Enhanced online privacy

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for enhancing online user privacy. A method can include receiving tag information specifying a given publisher identifier for a publisher and a given client identifier assigned to a user of a client device by the publisher. A given service identifier assigned to the user by a service apparatus is obtained. A mapping between the given service identifier and the given client identifier is created. A list of client identifiers assigned to a set of users by the publisher is received. A list of matching service identifiers corresponding to the list of client identifiers is stored. A plurality of content requests is received from a plurality of different client devices accessing services provided by the service apparatus. Responses to the content requests are based on whether the client devices provide service identifiers included in the list of matching service identifiers.

Description

[0001] This application is a divisional application of the invention patent application filed on December 5, 2019, with application number 201980009069.1 and title "Enhanced Online Privacy". Technical Field

[0002] This manual covers data processing and enhancing online privacy. Background Technology

[0003] This manual covers data processing and enhancing online privacy.

[0004] The internet facilitates the exchange and transaction of information among users worldwide. This exchange enables the distribution of content to a wide range of users. In some cases, content from multiple different providers can be integrated into a single electronic document to create a composite document. For example, a portion of the content included in an electronic document may be selected (or specified) by the document's publisher. Different parts of the content (e.g., digital components) may be provided by a third party (e.g., an entity that is not the document's publisher and / or has no right to modify the code defining the document). In some cases, digital components are selected for integration with the electronic document after a request has been made to render it. For example, when an electronic document is rendered at a client device, machine-executable instructions included in the document can be executed by the client device, and these instructions can enable the client device to contact one or more remote servers to obtain the digital components of the electronic document that will be integrated into the client device. Summary of the Invention

[0005] In general, an innovative aspect of the subject matter described in this specification can be embodied in a method comprising the following operations: receiving, by a service device and from a client device, tag information from a network call to the service device, wherein the network call is generated by activating a tag embedded in a publisher's resource, the tag information specifying a given publisher identifier of the publisher and a given client identifier assigned by the publisher to a user of the client device; obtaining from the client device a given service identifier assigned by the service device to the user; by the service device and creating a mapping from the given service identifier to the given client identifier in a data structure; receiving from the publisher and via an API a list of client identifiers assigned by the publisher to a set of users; determining that the list of client identifiers includes... A given client identifier mapped to a given service identifier; based on this determination, the service device stores the given service identifier mapped to the given client identifier in a matching service identifier list; the service device receives multiple content requests from multiple different client devices accessing services provided by the service device; responding to the content requests based on whether the client device provides a service identifier included in the matching service identifier list includes: when the client device provides a corresponding service identifier included in the matching service identifier list, sending first content reserved for the matching service identifier list; when the client device does not provide a corresponding service identifier included in the matching service identifier list, sending second content not reserved for the matching service identifier list. Other embodiments of this aspect include corresponding systems, devices, apparatuses, and computer programs configured to perform the actions of the method. The computer program (e.g., instructions) may be encoded on a computer storage device. These and other embodiments may each optionally include one or more of the following features.

[0006] The method may include the following actions: generating a hash representation of the user, including: combining a given publisher identifier and a given client identifier; and generating a hash of the combination of the publisher identifier and the given client identifier. Creating a mapping from a given service identifier to a given client identifier involves mapping the hash representation of the user to the given service identifier.

[0007] The method may also include the following actions: determining that a user is logged into a given service provided by a service device; identifying the user's account identifier based on the service the user is logged into; using the account identifier to identify different service identifiers assigned to the user by different services provided by the service device; and creating different mappings between a given client identifier and different service identifiers.

[0008] Creating a mapping from a given service identifier to a given client identifier may include creating a mapping from the given service identifier to a first hash value created using the given client identifier and a first hash function or seed. Creating different mappings between a given client identifier and different service identifiers may include creating different service identifiers to mappings from the given client identifier to a second hash value created using a second hash function or seed, wherein the second hash value is different from the first hash value.

[0009] The method may include the following actions: receiving tag information and different service identifiers from different client devices; deleting the mapping from a given service identifier to a given client identifier from a data structure; and creating different mappings from different service identifiers to a given client identifier in the data structure.

[0010] The storage of a given service identifier that will be mapped to a given client identifier in a list of matching service identifiers may include a data structure entry that stores the given service identifier in a set of publisher identifier-content pairs that includes a list of publisher identifiers with a specified list of publishers, where the list of publishers includes the given client identifier and the user-specific content to be distributed to users in the list of publishers.

[0011] The method may include the following actions: in response to determining that a user has been assigned a different service identifier, updating the list of matching service identifiers, including: remapping the existing associations between a given service identifier and a set of publisher identifier-content pairs to the different identifiers.

[0012] The method may include the following action: after storing the given service identifier, which will be mapped to the given client identifier, in the list of mapped service identifiers, deleting the given client identifier.

[0013] When a client device provides a corresponding service identifier that is included in the list of mapped service identifiers, sending the first content reserved for the matching service identifier list may include: presenting the first content when the user is accessing a service provided in a second-level domain that is different from the publisher's domain.

[0014] Another aspect of this disclosure provides a data processing apparatus configured to perform any of the methods disclosed herein. Another aspect of this disclosure provides a computer-readable medium (which may be transient or non-transitory) including instructions, wherein the instructions, when executed by a computer, cause the computer to perform any of the methods disclosed herein. Yet another aspect of this disclosure provides a computer program including instructions, wherein the instructions, when executed by a computer, cause the computer to perform any of the methods disclosed herein.

[0015] Another innovative aspect of the subject matter described in this specification can be embodied in a method comprising: receiving, by a service device, tag information in a network call to the service device, the tag information specifying a given client identifier, the given client identifier (i) being assigned by a publisher different from the service device, and (ii) representing a user in the publisher's publisher domain; obtaining, by the service device, a given service identifier, the given service identifier being (i) assigned by the service device and (ii) representing a user in the service domain of the service device, wherein the service domain is different from the publisher domain; creating, by the service device, a mapping from the given service identifier to the given client identifier in a data structure; receiving, by the service device, multiple content requests from multiple different client devices accessing services provided by the service device in the service domain; and responding to the content requests based on whether the client devices provide a service identifier mapped to the given client identifier, including: when the content request includes a service identifier mapped to the given client identifier, sending first content reserved for a content request from a client device providing a service identifier mapped to the given client identifier assigned by the publisher; and when the content request does not include a service identifier mapped to the given client identifier, sending second content not reserved for a content request from a client device providing a service identifier mapped to the given client identifier assigned by the publisher.

