Building a Data Clean Room: Is It Worth It for Mid-Market Publishers?

Sixty-two percent of data clean room users spent at least $200,000 on the technology in 2022, and 23 percent of them spent upwards of $500,000, according to IAB's State of Data 2023. Nearly half of users, 49 percent, dedicate six or more employees to running it. Those figures describe companies with data teams, standing legal support and board-level mandates. A mid-market publisher, one with millions of monthly pageviews rather than hundreds of millions, reads them and asks a sharper question: how much of the measurement upside is reachable without the headcount and the recurring bill? We work with thousands of publishers, each above one million monthly pageviews, and we field this question from both sides of the desk. For most of them the answer settles into two parts: no to building, yes to participating. The distance between those two answers is what this article covers.

What the room actually computes

A clean room is a controlled compute environment where two parties run queries across each other's data without either side receiving raw records. Inputs arrive as match keys: hashed email addresses, approved persistent identifiers, publisher first-party IDs. The room executes agreed queries, such as overlap, reach, frequency and conversion attribution, and returns aggregates that clear privacy thresholds. No participant exports a user-level file, and no participant sees the other side's raw rows.

Publishers already run cheap versions of the same questions. Google Ad Manager reports frequency and audience composition for your own inventory. Prebid carries first-party segments in the bid request. Your consent management platform gates the signals. What none of these tools can do is join your data to an advertiser's CRM, purchase history or conversion log, and that join is the entire product. Every use case in every clean room pitch reduces to one operation: querying two datasets whose owners will not hand raw files to each other.

Think in concrete terms about the first query most publishers run. The advertiser uploads hashed CRM emails, you upload hashed registrations, and the room reports the overlap share, a reach curve by frequency cap, and nothing else. The privacy threshold matters operationally too: queries that return small cells get suppressed, so a boutique sponsorship with a thin match population may produce aggregates too coarse to bill against.

The standards timeline changed the build math

Between July 2024 and July 2025, IAB Tech Lab shipped the three documents that replaced bespoke clean room engineering. The Tech Lab released Data Clean Room Guidance version 1.0, together with the first interoperability standard for private audience activation, in July 2024. It finalized ADMaP 1.0, an attribution protocol built on privacy-enhancing technologies, in February 2025. It finalized PAIR version 1.1 in July 2025; Google Ads originally developed the protocol, which uses commutative encryption between clean rooms owned by different parties so that neither side exposes its user list during matching. The full data clean room standards timeline sits on the Tech Lab's guidance hub.

The timeline changes a build decision in two ways. Published match protocols end custom schema work on both ends, and commutative encryption removes the raw data exchange that stalled legal reviews for months. What the standards do not remove is operating cost. Someone still normalizes identifiers, manages consent state, maintains the query library and interprets outputs against live campaigns. Standards made clean rooms interoperable, not turnkey.

What the technology actually costs

Adoption is broad: 64 percent of companies leveraging privacy-preserving technologies use data clean rooms, per the same study. The bill behind that adoption is enterprise scale. Sixty-two percent of clean room users spent a minimum of $200,000 on the technology in 2022, 23 percent spent upwards of $500,000, and compounded annual costs can soar above $2 million. Staffing drives the compounding: 49 percent of users have 6 or more employees dedicated to the technology, and 30 percent have at least 11 people. Time frames run from months up to two years to get running.

Returns lag the spend. Fifty-two percent of clean room users cite leveraging results and proving ROI as a challenge, with data interoperability and customization at 39 percent, internal resources at 38 percent, and privacy at 32 percent. Fewer than a third of users employ advanced measurement capabilities, which means most rooms operate below the measurement maturity that justified buying them. A room you cannot staff is a room you cannot query, and the staffing figures alone should end most mid-market build conversations before the budget line opens.

Treat these numbers as a ceiling check rather than a benchmark, because the survey base skews toward enterprise advertisers and large media groups. If your ad operations team is three people who already run Prebid, Ad Manager, consent management and direct campaigns, the staffing line disqualifies a build on its own. A $200,000 annual commitment against a mid-market display P&L is not a tooling decision. It is a strategic bet on direct revenue that, in most portfolios, does not exist yet.

