A retailer wants to measure whether a brand's advertising drove in-store purchases. The brand has exposure data with hashed identifiers and the retailer has transactions. Neither may see the other's raw records. Which arrangement should they use?
Show the full answer Hide the answer
The deciding property
Both parties need to compute a join neither is allowed to see. That single requirement eliminates most of the options, because it rules out any arrangement where one side holds the other's records in a form it can query freely.
The clean room answers it directly: the join happens inside an environment neither party administers, and only results that satisfy an output policy leave it. The critical part of that policy is a minimum cohort size — commonly in the tens, set so that a returned aggregate cannot be resolved to an individual — combined with limits on how many overlapping queries one party may run.
Why the other options fail
- A hashed-identifier exchange. Hashing an identifier is not anonymisation; it is a deterministic rename. Both parties can hash their own population and test membership, so the brand learns which of its known identifiers shop at the retailer, which is precisely the disclosure the arrangement was meant to prevent. This is the most common mistake in this space because it feels like a technical control.
- A differentially private synthetic copy. Useful for exploration, wrong for measurement: the noise that provides the guarantee is applied to exactly the small-cohort effects the campaign measurement is trying to detect. The answer would be private and not trustworthy, which is the worst combination for a commercial negotiation.
- A trusted third party with both raw datasets. This works and is how the problem was solved before clean rooms existed. It fails now on concentration of risk — one party holds everything, so the breach that matters is theirs — and on regulatory posture, since a controller handing raw personal data to a processor for a purpose the subject did not expect is the arrangement regulators examine most closely.
What would flip the decision
| If this changes | Choose | Because |
|---|---|---|
| Only counts are needed and cohorts are large | Aggregate exchange with a threshold | A clean room is machinery for a question a signed aggregate answers |
| The brand needs per-customer scores back | Nothing here works | The requirement is a disclosure; renegotiate it rather than engineer around it |
| Both parties already sit on the same cloud data platform | The platform's native sharing with policies | Same guarantees without a separate environment to operate |
| The analysis must run monthly and unattended | Clean room with a fixed approved query set | Ad-hoc query review does not survive contact with a schedule |
What it still costs, and when this is the wrong answer
A clean room is an operating burden: query approval, output review, an agreement about who may run what, and a bill neither party wants to own. It is worth it when the measurement is recurring and material. For a one-off campaign post-mortem, an aggregate exchange with an agreed threshold, signed off by both legal teams, delivers the answer in a fortnight instead of a quarter — and the honest position is that most partner analytics is the one-off case dressed up as a platform requirement.