[0016] Another innovative aspect of the subject matter described in this specification provides a system comprising: a memory device; and one or more processors configured to interact with the memory device and, upon execution of instructions, perform operations including: receiving tag information in a network call to a service device, the tag information specifying a given client identifier, the given client identifier being (i) assigned by a publisher different from the service device, and (ii) representing a user in the publisher's publisher domain; obtaining a given service identifier, the given service identifier being (i) assigned by the service device and (ii) representing a user in the service domain of the service device, wherein the service domain is different from the publisher domain; and creating a mapping from the given service identifier to the given client identifier in a data structure. Send; receive multiple content requests from multiple different client devices, the multiple client devices accessing services provided by a service device in a service domain; and respond to the content requests based on whether the client devices provide a service identifier mapped to a given client identifier, including: when the content request includes a service identifier mapped to a given client identifier, sending first content reserved for a content request from a client device that provides a service identifier mapped to a given client identifier assigned by a publisher; and when the content request does not include a service identifier mapped to a given client identifier, sending second content that is not reserved for a content request from a client device that provides a service identifier mapped to a given client identifier assigned by a publisher.

[0017] Another innovative aspect of the subject matter described in this specification provides a non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations including: receiving tag information in a network call to a service device, the tag information specifying a given client identifier, the given client identifier (i) being assigned by a publisher different from the service device, and (ii) representing a user in the publisher's publisher domain; obtaining a given service identifier, the given service identifier (i) being assigned by the service device (ii) and representing a user in the service domain of the service device, wherein the service domain is different from the publisher domain; creating a mapping from the given service identifier to the given client identifier in a data structure; receiving... Multiple content requests from multiple different client devices, multiple client devices accessing services provided by a service device in a service domain; and responding to content requests based on whether a client device provides a service identifier mapped to a given client identifier, including: when the content request includes a service identifier mapped to a given client identifier, sending first content reserved for a content request from a client device providing a service identifier mapped to a given client identifier assigned by a publisher; and when the content request does not include a service identifier mapped to a given client identifier, sending second content not reserved for a content request from a client device providing a service identifier mapped to a given client identifier assigned by a publisher.

[0018] Specific embodiments of the subject matter described herein can be implemented to achieve one or more of the following advantages. For example, the innovations discussed herein maintain user privacy while facilitating the ability to provide user-specific information across multiple different services, domains, and entities. More specifically, when a user accesses a third-party service, the publisher can specify a list of users to whom they wish to provide specific information without specifically identifying those users. Furthermore, the techniques described herein enable specific information to be provided to a designated list of users within a computational environment that does not allow third-party services access to the publisher's cookies. For example, this information can be used to provide specific information within content provided by a third-party provider, and also enables the service provider to select the content to be presented to users on the list in other web pages or applications (e.g., provided by the publisher).

[0019] Unlike conventional identifier mapping techniques (e.g., cookie mapping), the mapping discussed throughout this document is used to generate a list of service identifiers corresponding to users selected to receive user-specific information. This eliminates the need for mapping between client identifiers and service identifiers when requesting content for presentation in a third-party service. Using a list of service identifiers instead of mappings reduces system latency when requesting content. For example, the system can directly look up the service identifiers included in the list to determine whether user-specific information should be provided, rather than first identifying the service identifiers in the mapping, then identifying the client identifiers mapped to those service identifiers, and then determining whether the identified client identifiers are included in the list of client identifiers corresponding to the user to receive user-specific information. This results in a significant reduction in processor time required for service requests when aggregating millions / billions of requests.

[0020] Details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the following description. Other features, aspects, and advantages of this subject matter will become apparent from the specification, drawings, and claims. Attached Figure Description

[0021] Figure 1 This is a block diagram of an example environment in which digital components are distributed for presentation with electronic documents.

[0022] Figure 2A This is a block diagram illustrating an example technique for creating identifier mappings.

[0023] Figure 2B This is a block diagram illustrating example technologies for enhancing user privacy in cross-domain environments.

[0024] Figure 3 This is a flowchart of an example process for enhancing user privacy in a cross-domain content distribution environment.

[0025] Figure 4 This is a block diagram of an example computer system.

[0026] The same reference numerals and labels in different figures indicate the same elements. Detailed Implementation

[0027] This document discloses methods, systems, apparatus, and computer-readable media for maintaining user privacy while facilitating the provision of user-specific information across multiple different services and entities. More specifically, publishers (e.g., owners or operators of web pages or online applications) can specify a list of users to whom they wish to provide specific information when users access various third-party services hosted by online domains (e.g., web pages or online applications different from those provided by the publisher) that are different from the publisher's resources, without specifically identifying those users.

[0028] As described in more detail below, a service device can facilitate the distribution of user-specific information specified by a publisher to users of a third-party service based on a mapping maintained by the service device to client identifiers assigned to users by a publisher. The mapping from service identifiers to client identifiers can be generated by the service device. In some implementations, the service device obtains client identifiers assigned to users from a set of tag information, wherein this set of tag information is submitted to the service device when pixels within a publisher's resource are executed by a client device (e.g., a browser running on the client device). Tags triggered on the client device initiate a network call to the service device and notify the service device of the client identifier assigned by the publisher and the publisher's identifier. When a call is made to the service device (e.g., the service device's domain), the client device (e.g., a browser running on the client device) also submits the service identifier assigned by the service device and stored on the client device. Using this combination of information, the service device can map client identifiers assigned to a given user by a publisher to service identifiers assigned to that user by the service device.

[0029] Simultaneously, the publisher can submit (e.g., via the service device's application programming interface "API") a list of client identifiers that the publisher has selected to receive user-specific information. The service device uses a mapping created to convert the list of client identifiers into a corresponding list of service identifiers, which does not include client identifiers representing users in the publisher's domain, but still represents those same users in the service device's domain (e.g., those users represented by the client identifier list). When the service device receives content requests from users in the service device's domain accessing third-party services, those requests will include service identifiers representing users in the service device's domain. The received service identifiers can then be compared with the list of service identifiers representing users that the publisher has selected to receive user-specific information. When the service device identifies a match between the received service identifiers and the list, the service device can send user-specific information in response to the request. When the service device does not identify a match between the received service identifiers and the list, the service device suppresses the sending of user-specific information, but can still send other information in response to the request.

[0030] Figure 1 This is a block diagram of an example environment 100 in which digital components are distributed to be presented along with electronic documents. Example environment 100 includes a network 102, such as a local area network (LAN), a wide area network (WAN), the Internet, or a combination thereof. Network 102 connects an electronic document server 104, user equipment 106, a digital component server 108, and a service device 110. Example environment 100 may include many different electronic document servers 104, user equipment 106, and digital component servers 108.

[0031] Client device 106 is an electronic device capable of requesting and receiving resources via network 102. Example client devices 106 include personal computers, mobile communication devices, digital assistant devices, and other devices that can transmit and receive data via network 102. Client device 106 generally includes user applications such as web browsers to facilitate the transmission and reception of data via network 102; however, native applications executed by client device 106 can also facilitate the transmission and reception of data via network 102.

[0032] Digital assistant devices include devices containing microphones and speakers. Digital assistant devices are typically able to receive input via voice and respond to content using auditory feedback, and can present other auditory information. In some cases, digital assistant devices also include or communicate with a visual display (e.g., via a wireless or wired connection). When a visual display is present, feedback or other information can also be provided visually. In some cases, digital assistant devices can also control other devices, such as lights, locks, cameras, climate control devices, alarm systems, and other devices registered with the digital assistant device.