Put the same dollars against your existing roadmap before you commit them. A server-side Prebid expansion, a consent management rebuild and a dedicated data engineer all compete for that budget, and each of them touches revenue you already earn rather than revenue you hope to create. That comparison, not the technology itself, is the first honest test of worth.

Where a publisher extracts value

IAB's 2026 commerce clean room framework names publishers among its intended users and lists four core use cases: audience overlap, data enrichment, and targeting and suppression. The same framework cautions that clean rooms are not the right solution for every data or measurement need, and that caution should carry more weight with a mid-market publisher than the use case list does. Read the commerce clean room use cases next to your deal pipeline, because every use case prices a direct deal:

• Audience overlap. A sponsor sizes your registered users against its CRM before committing to a fixed fee. The overlap percentage sets the price of the sponsorship.
• Data enrichment. A buyer joins your subscriber segments to its purchase categories and buys the enriched audience at a guaranteed CPM.
• Targeting and suppression. The buyer suppresses users who already converted, conversion rates climb on the remaining impressions, and the buyer pays more for the next flight.

Note the pattern: each use case closes a direct campaign. None of them touches the open auction, because no bidder can query a clean room inside a real-time auction. Clean rooms raise the value of direct inventory; they do not lift open market CPMs by themselves.

Suppression deserves a second look from the sell side, because it looks like lost impressions until you price it. When a buyer stops paying for converters, the remaining impressions convert better, effective cost per acquisition falls, and the next insertion order carries a higher CPM or a larger budget. Publishers who understand that trade sell suppression into their direct packages instead of resisting it.

The buyers who run these workflows plan centrally. Agency teams build audience strategy against verified audiences and curated supply, then execute through seats on The Trade Desk or DV360. When a brand asks where to spend, the publishers that win are the ones that can declare a consented audience in the bid stream and, when a deal justifies it, meet the brand in a room.

Five checks before any build

Run the checks in order, because each one disqualifies a project faster than the one after it. Every check answers with data you already have or can collect in a week.

1. Authenticated share of traffic. Match keys need durable identifiers: hashed email from a login, newsletter registrations, paywall accounts. Rank them in the audit, login email hashes first, registered user IDs second, newsletter cookies third, because a one-way hash is the minimum bar for any key you contribute to someone else's room. If anonymous sessions dominate your logs, the matchable population covers a slice of the site, and an overlap query describes that slice, not your reach.

2. Direct revenue that requires cross-party measurement. Open auction revenue never needs a room. Sponsorships priced on guaranteed audiences, outcome-based campaigns and suppression flights sometimes do. Count the direct dollars with a specific measurement dependency, and if that count is zero, stop here.

3. Buyer infrastructure. Ask your five largest direct advertisers whether they operate clean room workflows at all. If they buy through The Trade Desk or DV360, ask their agency teams about data collaboration requirements before anyone drafts a statement of work. If the answer is delivery and reach only, they will never query a room you build.

4. Headcount. The State of Data figures set the bar: 49 percent of users dedicate 6 or more people, and 30 percent dedicate at least 11. A three-person ad operations team cannot absorb a sixth responsibility, and the room loses to campaign firefighting every sprint.

5. Time horizon. Rollouts run from months up to two years while direct deal cycles run quarterly. If the campaign that motivates the build closes this quarter, the room ships after the campaign ends.

Two failed checks end the project. One failed check means you partner instead of build.

The alternative stack, in order of cost

Before anyone writes a clean room statement of work, spend a quarter on the request path. The four moves below capture most of the mid-market value at a fraction of the cost, and each one leaves you more matchable for the day a buyer arrives with a funded use case.

1. Declare first-party data in the bid request. Prebid's first-party data modules write your segments into ortb2.user.data on every impression, and Ad Manager accepts the same signals through targeting keys. The payoff shows up as CPM deltas on data-enabled line items, and the legal surface is your existing consent flow. We run exactly this configuration across our OpenRTB 2.6 seats and Prebid, header and server-side, for thousands of publishers.

