Two companies want to measure advertising overlap without either seeing the other's user data. What architecture supports this?

Why the alternatives fall short

A trusted third party requires both parties to hand over raw data, which is precisely the thing neither will do, and it concentrates the risk rather than removing it.

Hashed identifier exchange feels private and is not: hashing an email address is not anonymisation, because the space of email addresses is enumerable and the hash is deterministic. Either party can test membership for any identifier they can guess.

Shared database with row-level security relies on configuration to prevent access to data that is present. One policy error is a full disclosure, and the parties cannot verify each other's configuration.

What the clean room provides

• Computation without disclosure: both datasets are present to the engine, neither party can read the other's rows.
• Approved queries only, so the analysis is agreed in advance rather than exploratory.
• Aggregate outputs with minimum group sizes, which is the control that actually prevents reconstruction.
• Query logging visible to both parties, so each can verify what was run.

The failure mode that matters most

Differencing attacks. Two permitted aggregate queries whose results differ by one individual disclose that individual. Minimum thresholds on single queries do not prevent this — it requires query budgets, result perturbation and history-aware policy that considers what has already been asked.

This is why clean rooms need query governance rather than only output thresholds, and why "we only return aggregates" is not by itself a privacy guarantee.