[0033] An electronic document is data that presents a collection of content at client device 106. Examples of electronic documents include web pages, word processing documents, portable document format (PDF) documents, images, videos, search results pages, and feeds. Native applications (e.g., "apps") such as applications installed on mobile computing devices, tablet computing devices, or desktop computing devices are also examples of electronic documents. Electronic documents may be provided to client device 106 by electronic document server 104 ("electronic Doc server"). For example, electronic document server 104 may include a server hosting a publisher's website. In this example, client device 106 may initiate a request for a given publisher's web page, and electronic server 104 hosting the given publisher's web page may respond to the request by transmitting machine-executable instructions to initiate the presentation of the given web page at client device 106.

[0034] In another example, electronic document server 104 may include an app server from which client device 106 can download an app. In this example, client device 106 can download the files required to install the app at client device 106 and then execute the downloaded app locally.

[0035] Electronic documents can include a variety of content. For example, an electronic document may include static content (e.g., text or other specified content) that is within the electronic document itself and / or does not change over time. Electronic documents may also include dynamic content that can change over time or based on each request. For example, the publisher of a given electronic document may maintain a data source for populating portions of the electronic document. In this example, a given electronic document may include a script that, when processed (e.g., displayed or executed) by client device 106, causes client device 106 to request content from the data source. Client device 106 integrates the content obtained from the data source into the given electronic document to create a composite electronic document that includes the content obtained from the data source.

[0036] In some cases, a given electronic document may include a digital component script referencing service device 110 or a specific service provided by service device 110. In these cases, the digital component script is executed by client device 106 when the given electronic document is processed. Execution of the digital component script configures client device 106 to generate a request for digital component 112 (referred to as a “component request”), which is sent to service device 110 via network 102. For example, the digital component script may enable client device 106 to generate a packet data request that includes header and payload data. Component request 112 may include event data specifying characteristics such as the name (or network location) of the server from which the digital component is requested, the name (or network location) of the requesting device (e.g., client device 106), and / or information that service device 110 can use to select one or more digital components or other content to be provided in response to the request. Component request 112 is sent by client device 106 to a server of service device 110 via network 102 (e.g., a telecommunications network).

[0037] Component request 112 may include event data specifying other event characteristics, such as the characteristics of the requested electronic document and the location of the electronic document in which the digital component can be presented. For example, event data specifying a reference (e.g., a URL) to an electronic document in which the digital component will be presented (e.g., a webpage), an available location of the electronic document that can be used to present the digital component, the size of the available location, and / or the type of media eligible to be presented at that location may be provided to service device 110. Similarly, event data specifying keywords (“document keywords”) associated with the electronic document or entities (e.g., people, places, or things) referenced by the electronic document may also be included in component request 112 (e.g., as payload data) and provided to service device 110 to facilitate the identification of digital components eligible to be presented with the electronic document. Event data may also include search queries submitted from client device 106 to obtain search results pages.

[0038] Component request 112 may also include event data relating to other information, such as information already provided by the user of the client device, geographic information indicating the state or region from which the component request was submitted, or other information providing context for the environment in which the digital component will be displayed (e.g., the time of day of the component request, the day of the week of the component request, the type of device from which the digital component will be displayed, such as a mobile device or a tablet device). Component request 112 may be sent, for example, via a packet network, and component request 112 itself may be formatted as packet data with a header and payload data. The header may specify the destination of the packet, and the payload data may include any of the information discussed above.

[0039] In response to receiving a component request 112 and / or using the information included in the component request 112, the service device 110 selects a digital component (e.g., a video file, audio file, image, text, or a combination thereof, which may take the form of advertising or non-advertising content) to be presented along with a given electronic document. In some implementations, the digital component is selected in less than one second to avoid errors that may be caused by delayed selection of the digital component. For example, a delay in providing the digital component in response to the component request 112 may cause a page loading error at the client device 106, or cause portions of the electronic document to remain unfilled even after other portions of the electronic document have been presented at the client device 106. Furthermore, as the delay in providing the digital component to the client device 106 increases, it is possible that the electronic document is no longer presented at the client device 106 when the digital component is delivered, thus negatively impacting the user's experience with the electronic document. Additionally, for example, if the electronic document is no longer presented at the client device 106 when the digital component is provided, the delay in providing the digital component may result in failed delivery of the digital component.

[0040] In some implementations, service device 110 is implemented in a distributed computing system, which includes, for example, a server and a collection 114 of multiple computing devices interconnected and identifying and distributing digital components in response to request 112. The collection 114 of multiple computing devices operates together to process millions of available digital components (DCs). 1-x The corpus identifies sets of digital components eligible to be presented in electronic documents. For example, millions of available digital components can be indexed in a digital component database 116. Each digital component index entry can reference the corresponding digital component and / or include distribution parameters (DP1-DP1) that help (e.g., trigger, regulate, or limit) the distribution / transmission of the corresponding digital component. x For example, distribution parameters can facilitate (e.g., trigger) the transmission of a digital component by requiring the component request to include at least one criterion that matches one of the distribution parameters of the digital component (e.g., precisely or at a pre-specified level of similarity).

[0041] In some implementations, distribution parameters for a particular digital component may include distribution keywords that must be matched (e.g., by electronic documents, document keywords, or terms specified in component request 112) for the digital component to be eligible for presentation. Distribution parameters may also require component request 112 to include information specifying a particular geographic region (e.g., country or state) and / or information specifying that component request 112 originates from a particular type of client device (e.g., mobile device or tablet device) for the digital component to be eligible for presentation. Distribution parameters may also specify eligibility values ​​(e.g., bid, ranking score, or some other specified value) used to evaluate the digital component's eligibility for distribution / sending (e.g., among other available digital components), as discussed in more detail below.

[0042] The identification of eligible digital components can be segmented into multiple tasks 117a-117c, which are then distributed among computing devices within a set of multiple computing devices 114. For example, different computing devices in set 114 can each analyze different portions of the digital component database 116 to identify various digital components having distribution parameters that match the information included in component request 112. In some embodiments, each given computing device in set 114 can analyze different data dimensions (or sets of dimensions) and transmit (e.g., send) the results of the analysis (Res 1-Res 3) 118a-118c back to the service device 110. For example, the results 118a-118c provided by each computing device in set 114 can identify subsets of digital components eligible for distribution in response to a component request and / or subsets of digital components having certain distribution parameters. Identification of subsets of digital components may include, for example, comparing event data with distribution parameters and identifying subsets of digital components having distribution parameters that match at least some characteristics of the event data.

