---
title: "How Stagwell built privacy-safe ID matching on Databricks"
description: "Stagwell built a Databricks Marketplace App to let brands match first-party records against its Identity Spine without sending raw customer data outside their own workspaces. It combines Databricks Clean Rooms, Unity Catalog, Jobs and Notebooks, Delta Sharing, and a React/Express interface. Workspace OAuth and On-Behalf-Of authorization enforce the user's Unity Catalog permissions, while separate service principals and a scoped personal access token support app and clean-room operations. Within the clean room, a packaged notebook joins brand data with the Identity Spine, resolves multiple identifiers, and computes match rates, coverage metrics, and household and consumer IDs; results include aggregated audience insights for activation, while raw customer data and proprietary matching code remain separated."
---

# How Stagwell built privacy-safe ID matching on Databricks

[Databricks](https://yomu.fyi/company/databricks) · Sridhar Sundaresan, Suvan Kaul · Jun 18, 2026

**Type:** Explainer

## Summary

Stagwell built a Databricks Marketplace App to let brands match first-party records against its Identity Spine without sending raw customer data outside their own workspaces. It combines Databricks Clean Rooms, Unity Catalog, Jobs and Notebooks, Delta Sharing, and a React/Express interface. Workspace OAuth and On-Behalf-Of authorization enforce the user's Unity Catalog permissions, while separate service principals and a scoped personal access token support app and clean-room operations. Within the clean room, a packaged notebook joins brand data with the Identity Spine, resolves multiple identifiers, and computes match rates, coverage metrics, and household and consumer IDs; results include aggregated audience insights for activation, while raw customer data and proprietary matching code remain separated.

## Context

Brands' first-party data is fragmented, while traditional identity matching requires exporting customer records to third-party platforms. That process can expose PII, create compliance risks, and delay results, even as third-party cookies become unreliable and identity stitching grows more complex.

## Approach / What changed

Stagwell packaged its identity matching capabilities as a Databricks Marketplace App. The application runs in the brand's workspace, uses OAuth, On-Behalf-Of authorization, service principals, and a scoped personal access token, and executes a packaged Clean Room notebook against the brand's data and Stagwell's Identity Spine. Unity Catalog governs access, while Delta Sharing delivers results.

## Takeaways

- Marketplace Apps keep the consumer's data inside its Databricks environment while distributing proprietary application code in a containerized, opaque form.
- On-Behalf-Of authorization makes the app operate under the logged-in user's Unity Catalog permissions, including ACLs, row filters, and column masks.
- Packaged Clean Rooms remove the standard notebook approval step, allowing brands to install the app and run identity matching in minutes rather than weeks.

**Tags:** [Databricks](https://yomu.fyi/topic/databricks), [Marketplace](https://yomu.fyi/topic/marketplace), [Privacy](https://yomu.fyi/topic/privacy), [Unity Catalog](https://yomu.fyi/topic/unity-catalog)

- Source: [Databricks](https://www.databricks.com/blog/how-stagwell-built-privacy-safe-id-matching-databricks)
- Source URL: https://www.databricks.com/blog/how-stagwell-built-privacy-safe-id-matching-databricks
- Ingested by Yomu: 2026-08-30T17:00:47.689Z

[Read original post](https://www.databricks.com/blog/how-stagwell-built-privacy-safe-id-matching-databricks)