At Surfside, the right way to evaluate a targeting identifier is not by whether it exists in a bid request, but by what it lets us do after the bid is won. An identifier becomes actionable when it helps us build audiences, activate consistently across supply, control frequency, suppress waste, measure outcomes, and feed those outcomes back into optimization. By that standard, not all identifiers are created equal.

The important distinction is the layer of identity each signal represents. An IP address is a network-level signal. A UserHash built from IP + User-Agent is a browser or request-level proxy. A device ID is a device-level key. A third-party cookie is a browser-level key. UID2 is a people-based, first-party anchored identifier. The closer an ID gets to a durable relationship with a known consumer, the more valuable it usually becomes for performance, attribution, and long-term optimization.

IP address

IP address is the broadest fallback signal in the stack because it can exist even when there is no login, no cookie, and no device identifier. That makes it useful for household-style activation, coarse geographic targeting, store-trade-area media, and extending campaigns into otherwise anonymous traffic. But IP is not a person ID. Cisco notes that NAT allows a limited number of public IPs to represent entire groups of devices, and Cloudflare notes that multi-user IPs can reflect shared households, VPNs, or CG-NAT environments rather than a single user.

That gives IP high raw reach and low precision. On measurement, it can support directional lift and broad delivery analysis, but it is weak for user-level attribution, deduplicated reach, persistent suppression, and precise frequency control. In campaign terms, IP can absolutely make media more scalable, but by itself it rarely makes media smarter. It is best used as a coarse signal or fallback rail, not as the primary identity spine.

UserHash

IP + User Agent improves on raw IP because it adds a second dimension. Distinct User-Agent values can help separate different browsers or devices behind the same public IP; Cloudflare explicitly uses distinct user agents as one input in detecting multi-user IP environments. The improvement is still probabilistic, however, and it resets any time either input changes. It is also exposed to the broader privacy trend of reducing passive browser entropy: Chrome says User-Agent reduction is generally available and reduces the identifying information passively shared in the User-Agent header.

In practice, Surf UserHash is best understood as a pseudo-session or browser-instance key, not a durable person ID. Its reach is close to IP because it only depends on passive request data, and its actionability is materially better than IP for short-window frequency, anonymous web retargeting, and supply extension. But for long-window attribution, cross-device measurement, or persistent suppression, it still fragments too easily. Used correctly, it is an excellent fallback signal. Used as a primary measurement currency, it tends to overcount reach and understate repeat exposure.

Device ID

Device IDs are the most actionable device-level identifiers in the market. On Apple platforms, access to the advertising identifier requires AppTrackingTransparency permission, and without permission the advertising identifier returns zeros. On Android, Google describes the Advertising ID as unique, resettable, and deletable, and says that for advertising use cases it must be the identifier used; Google also recommends it for conversions and remarketing.

That makes device ID exceptionally strong for in-app performance media. Its pros are deterministic delivery on a device, reliable frequency control, strong conversion attribution, and fast optimization loops. Its cons are just as important: it is not naturally cross-device, it does not solve open-web identity, and on Apple inventory its usable reach is gated by ATT permission. So on reach, device ID is narrower than IP or anonymous web proxies; on measurement and outcome optimization, it is often the strongest signal wherever it is available. For app-driven campaigns, device ID is often the highest-actionability workhorse in the stack.

Third-party cookies

Third-party cookies used to be the default web identity layer. Today they are fragmented by browser and settings. WebKit says Safari blocks all third-party cookies by default. Mozilla says cross-site tracking cookies are disabled by default for all Firefox users. Chrome, meanwhile, decided in April 2025 to keep third-party cookies as a user choice in Chrome settings rather than roll out a new standalone prompt, and Incognito already blocks them by default. In October 2025, Chrome also said it would retire several Privacy Sandbox technologies, including Attribution Reporting API, Topics, Protected Audience, and IP Protection, which reinforces how fluid the browser-side replacement roadmap has been.

The pro of third-party cookies is that, where they still exist, they remain useful for browser-level retargeting, sequencing, and same-browser web attribution. The con is that they are no longer a stable foundation for scaled planning or clean measurement across the open web. Their reach is now structurally biased toward the browsers and users that still permit them, and their measurement is biased in the same way. Because they are browser-scoped rather than people-scoped, they were never especially strong for cross-device outcomes in the first place. That makes them valuable tactically and weak strategically.

UID2

UID2 sits closest to a people-based, first-party anchored model. UID2 describes itself as a deterministic identity framework for the open internet, built to let advertisers activate first-party data on publisher inventory. Official docs say raw UID2s and UID2 tokens are created from email addresses or phone numbers, that publishers can use UID2 for addressable targeting and cross-device frequency management, and that consumers can opt out globally through the Transparency and Control Portal. The same docs also make clear that UID2 requires token generation, refresh, and participant-side handling of missing identities and user opt-outs.

That creates a very different reach-versus-actionability tradeoff than IP or cookies. Raw reach is lower, because UID2 depends on authenticated or otherwise known users and participating supply. But the reach it does have is much more actionable. It supports cleaner cross-device control, stronger suppression, better closed-loop matching to first-party outcomes, and more stable optimization than browser proxies. The downside is operational overhead: identity capture, token management, partner enablement, and the need for enough logged-in supply to matter. For retailers and commerce media platforms, though, that trade is often worth making, because campaign success depends less on abstract scale and more on whether impressions can be tied back to real outcomes.

What this means for Surfside

The practical answer is that no single identifier wins every environment. IP maximizes fallback scale but has the lowest precision. Surf UserHash is a meaningful upgrade on IP for anonymous traffic, but it remains a probabilistic proxy. Device ID is the best device-level performance rail where platform permissions allow it. Third-party cookies still matter in pockets of the web, but they no longer deserve to be treated as a durable strategic foundation. UID2 offers the strongest open-internet balance of determinism, cross-device actionability, and measurement when a first-party relationship exists.

So the right architecture is layered. Device ID and UID2 should be the primary optimization and measurement rails where they are available. Third-party cookies should be used opportunistically, but campaign reporting should never depend on them alone. Surf UserHash should be the anonymous fallback for short-window actionability. IP should sit underneath everything else as the coarsest reach and household signal. In other words, the job of an identifier is not merely to find a user. The job is to create a feedback loop that improves targeting, measurement, and business outcomes. The identifiers that best support that loop are the ones that will drive the most campaign success.