[0043] Service device 110 aggregates results 118a-118c received from a set 114 of multiple computing devices and uses information associated with the aggregated results to select one or more digital components to be provided in response to request 112. For example, as discussed below, service device 110 may select a winning set of digital components (one or more digital components) based on the results of one or more content evaluation processes. In turn, service device 110 may generate and transmit response data 120 (e.g., digital data representing a response) via network 102, wherein the response data 120 enables client device 106 to integrate the winning set of digital components into a given electronic document, such that the winning set of digital components and the content of the electronic document are presented together on the display of client device 106.

[0044] In some implementations, client device 106 executes instructions included in response data 120 that configure and enable client device 106 to obtain a set of winning digital components from one or more digital component servers. For example, the instructions in response data 120 may include a network location (e.g., a Uniform Resource Locator, URL) and a script that causes client device 106 to send a server request (SR) 121 to digital component server 108 to obtain a given winning digital component from digital component server 108. In response to this request, digital component server 108 identifies the given winning digital component specified in server request 121 (e.g., in a database storing multiple digital components) and sends digital component data (DC data) 122 to client device 106, which presents the given winning digital component in an electronic document at client device 106.

[0045] Service device 110 can utilize various techniques to evaluate the eligibility of different digital components that can be sent in response to a given component request (e.g., a single component request). For example, service device 110 can compare the eligibility values ​​of various different digital components and select one or more of the digital components with the highest eligibility values ​​as the digital components to be sent to client device 106 in response to a given component request. In some cases, the initial eligibility value (e.g., bid or other value) of each digital component can be specified by the provider (or source) of the digital component. For example, a provider (P1) of a video clip (VC1) can provide an initial eligibility value of 1.0, while a different provider (P2) of a different video clip (VC2) can provide an initial eligibility value of 1.1. For the purposes of this example, assume that the component request only requests one digital component to be rendered with a specific webpage. To select which of the two video clips to be provided, service device 110 can rank VC1 and VC2 based on their respective initial eligibility values ​​and select the video clip with the highest ranking to be sent to the client device in response to the component request. In this example, VC2 ranks higher than VC1 because VC2's initial qualification value of 1.1 is higher than VC1's initial qualification value of 1.0.

[0046] In some cases, the eligibility of various digital components can be evaluated using only the initial eligibility values ​​submitted by the digital component provider (source). In other cases, the initial eligibility values ​​submitted by the provider are increased (or changed) based on one or more other factors. For example, service device 110 can generate adjusted eligibility values ​​for digital components based on the initial eligibility values ​​and the quality factors of the digital components.

[0047] A quality factor for a given digital component can quantify the likelihood that a given digital component is the appropriate digital component provided in response to a given component request. In some implementations, the quality factor is determined based on one or more features specified by event data. More specifically, the service device 110 may input one or more features from the event data (e.g., geographic information and / or terminology from an electronic document) into a machine learning system, wherein the machine learning system outputs a predicted distribution result that can be used as the quality factor. The predicted distribution result may be expressed as, for example, a predicted interaction rate of the digital component in the context of the current component request (e.g., click-through rate, play-through rate, or another measure of interaction with the digital component).

[0048] Once the quality factor is obtained, it can be applied to the initial eligibility value to derive the adjusted eligibility value. For example, the adjusted eligibility value (AEV) can be the product of the initial eligibility value and the quality factor (e.g., AEV = quality factor * initial eligibility value). In some cases, the adjusted eligibility values ​​of various different numeric components can be used to rank the numeric categories (e.g., from highest to lowest), and one or more of the highest-ranked numeric components can be selected to be sent in response to a component request.

[0049] In some cases, the selection of a digital category can also be based on whether a user is selected to receive user-specific information. As used throughout this document, user-specific information refers to information (e.g., including digital components) that has been designated for distribution to one or more users included in a specific user list. For example, user-specific information includes, but is not limited to, specific digital components that have been designated for distribution to user lists submitted by publishers of websites, applications, or other resources. The user list selected to receive / be provided to users on the list can be generated in various ways, but in some cases, the list is generated based on users who have performed specific online activities (e.g., visiting specific pages on a website, reaching a specific level within an application (such as a game application), requesting specific information (e.g., using a digital assistant device), watching specific videos, or other activities). More specifically, the publisher can identify users performing specific activities, create a list of user identifiers representing those users, and provide that list of user identifiers along with instructions on the user-specific information to be provided to the users in the list to service device 110.

[0050] Restrictions on user identifiers limit the ability of service device 110 to use the list of user identifiers provided by the publisher. For example, cookies that typically contain user identifiers are generally only accessible to devices (e.g., servers or other computing devices) hosted in a domain that matches the domain of the cookie. That is, when a cookie is placed on client device 106 by an electronic document server 104 in the domain example.com, it is generally only available to the browser or native application running on that client device when the client device accesses a web location (e.g., a webpage) within example.com. Therefore, a server providing content in the domain example.com will only be able to access cookies in the domain example.com. Thus, any user identifiers stored in the example.com cookie will not be available to devices (e.g., servers or other computing devices) in other domains. Similarly, information in a cookie placed on client device 106 that includes user identifiers assigned by devices providing electronic documents in different domains (e.g., other than example.com) is generally not accessible to the electronic document server 104 in the domain example.com. Thus, service device 110 generally cannot directly use the list of identifiers assigned to users by the publisher to facilitate the distribution of user-specific information across domains.

[0051] Cookie mapping can facilitate the distribution of user-specific information across domains (and cookie spaces), but it lacks a process to protect user privacy. The use of cookie mapping can lead to data leaks (e.g., the spread of user information) and / or the aggregation of users from multiple different cookies provided by multiple different entities. Cookie mapping itself also results in higher response latency due to the lookup process associated with it. The following discussion provides details of a technique that can be used to enhance user privacy while facilitating the distribution of user-specific information by a service device to users designated by a publisher (e.g., an entity operating and / or maintaining an electronic document server 104) that publishes content in a domain different from the domain of the service device. This technique also provides lower response latency than conventional cookie mapping because cookie mapping is not required during service operation.

[0052] Note that the techniques described herein can be used in any situation where access to user identifiers is restricted. For example, even though access to user identifiers assigned in one domain is generally available to a device (e.g., a service device) that provides HTTP requests to web pages / services in a different domain, the techniques described herein can also be used in situations where separation of user identifiers is desired or unavoidable (e.g., to improve user privacy).

[0053] This document relates to a service apparatus. As used herein, a service apparatus is one or more data processing devices that perform operations to facilitate the distribution of content over a network. A service apparatus is depicted as a single block in a block diagram. However, while a service apparatus may be a single device or a collection of single devices, this disclosure contemplates that a service apparatus may also be a group of devices, or even multiple different systems, communicating to provide various types of content to client devices. For example, a service apparatus may encompass one or more of the following: a search system, a video streaming service, an audio streaming service, an email service, a navigation service, an advertising service, or any other service.

