How Stagwell built privacy-safe ID matching on Databricks

Summary

Stagwell built a Databricks Marketplace App to let brands match first-party records against its Identity Spine without sending raw customer data outside their own workspaces. It combines Databricks Clean Rooms, Unity Catalog, Jobs and Notebooks, Delta Sharing, and a React/Express interface. Workspace OAuth and On-Behalf-Of authorization enforce the user's Unity Catalog permissions, while separate service principals and a scoped personal access token support app and clean-room operations. Within the clean room, a packaged notebook joins brand data with the Identity Spine, resolves multiple identifiers, and computes match rates, coverage metrics, and household and consumer IDs; results include aggregated audience insights for activation, while raw customer data and proprietary matching code remain separated.

Context

Brands' first-party data is fragmented, while traditional identity matching requires exporting customer records to third-party platforms. That process can expose PII, create compliance risks, and delay results, even as third-party cookies become unreliable and identity stitching grows more complex.

Approach / What changed

Stagwell packaged its identity matching capabilities as a Databricks Marketplace App. The application runs in the brand's workspace, uses OAuth, On-Behalf-Of authorization, service principals, and a scoped personal access token, and executes a packaged Clean Room notebook against the brand's data and Stagwell's Identity Spine. Unity Catalog governs access, while Delta Sharing delivers results.

Takeaways

• Marketplace Apps keep the consumer's data inside its Databricks environment while distributing proprietary application code in a containerized, opaque form.
• On-Behalf-Of authorization makes the app operate under the logged-in user's Unity Catalog permissions, including ACLs, row filters, and column masks.
• Packaged Clean Rooms remove the standard notebook approval step, allowing brands to install the app and run identity matching in minutes rather than weeks.

Related reading