CMO playbook & advanced tactics for cookieless & data clean rooms

Count the partners who want your customer file inside their environment: two or three retail media networks, a streaming platform, the walled gardens you already buy, plus whichever bank or telco has just launched an audience business. Each request is reasonable on its own. Together they are a portfolio decision, and most marketing organisations make it by accident, saying yes to whoever asked first and whoever the agency already has a login for.

Three arbitrations sit underneath that portfolio, and this lesson works through all three: which partners earn a room and which get standard reporting, what data you will not contribute no matter who asks, and what it costs you when the seller of the media also produces the measurement. Google's July 2024 decision not to force-deprecate third-party cookies in Chrome, confirmed in April 2025, moved the timetable and nothing else. Safari and Firefox still block by default across roughly a third of global browser traffic, match rates drift down as users opt out, and consent enforcement keeps tightening. You are going to run this portfolio either way. The only open question is how many rooms you can run well.

The arbitration: which partners earn a room

The privacy-preserving matching environment the foundations lesson describes is cheap to sign and expensive to operate. The licence is rarely the constraint. The constraint is the person who can write the query, defend the result to finance, and notice when the output is wrong. In practice one competent analyst sustains about two live partnerships with standing questions and a quarterly reallocation cycle. A third partnership does not get half an analyst; it gets the leftovers, which is how you end up with three environments and one usable answer.

Tier the portfolio explicitly, and write the tiering down so the next partner request is answered by policy rather than by whoever is most persuasive in the room:

• Tier 1, a live partnership with standing questions: reserved for partners where you can name a decision you will take differently every quarter based on the output. For most CPG advertisers that is the two or three retailers carrying the majority of category sales, not the eight that carry the tail.
• Tier 2, project-based matching two or three times a year, usually through neutral infrastructure rather than the partner's own environment, for a specific question with a start and an end date.
• Tier 3, everyone else: their aggregate reporting, your own geogeoThe practice of making your brand and content visible and citable inside AI-generated answers from tools like ChatGPT, Gemini and Perplexity.View full definition → tests, no data contribution.

The test for Tier 1 is not partner enthusiasm or spend alone. It is whether the partner holds a signal you genuinely cannot obtain elsewhere. A retailer with loyalty-linked basket data holds one. A publisher offering you exposure logs you already receive in your ad server does not.

The cost curve of a second room

The second partnership costs perhaps 70% of the first, never 50%. The legal work partly transfers, but each environment has its own query dialect, its own privacy checks and its own thresholds. Google's Ads Data Hub, for instance, will not return rows that aggregate fewer than roughly 50 users, and activation floors elsewhere sit in the same territory. Those thresholds decide which of your questions are answerable before you write a line of SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.View full definition →: a campaign against a 40,000-person lapsed-buyer segment can look invisible in one environment and perfectly measurable in another.

Budget the real line items. Legal review and a data processing agreement with a derived-data clause take six to twelve weeks with any partner of size. Engineering has to build a contribution pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → that is reproducible rather than a one-off export from a laptop. Compute is billed per query, and an analyst who scans a year of log-level data to answer a question that a sampled month would have settled can burn more than the analysis was worth.

What you refuse to contribute

Start from the position that everything you contribute teaches the partner something about your business, whether or not they see a single raw record. Aggregated outputs still leak structure: overlap rates, penetration, the shape of your lapsed base.

A defensible refusal list for a brand contributing into a retailer's environment:

• Cost, margin and trade-spend data. It has no measurement use and considerable negotiation value to the party sitting across the table from you at the annual terms discussion.
• Model outputs, not just model inputs. Your churn score or predicted lifetime valuelifetime valueLifetime Value: the total revenue (or profit) a customer generates throughout their entire relationship with your business.View full definition → is the product of years of investment. Contribute the identifiers and the exposure log; keep the scores.
• Sensitive inferences you have derived rather than collected, including anything touching health, pregnancy or financial distress. Even where consent technically covers it, the reputational asymmetry is not in your favour.
• Employee, panel and research populations, which almost always slip in through a general CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → export nobody filtered.

Then negotiate the two clauses most contracts leave vague. First, use limitation: outputs may be used for media measurement and activation, not for assortment, pricing or own-brand development. Second, derived-data ownership: who owns a model trained on the overlap, and does it survive the end of the agreement. A partner who will not restrict the use of outputs is telling you what the outputs are for.

The price of measurement you cannot audit

Every environment run by a media seller measures that seller's media. Ads Data Hub is Google's environment reporting on inventory Google sells; the same conflict exists at every retail media network with a measurement product. That does not make the numbers dishonest. It makes them unaudited, and unaudited numbers drift in a predictable direction.

Price the exposure rather than complaining about it. Take a €60m working budget with 40% running in environments where the seller sets the attributionattributionA framework for assigning credit to the touchpoints that contributed to a conversion, so you can measure which channels and interactions actually drive results.View full definition → window and produces the result. Suppose the reported return in those environments is overstated by a quarter, which is a modest assumption when a 14-day view-through window is the default and you did not choose it. You are then holding somewhere near €6m of spend you would not have approved at the true number. That is the annual value of an audit layer, and it is what justifies the analyst headcount from the previous section.

The audit layer is incrementalityincrementalityThe share of results (sales, conversions, revenue) that only happened because of a marketing action, not what would have occurred anyway.View full definition → testing you control: geo holdouts, matched-market tests, occasional full-channel pauses. Ring-fence 2% to 5% of the budget for it and accept that the holdout costs you real revenue. What you buy is a coefficient you can apply to every partner-reported figure, and a position at contract renewal. A second-order effect matters more than the calibration: once partners know you run holdouts, the reported numbers you receive tend to get more conservative on their own.

The failure mode to watch for is arithmetic, not methodology. Sum the conversions claimed across all your partner environments. When the total exceeds the sales your finance team recorded, you are not looking at a measurement problem; you are looking at three partners each claiming the same purchase, and a reallocation decision built on that sum will move money toward whoever counts most aggressively.

Who owns the query

If your agency writes every query, holds the credentials and delivers a slide, you cannot reproduce the result, you cannot re-run it after a pitch, and you have no independent view when a partner's number looks generous. Own the account, own the query library, own the contribution pipeline. Segment and the other pipe vendors sell the plumbing that pushes consented identifiers into these environments and they will happily sell you more of it, so specify what you need before the conversation starts: hashed identifiers, consent state travelling with the record, and the persistent profile the CDPCDPSoftware that unifies customer data from every source into one persistent profile that marketing, sales and service teams can act on.View full definition → foundations lesson describes as the single source you contribute from. Contributions assembled per campaign from ad hoc exports are how the same customer arrives with three different identifiers and your match rate quietly collapses.

Real-world case 1: p&g and the cost of unaudited media

Procter & Gamble spends on the order of $8bn a year on advertising, which makes it the clearest test of what unaudited measurement costs. In January 2017 Marc Pritchard, its chief brand officer, told the IAB that the digital media supply chain was murky at best and set conditions: MRC-accredited third-party viewability measurement, transparent agency contracts, verified fraud protection. P&G then cut more than $200m of digital spend and reported that reach went up rather than down, because much of what disappeared had been reaching nobody in particular.

The transferable point is the sequence. P&G did not start by demanding better numbers from sellers. It set a standard it would accept, withdrew money from anything that failed the standard, and measured the business outcome of the withdrawal. Applied to a partner environment, that is: agree the attribution rules in the contract, validate them once a year against a holdout you run, and be visibly willing to move budget when the two disagree.

Real-world case 2: carrefour and the other side of the table

Carrefour launched Carrefour Links in 2021 to sell its shopper data and retail media to suppliers, and in 2023 formed Unlimitail with Publicis to scale that business across Europe and Latin America. For a brand, this is the standard Tier 1 candidate: loyalty-linked basket data across a large store network, matched against your campaign exposure, answering questions your own systems cannot.

It is also a partner with an own-brand programme it has publicly targeted at around 40% of sales. Nothing improper follows from that, and the measurement value is real. What follows is that use limitation and derived-data ownership are not boilerplate in this contract, they are the contract. The brand contributes exposure and audience identifiers, gets incrementality and reach overlap back, and keeps SKU-level margin economics and its own propensity models on its side of the wall. A retailer that accepts those terms is a partner worth investing an analyst in. One that does not belongs in Tier 3.

CMO action items

• Write the tiering policy this quarter and name the partners in each tier. Two live partnerships per analyst is the working limit; if you have five environments and one analyst, you have one environment and four liabilities.
• Put a refusal list in front of legal and marketing together, covering margin data, model outputs, sensitive inferences and internal populations. Attach it to the standard contribution template so the decision is made once, not per partner.
• Ring-fence 2% to 5% of working media for holdout testing and calibrate every seller-reported number against it at least annually. Present the calibrated figures to finance, not the raw partner reports.
• Add use limitation and derived-data ownership clauses to every partner agreement before renewal season, and treat refusal to accept them as pricing information about what the partner intends to do with your data.

Common mistakes that kill results

• Signing every environment offered. Access is free and attention is not. The organisation that runs two partnerships to a quarterly reallocation decision beats the one holding six logins and an annual overlap report.
• Accepting the partner's attribution window as a technical detail. The window is a commercial term. Negotiate it in the contract, in writing, before the first query runs, and hold it constant across partners so their numbers are comparable to each other.
• Adding up partner-claimed conversions. If the sum exceeds actual sales, the whole set is inflated and reallocating between partners on that basis moves money toward the most generous counter.
• Contributing the model rather than the data. Handing over propensity scores or churn flags gives a partner your analytics investment in a form they can reuse long after the campaign ends.
• Treating Google's cookie reversal as an all-clear. Cookies remaining in Chrome does not restore their reliability, and none of the portfolio arbitrations above change because the deprecation deadline vanished.

Key takeaways

• Clean room capacity is measured in analysts, not licences. Roughly two live partnerships per analyst, and everyone else gets standard reporting.
• A partner earns Tier 1 only if it holds a signal you cannot get elsewhere and you can name the quarterly decision the output will change.
• Decide once, centrally, what you refuse to contribute: margin and trade economics, model outputs, sensitive inferences, internal populations.
• Use limitation and derived-data ownership are the two clauses that determine whether a measurement partnership stays a measurement partnership.
• Unaudited measurement has a computable annual price. On a €60m budget with 40% seller-measured, a 25% overstatement is around €6m misallocated, which is why a 2% to 5% holdout reserve pays for itself.
• P&G's 2017 withdrawal of digital spend without losing reach is the template: set the standard, move the money when the standard fails, measure what happened.