results. Re-test after any tag, vendor or CMP change. That paper trail is what lets you say, credibly, that you looked.
This article is general information for marketers, not legal advice. Have counsel review your specific data flows.
This week, pick your highest-spend cross-device vendor, send a GPC signal through a test browser, and check whether the linked profile actually gets suppressed. Save the result in your compliance file.
FAQs
What is identity resolution in marketing?
Identity resolution is the process of linking identifiers such as cookies, device IDs, hashed emails and IP addresses to a single person or household. It lets brands measure and target across devices. That linking is exactly what privacy regulators scrutinize.
Does GDPR require consent for cross-device tracking?
Usually, yes, at least for the device-level storage or access step, and you also need a lawful basis for the profile you build. The ICO guidance covers cookies, pixels and fingerprinting, and applies UK GDPR where the data is personal. CNIL allows consent choices to carry across devices only for logged-in users, with clear notice to them.
Does Global Privacy Control apply across devices?
California enforcement signals say opt-out rights apply to the consumer, not just a browser or device. Formal CPPA rulemaking is underway to clarify how linked identifiers should be treated. Plan to apply a signal to every identifier you have linked to that person.
Is probabilistic matching riskier than deterministic matching?
Often it is harder to defend. Probabilistic methods can rely on signals like IP addresses and fingerprinting, which fall inside ePrivacy-style rules, and users rarely expect them. Deterministic matching tied to a login is easier to explain and to link to consent.
Who is liable, the brand or the identity vendor?
Both can be. Brands that decide how and why data is used carry their own obligations, and a vendor’s failure does not remove them. Use contracts with audit rights, deletion timelines and regulatory notice clauses to allocate and reduce that risk.
What should I ask an identity resolution vendor first?
Ask which identifiers they use, how they collect and verify consent, whether they are a registered data broker, and how an opt-out signal propagates across linked devices. Ask for a live demonstration, not a policy PDF.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →