Data Clean Room
A controlled environment where two parties analyse their combined data without either gaining access to the other's raw records.
The commercial driver is the collapse of third-party tracking: advertisers and publishers, retailers and brands, banks and partners all need to measure overlap and effectiveness across their respective customer bases, and none of them can lawfully or commercially hand over their customer list.
The construction is consistent. Both parties' data is loaded into an environment neither controls alone. Only approved query types may run, typically aggregates. Outputs are constrained by minimum aggregation thresholds so no result can describe an individual. Nobody can extract raw records, and every query is logged for both parties.
The genuinely hard problem is not access control but inference. A sequence of individually compliant aggregate queries can isolate an individual through differencing — run a count, add one filter, and the difference between the two results describes one person. Defending against this requires query auditing across sessions, limits on repeated similar queries, and increasingly differential privacy techniques that add calibrated noise so that no single record materially changes any result.
The architectural judgement to make before adopting one: clean rooms give privacy-preserving measurement, not privacy-preserving anything. They constrain what can be asked, and the constraint is the product. Teams expecting the flexibility of a warehouse are consistently disappointed, and the ones that succeed design a small set of high-value questions first.