2. Package the segments into curated deals. A declared, consented segment sold as a private marketplace deal monetizes your data without any room: the buyer gets a guaranteed audience, and you get a fixed rate. The operating load is a deal ID and a report, not a two-year integration. Our curated demand network works with publishers above one million monthly pageviews and pays Net 30, CPM based, with no sliding terms. On the publisher side that means curated demand, a ten minute reporting console, and payment terms you can plan a quarter around.

3. Let the buyer bring the room. When an advertiser wants an overlap or suppression workflow, contribute your identifiers to its existing clean room under PAIR's commutative encryption. You ship match keys and consent documentation; the buyer runs the queries on infrastructure it already funds. Your engineering cost drops to an export job and a privacy review.

4. Buy the measurement instead of building it. The attribution questions ADMaP 1.0 answers for enterprise teams also have a market answer: you can commission measurement studies through partner lines that span DSP seats, SSP pathways and agency direct lines. Paying per study prices the question correctly, because you learn whether the workflow justifies a room before you fund one.

If most of your demand is Google-managed, the room conversation shifts to Google's own surfaces: Ads Data Hub for query access and the Privacy Sandbox APIs as they scale. That turns a build into a configuration project with a different and usually lower cost profile.

When the answer flips to yes

Three publisher profiles clear the bar, and none of them is a generic display portfolio. Each one has a payer for the output, which is the variable that separates a viable build from a science project.

• Subscription and account-based businesses. Logins cover most sessions, match rates support overlap queries, and churn models already connect audience data to revenue.
• Commerce adjacency. IAB built its commerce framework because retailers, retail media networks and their publisher partners need overlap, enrichment and suppression workflows at deal grade. A publisher holding transaction or shopping-intent data belongs in that framework.
• Publishers with a data product. Registration files, event attendance, B2B intent databases: when the audience file itself earns revenue, the room that proves its value has a named payer.

Even for these profiles, enter as a contributor first. Join a room operated by your agency or demand partner, learn the query patterns on someone else's infrastructure, and graduate to your own deployment only when you hit its limits. We see the full arc here because OnlyMedia operates as an ad network, an SSP and an agency in one company: sell-side seats, buy-side seats and the measurement between them sit in the same operation. That vantage point supports the same conclusion the cost data does: the requirement originates on the buy side, so publishers should build to meet buyers, not to precede them.

If you do build, assign ownership before you assign budget. One person owns the identifier pipeline, one owns the query library and buyer relationships, one owns consent and legal review. The IAB staffing data says most operators run 6 or more dedicated people; a small core with clear lanes can run a contributor model, but not a standalone room.

A 90-day plan either way

Whatever you decide, this sequence costs only the headcount you already have, and it leaves you matchable for the day a buyer shows up with a funded requirement. Each block assumes a four-week sprint and nothing more.

Weeks 1 to 4: audit identifiers. Pull the share of impressions carrying a durable, consented identifier, such as login email hashes, registered user IDs or newsletter cookies, and pull the consent string distribution alongside it. The audit answers check one with data instead of instinct.

Weeks 5 to 8: activate what the audit finds. Wire segments into Prebid first-party data and Ad Manager targeting keys, split line items so the comparison reads cleanly, and record the CPM delta on data-enabled inventory. That number becomes your negotiating position in every direct conversation that follows.

Weeks 9 to 12: put the question to buyers. Ask your five largest direct advertisers one thing: what would you measure about our audience that you cannot measure today? Two answers that describe overlap or suppression needs mean you have a funded use case. Zero answers means you have a verdict, and you just saved $200,000.

The verdict

The IAB framework's own caution settles most build debates: clean rooms are not the right solution for every data or measurement need. For a mid-market publisher, the winning position is rarely ownership. It is readiness: consented identifiers, declared segments in the bid stream, and buyers who know you can meet them in a room when a deal justifies it. Build when a named advertiser funds the queries. Until then, spend the engineering budget on the request path, because that is where the next measurable CPM increase actually comes from.