[0054] Figure 2A This is a block diagram 200 illustrating an example technique for creating identifier mapping 224. Identifier mapping 250 maps a service identifier (“SID”) assigned to a user by service device 110 (or an attachment) to a client identifier (“CID”) assigned to the user by publisher 206. Publisher 206 may be the owner, operator, and / or manager of a publisher resource. In some implementations, publisher resource 206 resides in a different domain (e.g., a different fully qualified domain or a different second-level domain) than the documents and / or services of service device 110. For example, publisher resource 206 may be in the example.com domain, while the documents and / or services provided by service device 110 are not in the example.com domain. In a particular example, service device 110 may provide HTTP requests for documents and / or services in the google.com domain, while publisher resource 206 may be in a different domain (e.g., other than google.com).

[0055] Client identifiers assigned to users by the publisher and stored on client device 106 are accessible only to devices residing in the example.com domain (e.g., servers). This means that service device 110 will not be able to access those identifiers assigned to users by the publisher and stored on client device 106. More specifically, when client device 106 accesses a given network location (e.g., a URL) using browser 208 (or a native application), the browser typically does not provide cookies (or other files) originating from a domain different from the domain of the webpage / service provided from the given network location. Thus, when client device 106 accesses service device 110 using browser 208 (or a native application), any cookies dropped on client device 106 from a domain different from the domain of the documents and / or services provided by service device 110 will not be provided to service device 110. Therefore, any client identifiers assigned to users by publisher 206 and stored on client device 106 (e.g., in publisher cookies) will not be passed to service device 110 by browser 208.

[0056] Publisher 206 may use a tag called pixel 210 (for illustrative purposes) embedded in the publisher's attributes (e.g., web pages and / or native applications) to cause client device 106 to send information from the publisher's cookies (e.g., any cookies discarded on the client device from the publisher's domain) to service device 110. Pixel 210 may be a 1×1 pixel (or another pixel, script, or other tag) embedded in publisher resource 206. When client device 106 submits a request 212 for publisher resource 206, the request is received by one of the publisher's servers, and a response including publisher resource 206 is sent to client device 106. When client device 106 displays publisher resource 206 within browser 208, the client device will encounter pixel 210. Execution of pixel 210 by client device 106 (e.g., using browser 208) triggers a network call 216 to service device 110 (e.g., to the URL of service device 110).

[0057] Pixel 210 can be configured to embed a user's client identifier (e.g., "CID1") into network call 216. Pixel 210 can also be configured to embed additional information (such as the publisher's identifier (e.g., "PID1")) into network call 216. For example, when client device 106 requests publisher resource 206 using browser 208, browser 208 can pass the publisher's cookie stored on client device 106 to the publisher's server. The publisher server can embed this information into pixel 210 such that when client device 106 executes pixel 210, the embedded information will be included in network call 216 passed to service device 110. In this way, service device 110 can obtain any client identifiers already assigned to the user, even if browser 208 may not provide those client identifiers to service device 110 as part of a regular network call to service device 110 (e.g., initiated by the user entering the URL of service device 110 into browser 208).

[0058] When pixel 210 initiates a network call 216 to service device 110, the information embedded in pixel 210 will typically not include any service identifier (e.g., SID1) assigned to the user by service device 110. This is because when client device 106 requests publisher resource 206, browser 208 does not pass the cookie discarded on client device 106 to the publisher server for reasons discussed above (e.g., different and / or mismatched domains between the publisher server and the cookie). However, when pixel 210 generates a network call 216 to service device 110, this network call 216 will be directed to the domain of service device 110 (e.g., google.com), causing browser 208 to send cookie 218 of service device 110 (e.g., having the same domain as service device 110) to service device 110. Cookie 218 sent to service device 110 will include the service identifier (e.g., "SID1") assigned to the user by service device 110 (or another device in the same domain as service device 110). Therefore, when pixel 210 is activated, client device 106 will send the service identifier assigned to the user by service device 110 and the client identifier assigned to the user by publisher to service device 110.

[0059] The above examples involve sending a service identifier and a client identifier to service device 110 using pixels. In some implementations, the service identifier and client identifier may be sent to service device 110 by client device 106 using a script (e.g., JavaScript) embedded in publisher resource 206. This script may be provided, for example, by a service provider that owns / operates service device 110. When browser 208 encounters the script, browser 208 executes the script, causing browser 208 to send an HTTP request to service device 110 including the service identifier and / or client identifier. In some implementations, the script causes browser 208 to access one or more cookies having the same domain as the HTTP request to service device 110 and to provide the cookies and / or information from the cookies to service device 110. In this way, scripts can be used to send the service identifier and client identifier to service device 110.

[0060] Note that client identifiers may not be stored on the client device, but are generated based on other user-specific information that can be stored on client device 106. This user-specific information is included in HTTP request parameters or in dynamic HTTP responses generated by the publisher server when client device 106 accesses electronic documents and / or services provided by the publisher. These types of client identifiers can also be obtained by browser 208 and sent to service device 110 when pixels or scripts are executed by browser 208. Scripts and / or other executable instructions embedded in the publisher's resources are also referred to as tags, and the information provided based on the execution of these scripts and / or other executable instructions is collectively referred to as tag information. The execution of tags is also referred to as tag activation.

[0061] Service device 110 receives both a client identifier and a service identifier, and generates mapping information 220 indicating that both the service identifier and the client identifier are assigned to and / or represent the same user. For example, the mapping information may be a data set arranged in a manner that allows service device 110 to use either the service identifier or the client identifier to obtain another corresponding identifier representing the same user. For example, the mapping information may simply be formatted as key-value pairs indicating that the service identifier and the client identifier represent the same user.

[0062] One way this innovation enhances user privacy is by creating and storing a mapping from client identifiers to service identifiers. For example, instead of simply storing a direct mapping from client identifiers assigned by the publisher to service identifiers assigned by service device 110, service device 110 can generate a hash of the client identifier mapped to the service identifier. This limits the ability to reveal a user's client identifier. Furthermore, to prevent the possibility of linking two different client identifiers to the same user (e.g., by assigning the same client identifier to the same user by two different publishers), service device 110 can combine the publisher identifier with the client identifier before hashing.

[0063] For example, suppose a publisher with identifier PID1 assigns a client identifier CID1 to a specific user, and a different publisher with identifier PID2 also assigns the client identifier CID1 to the same specific user. In this example, the mapping of the client identifier for the first publisher could be, for example, SID1 = hash(PID1:CID1), while the mapping for the second publisher could be SID1 = hash(PID2:CID1), resulting in different mappings across different publishers.

[0064] Service device 110 may store mapping information 220 in ID mapping database 222. For example, each entry in ID mapping database 222 may correspond to a pair of service identifiers and client identifiers representing the same user. In other words, each entry may specify a mapping from a user's service provider to the same user's client identifier. ID mapping database 222 may store multiple instances of mapping information 220 for multiple different users, which are collectively referred to as identifier mapping 224.

[0065] Some service providers may use different service identifiers and / or different domains for different services. In these cases, the process performed above can be combined with additional processes as needed to extend cookie mapping while continuing to protect user privacy by preventing different service identifiers from being linked to the same client identifier. For example, when the combination of the client identifier and the service identifier is received by service device 110, service device 110 can determine whether the user is currently logged into a service provided by service device 110.

