The reasoning gap starts at upload
A company’s own customer data can provide a sound basis for marketing decisions. It does not follow that every subsequent ad contact reaches those customers. Fou’s new article focuses on this gap: the provenance of a record and the quality of its activation are different audit questions. Our assessment therefore starts with the evidence available along the delivery chain, rather than with a general debate about whether first-party data is valuable.
1. What identifiers establish – and what remains open
First-party data comes from a company’s direct relationships with customers or users. HEMs are hashed email addresses: an address is transformed into a hash value that can be used for matching. NPI numbers identify healthcare providers in the United States; they are not browser or device identifiers. None of these categories, on its own, establishes who receives a particular impression, whether a human is involved or whether the advertising generates additional business.
2. Matching is a process, not a uniform quality guarantee
Depending on the provider and environment, an input identifier may be linked to an account, cookie, device ID or identity graph. A direct comparison of identical hashes with logged-in accounts differs methodologically from links inferred through other relationships. Google, for example, describes hash matching against Google accounts. Calling all matching guesswork would therefore be too broad. What matters is the provenance, freshness and validation of each link, particularly where additional devices or households are inferred.
3. Match rate is not targeting accuracy
A match rate initially describes the proportion of an uploaded list that a particular system could associate with its records. It does not automatically establish how many associations are correct or how many intended people are subsequently reached. Google itself explains that match rate is not an indicator of list performance. An audit should document the denominator, deduplication, active reachability and potential incorrect associations separately. A high percentage without these definitions mainly creates reassurance on paper.
4. Audience expansion changes the question
If an uploaded list is extended through similar users or modelled audiences, the potential recipient group changes. This is a separate decision about reach and audience definition. Reporting should distinguish delivery associated with the original list from delivery resulting from expansion or modelling. Otherwise a campaign may be assessed as precise customer targeting even though a substantial part of delivery follows another logic. Campaign settings and delivery data must establish the actual proportions.
5. A usable ID does not establish human activity
Fou uses the term bid licking to describe the reuse of identifiers from the programmatic ecosystem in manipulated requests, seeking more valuable bids. The audit implication is relevant: an ID can remain usable to a buying system while appearing in automated activity. This does not establish that every identifier can be copied or that every identity graph is compromised. The feasibility and scope of such abuse depend on implementation and the controls available.
6. What the examples establish
Fou describes a campaign using uploaded customer emails in which measured landing-page traffic was predominantly classified as bot activity. Such findings justify investigating that particular delivery. They are not a representative market benchmark or an error rate for all first-party campaigns. An unusual app placement alone does not establish fraud either: the intended person could be using it. A stronger assessment combines placement, device evidence, technical patterns and observed behaviour.
7. The evidence we expect from activation
Before launch, document how the list becomes reachable identifiers and whether expansion is permitted. During delivery, require visibility into publishers, apps, supply paths and measurement coverage. Where technically possible, we connect independent in-ad and on-site evidence. Suspicious identifiers or sources should be investigated, changes documented and their consequences checked. The absence of a bot finding is insufficient as positive evidence of human activity. Reporting must clearly retain any limits on what can be established directly.
Effectiveness requires another test
Even a correctly associated human contact does not establish additional demand. An existing customer may purchase regardless of the advertising. Audience accuracy, traffic quality and incrementality therefore require separate assessment. The media decision should consider the additional contribution generated by the budget. Contextually relevant quality publishers can provide a testable alternative; an appropriate campaign comparison must establish whether they perform better. H.O.T. AG connects this strategic assessment with Media Forensics and FouAnalytics.
The question for your next data partner
Ask for more than a successful upload and a match rate. Require evidence of the path from the original list to actual delivery: which link was directly observed, which was inferred, which contact was independently assessed and which outcome was additional? A credible account also identifies the gaps. Your data’s provenance starts this assessment. The quality of your ad contacts must withstand scrutiny throughout the campaign.
Additional primary sources
The campaign examples and ID abuse mechanism are reported in Fou’s original article and its linked analyses; H.O.T. AG has not independently re-examined the underlying raw data here. They are not used to infer general fraud rates. The distinctions between matching methods and the audit and effectiveness recommendations are H.O.T. AG’s assessment. Observability depends on implementation, platform and data access.