[0066] If a user is currently logged into a service provided by service device 110 (e.g., a video streaming service), service device 110 can identify the user's account and the account identifier for that service. Using the account identifier, service device 110 can identify a different service identifier (different from the service identifier received from client device 106 based on pixel excitation) that has been assigned to the user for another service provided by the service provider (e.g., a search service). For example, service device 110 can search for an index of the account identifier and the corresponding service identifier for that other service (e.g., the search service) and identify the different service identifier that has been assigned to the user for that other service. Service device 110 can then use the client identifier and the different service identifier, for example, in different databases, in a manner similar to that described above. In this way, service device 110 can perform the operations discussed throughout this document across two different identifier spaces (e.g., a cookie space) on a publisher resource that is excited by a single pixel, where the publisher resource and the service provided by the service provider reside in different identifier spaces (e.g., a cookie space).

[0067] To further protect user privacy in this cross-identifier space (e.g., cross-cookie space) implementation, different hash functions (or seeds) can be used when hashing the client identifier assigned to the user by publisher 206. For example, instead of using the same hash of the client identifier discussed above, service device 110 can use different hash functions (or seeds) to create different hashes of the client identifier, such that a first mapping between the client identifier and (e.g., a first service) a first service identifier is different from (and not directly subordinate to) a second mapping from the client identifier to the second service identifier. More specifically, the first mapping of the first service could be, for example, SID1 = hash1(PID1:CID1), and the second mapping of the second service could be, for example, SID2 = hash2(PID1:CID1), such that it is not obvious that SID1 and SID2 are assigned to the same user. A similar process can be performed across any number of identifier spaces to link the client identifier to the corresponding service identifier in each identifier space (e.g., for each service), while ensuring that entries in different mappings do not belong to each other.

[0068] In some situations, a user may use multiple different devices to access the services of a service provider (e.g., service device 110). For example, a user may first use their mobile device to access a specific service, then use a digital assistant device to access the same service, and then use a tablet device to access the same service. In this example, each device will have a different service identifier stored on that device. To protect user privacy, service device 110 can be configured to retain only the mapping of the most recently encountered service identifier.

[0069] Continuing the example above, suppose service device 110 first maps a service identifier stored on a mobile device to a client identifier, for example, in the manner described above. Further suppose that at a later time, service device 110 receives a client identifier from a tablet device, along with the client identifier (e.g., due to pixel excitation). In this case, service device 110 can delete the mapping from the client identifier to the service identifier created using the service identifier obtained from the mobile device, thereby removing the earlier received service identifier from identifier mapping 224. However, service device 110 can create a new mapping from a second service identifier (e.g., the service identifier received from the tablet device) to a client identifier assigned to the user by publisher 206, and store this mapping in mapping list 224 in a manner similar to that discussed above. In this way, service device 110 further enhances user privacy by reducing the number of identifiers that can be attributed to the same user, which limits the amount of information attributed to a particular user.

[0070] In some implementations, one or more additional devices (not shown) may receive network call 216 and redirect client device 106 to service device 110. For example, pixel 210 may initiate network call 216 to a server tracking conversions (or other analytics data). In this example, the server tracking conversions may record the conversions identified in network call 216 and pass a client identifier and / or publisher identifier to service device 110 in the redirection. The server tracking conversions may also pass a service identifier to service device 110 (e.g., if the additional device belongs to the same domain as service device 110). Alternatively and / or additionally, when a redirection from an additional device is performed by client device 106, the browser will identify service cookies(s) and pass them along with information from network call 216, which is embedded in the redirection initiated by the additional device.

[0071] Figure 2B This is block diagram 250 illustrating example techniques for enhancing user privacy in cross-domain environments. The techniques illustrated by block diagram 250 can be used (e.g., after creation) for reference. Figure 2A The identifier mapping 224 discussed is executed. Furthermore, the technology illustrated in block diagram 250 enables service device 110 to facilitate the delivery (e.g., distribution or sending) of user-specific information to a list of users specified by publisher 206 (e.g., via client identifiers) when users are accessing services provided by service device 110 (e.g., when client device 106 does not provide a client identifier to service device 110).

[0072] As discussed above, publisher 206 may specify that user-specific information (e.g., remarketing content) is provided to a designated list of users. In some cases, publisher 206 may want to provide user-specific information to a designated set of users when those users access (or otherwise utilize) services provided by service device 110 (or another third-party service provider) outside the publisher's domain. To facilitate the ability of service device 110 to distribute (or send) user-specific information to users selected by publisher 206, publisher 206 may provide service device 110 with a list 252 of client identifiers representing users that the publisher has selected as recipients of user-specific information. The list 252 of client identifiers specifies one or more client identifiers that have been assigned by publisher 206 to the corresponding user(s). Client identifiers in the list may be assigned to a user when the user first accesses a resource provided from the publisher's domain (e.g., any webpage on the publisher's website). Additionally, or alternatively, the list of client identifiers may be assigned to those users when they access specific resources provided by the publisher (e.g., specific pages within the publisher's website). The client identifier can be stored on the user's client device 106, for example, in a cookie that can only be accessed by a device (e.g., a server) with a network address within the publisher's domain.

[0073] After receiving the client identifier list 252, the service device 110 can use the identifier map 224 to determine whether a service identifier has been assigned to each user represented by a client identifier in the client identifier list 252. In some implementations, the service device 110 may perform a lookup (or search) of the identifier map 224 to attempt to identify entries in the identifier map 224 that match each specific client identifier included in the client identifier list 252. For example, the service device 110 may compare each client identifier in the client identifier list with the client identifier in each entry of the identifier map 224. In this example, the service device 110 will determine that the identifier map 224 includes a set of entries 254 that includes client identifiers (e.g., CID1, CID2) that match identifiers in the client identifier list 252.

[0074] When service device 110 determines that an entry in identifier mapping 224 matches one of the client identifiers in client identifier list 252 (e.g., through a comparison function, a query function, or another function), service device 110 can identify the given service identifier included in the entry containing the matching client identifier. As discussed above, including a given service identifier in the same entry in identifier mapping 224 indicates that the given service identifier represents (e.g., is assigned to) the same user represented (e.g., is assigned to) by the client identifier in that entry. Thus, service device 110 can add the service identifier (but not the client identifier) ​​to the list 256 of matching service identifiers stored in publisher list database 258. In this way, service device 110 can generate a set of service identifiers representing users identified by publishers using client identifiers. This set of service identifiers allows service device 110 to determine, using only the service identifiers (e.g., without client identifiers), whether a given user accessing the service of service device 110 is a user that the publisher has specified should receive user-specific information (e.g., by client identifier).

[0075] In some implementations, the publisher list database 258 stores a data structure 260 that includes a list of matching identifiers 256. Data structure 260 may also include information identifying the publisher that submitted the client identifier used to create the list of matching identifiers 256 (e.g., publisher ID, PID1). Data structure 260 may also include information identifying user-specified content (e.g., US content 1) that the publisher has specified should be delivered to the user specified by the publisher. Note that the publisher list database may store different data structures for multiple different publishers to enable the provision of user-specific information to multiple different user lists provided by multiple different publishers.

[0076] When client device 106 accesses a service provided by service device 110, or otherwise submits a request to service device 110 (e.g., to any resource belonging to the same domain as service device 110), client device 106 will submit a service identifier assigned to the user by service device 110 to service device 110. For example, as discussed above, if the user is accessing a URL provided by the service device (e.g., in the same second-level domain as that device, such as google.com), the browser executing at client device 106 will provide any cookies belonging to the domain of service device 110 (e.g., a second-level domain) to service device 110.

[0077] In a specific example, such as Figure 2BAs shown, client device 106 contacts service device 110 to access webpage 264, which is hosted in the domain of service device 110 and includes service content 266. When client device 106 requests webpage 264, browser 208 submits a service identifier 268 (e.g., as part of a cookie file) assigned to the user by service device 110 to service device 110.

[0078] Service device 110 responds to a request for a webpage by providing a webpage 264 that includes service content 266. In some embodiments, the service content is the user interface of a search system. In these cases, a user can submit a search query to service device 110, and the service device can respond with service content 266 in the form of a search results page. The search results page may include content slots 270 reserved for the presentation of third-party content (e.g., digital components) that differ from the search results.

[0079] Service device 110 may select third-party content to populate content slot 270 based in part on whether the user's service identifier 268 is included in the publisher list database 258. For example, service device 110 may look up (or query) the publisher list database 258 to determine whether the service identifier 268 obtained from client device 106 is included in the publisher's data structure 260. More specifically, service device 110 may use the service identifier 268 to query the publisher list database 258. When the query returns a match in data structure 260 stored in the publisher list database 258, service device 110 may send the content specified by data structure 260 to client device 106.

[0080] For example, when service device 110 queries publisher list database 258 using service identifier 268, the query result may be an indication that matching service identifier 272 is included in the data structure 260 of a publisher with publisher identifier PID1. In other words, the response to the query may be an indication that the client device has provided a service identifier that is included in the list of matching service identifiers of the publisher.

[0081] In response to the identification of the matching service identifier 272, the service device can send content reserved for the user (e.g., user-specified) as represented by the service identifier in data structure 260, in this example, US content 1 275. For example, service device 110 can retrieve US content 1 275 from content database 274 and send the retrieved content to client device 106 for presentation in content slot 270, or service device 110 can send the network address of US content 1 275 to user device 106, and user device can retrieve US content 1 275 from the network address. In this example, the reserved content is user-specific information US content 1 275.

[0082] When a query fails to return an indication in the publisher list database 258 that a matching service identifier 272 is included (the client device does not provide an indication of a service identifier included in the list of matching service identifiers provided by the publisher), the service device 110 may either not provide any content to populate the content slot 270, or the service device 110 may provide content that is not reserved (or specifically specified) for the user represented by the list of matching service identifiers. In this example, in such a case, the user-specific information US content 1 275 will not be provided to the client device.

[0083] For illustrative purposes, the above description relates to determining whether service identifier 268 is included in a data structure 260 that has a publisher identifier PID1. In some implementations, each service identifier is used as an index key for determining a list of all publishers including a user. For example, data structure 260 may include publisher identifiers (e.g., PIDs) and a mapping of corresponding content to service identifiers, which allows direct lookup of a list of all publishers including a user using service identifier 268, and the corresponding content to be distributed to users on each list.

[0084] More specifically, suppose data structure 260 includes the following mapping: SID1→PID1: US content 1, PID2: US content 2, PID3: US content 3. In this example, service device 110 can use the received service identifier SID1 as a query parameter for searching publisher list database 258 and / or data structure 260. The response to the query will be a list of publisher identifiers corresponding to the publisher list including service identifier SID1, and the corresponding content that has been designated to be provided to users in the publisher list. This response is also considered to be an indication that the client device has provided a service identifier included in the list of matching service identifiers of the publisher (or multiple publishers). Service device 110 can use this list of publisher identifiers and the corresponding content to determine which content will actually be sent to client device 106. For example, the service device can perform a similar process to referencing... Figure 1 The process of selecting content is described.

[0085] In the example above, the service provided by service device 110 is referred to as a search service, but the service can be any service. For example, the service could be a music streaming service, where the content slots are time slots used to present third-party content. The service could also be an email service, a social media service, a digital assistant service, a video streaming service, another online media service, a shopping service, an advertising service, or any other service offered online.

[0086] In some implementations, the content and / or services may be provided by a third party that is different from the publisher of the content and each of the service devices 110. In these cases, a similar process can be used when service device 110 is providing services within content and / or services provided by a third party. For example, if the third-party content includes pixels or scripts that generate an HTTP request to service device 110, the browser (or application) initiating the HTTP request can provide service identifier 272 to service device 110, and service device 110 can use service identifier 272 in a manner similar to that described above to select the content to be presented at client device 106 along with the third-party content or service.

[0087] Figure 3 This is a flowchart of an example process 300 for enhancing user privacy in a cross-domain content distribution environment. Process 300 can be executed by one or more data processing devices (such as the service device 110 discussed above). The process can also be implemented as instructions stored on a non-transitory computer-readable medium. The instructions can be executed by one or more data processing devices. Execution of the instructions can cause one or more data processing devices to perform the operations of process 300.

[0088] Tag information is received from the client device during a network call (302). In some implementations, a network call including tag information is generated by activating tags (e.g., pixels) embedded in a publisher resource. For example, when the client device displays a publisher resource, it executes a tag, thereby activating the tag, which generates a network call that delivers the tag information to the service device. In some implementations, the tag information includes a given publisher identifier of the publisher of the publisher resource and a given client identifier assigned by the publisher to the user of the client device. The given publisher identifier can uniquely identify the publisher, while the given client identifier can uniquely identify a user within the publisher's domain.

[0089] Obtain the given service identifier from the client device (304). The given service identifier is an identifier assigned to the user by the service device. In some implementations, the given service identifier uniquely identifies the user relative to other users within the service provider's domain. The given service identifier may be obtained, for example, through a cookie discarded on the client device by the service device.

[0090] For example, the client device may have already accessed a service provided by a service provider before encountering the tag at the publisher's resource. In this example, a cookie including a given service identifier may have already been dropped on the client device by the service device. When the tag fires and submits a network call to the service device on the client device, the browser (or other application) executing on the client device can identify the domain of the service device (e.g., from the tag or the network call), use that domain to identify a cookie whose domain matches the domain of the service device, and submit that cookie, which may include the given service identifier, to the service device.

[0091] A fuzzy representation of the user is generated (306). The fuzzy representation of the user can be any representation of the user that helps prevent the user's identity from being directly determined through that representation. One technique used in fuzzing the user's representation is hashing. In some implementations, the user's representation is fuzzed by hashing a given client identifier assigned to the user by a publisher. However, two different publishers may have assigned the same client identifier to the same user, such that the same hash value could end up representing the same user in two different publisher domains (e.g., in two different cookie spaces). To reduce (e.g., prevent) the possibility of a single user being represented by the same hash value in two different domains, as discussed above, the fuzziness of the user's representation can be a hash of a combination of the given client identifier and the publisher identifier of the publisher who assigned the given client identifier to the user.

[0092] In a specific example, a user's hash representation can be generated as follows: A given publisher identifier (e.g., as indicated in the tag information) can be combined with a given client identifier (e.g., as indicated in the tag information). This combination can be performed in various ways, but in one example, it can be a concatenation of the given publisher identifier and the given client identifier. The combination of the given publisher identifier and the given client identifier can then have a hash function applied to it, thereby generating a hash of the combination. This hash of the combination can serve as a hash representation of the user, or a fuzzy representation of the user.

[0093] A mapping is created from a given client identifier to a given service identifier (308). In some implementations, the mapping is created in a data structure stored in a database, as discussed above. For example, the service device may create entries in the data structure that link, associate, or otherwise indicate that the given client identifier and the given service identifier represent the same user.

[0094] As discussed above, when a service device provides multiple services, it can assign different service identifiers to the same user. For example, a service device providing an online search service can assign a first service identifier to a specific user for that search service. Similarly, if the service device also provides an online video streaming service, it can assign different service identifiers to the same specific user for that video streaming service. In this example, a specific user has two different service identifiers assigned to the user by the service device, but the user may be able to access both services using the same account identifier, for example, by using the same login credentials.

[0095] In some implementations, the service apparatus can extend the mapping of client identifiers to different service identifiers (e.g., different services for the service apparatus). For example, suppose that when tag information is received from a client device (e.g., when a user accesses a publisher resource), the user is currently logged into a service provided by the service apparatus (e.g., a video streaming service). In this example, the service apparatus can identify the user's account identifier and use the account identifier to identify other service identifiers that the service apparatus has already assigned to the user in other services (e.g., in other cookie spaces). For example, the service apparatus can use the account identifier to search for mappings of the account identifier to service identifiers in databases associated with other services. When a match is found between the account identifier and the mapping of the account identifier to the service identifier in the databases of other services, the service apparatus can continue to identify different service identifiers that have been assigned to the user for different services provided by the service apparatus. The different mappings between client identifiers and different service identifiers can then be created in a manner similar to that discussed above.

[0096] Mapping client identifiers to various service identifiers that the service device has assigned to users for various different services enables the service device to perform actions across various different services provided by the service device (e.g., using client identifiers assigned to users by the publisher) to send user-specific information to a set of users specified by the publisher, even if different services do not share a common user identifier space (e.g., cookie space).

[0097] When the mapping from client identifier to service identifier is extended to other cookie spaces, for example for other services provided by the service device, additional privacy enhancement techniques can be used to ensure that information from different cookie spaces cannot be aggregated and attributed to the same user. For example, a given client identifier assigned to a user by the publisher (e.g., a single client identifier received in tag information) can be hashed using a different hash function (or seed) for each different cookie space (e.g., for each service provided by the service device).

[0098] In a specific example, suppose the publisher assigns a client identifier of CID1 to a particular user, and the user logs into a specific service provided by a service device. In this example, a first hash function (or seed) can be used to hash the given client identifier (or a combination of the given client identifier and the publisher identifier) ​​to obtain a first hash value, which is then mapped to a service identifier for the specific service. Continuing the example, before the given client identifier is mapped to different service identifiers for different services provided by the service device, a second hash function (or seed) can be used to hash the given client identifier (or a combination of the given client identifier and the publisher identifier) ​​to obtain a second hash value that is different from the first hash value but represents the same user as the first hash value. A mapping from the second hash value to different service identifiers can be created such that the user corresponding to the given client identifier can be identified in the context of different services and provided with user-specific information specified by the publisher.

[0099] In some implementations, a service device can assign multiple distinct service identifiers to the same user in other contexts. For example, the same user may access the same service at different times, where the same user is logged in during one visit and not logged in during another. In this case, the service device can assign two distinct service identifiers to the same user. In this example, one service identifier will represent the user when logged in, and the other service identifier will represent the user when logged out. Mapping extensions similar to those discussed above can also be used in these scenarios.

[0100] Receive a list of client identifiers from the publisher (310). In some implementations, the list of client identifiers is received via an API that enables the publisher to upload client identifiers to the service device. The list of client identifiers includes client identifiers that have been assigned by the publisher to various users. The list of client identifiers represents users that the publisher has selected to receive user-specific information (e.g., remarketing content) specified by the publisher when these users access services provided by the service device (e.g., in a different domain and / or cookie space than the publisher). In some implementations, as discussed above, the list of client identifiers represents users who have performed certain actions on the publisher's website (or other attributes).

[0101] Determining that the list of client identifiers provided by the publisher includes the given client identifier (312). This can be determined by comparing the list of client identifiers with a mapping of service identifiers to client identifiers (e.g., the identifier mapping discussed above). In some implementations, each client identifier in the list (or a combination of the publisher identifier and each client identifier) ​​is hashed in the same way as the representation of the user in the mapping, as discussed above. The hashed version of the client identifier is then compared with the representation of the client identifier in the mapping. When a match is found between representations of the given client identifier (e.g., its hash representation), it is determined that the given client identifier is included in the list of client identifiers. Note that the same steps can be followed for each client identifier in the list, and all client identifiers that match an entry in the mapping can be determined. Also note that references to the mapping of client identifiers to service identifiers (or vice versa) take into account any mapping between client identifiers and / or service identifiers (e.g., raw, hashed, or otherwise).

[0102] The service identifier to be mapped to a given client identifier is stored in a matching service identifier list (314). In some implementations, the service identifier is stored in the matching service identifier list based on determining that a given client identifier is included in a list of client identifiers received from the publisher. The matching service identifier list is a new / different representation of the list of client identifiers received from the publisher. That is, the matching service identifier list uses the service identifier assigned to the user by the service device to represent the user specified by the publisher using the client identifier assigned to those users by the publisher. This makes it possible to identify the user specified by the publisher within a service provided by the service device (e.g., in a domain and / or cookie space different from the publisher). Thus, the matching service identifier list can be used to ensure that the user specified by the publisher receives user-specific information when the user is accessing a service provided by the service provider. Note that this process can be performed on each client identifier in the client identifier list to create a list of multiple service identifiers representing users corresponding to the client identifier list. This can also be performed for multiple different publishers. As discussed above, the mapping can be a mapping between a single instance of a service identifier and all publisher identifier pairs including a list of service identifiers and corresponding content, where the corresponding content has been specified for distribution to users in the list including the service identifier. This facilitates the direct lookup of user-specific content that has already been designated for distribution to that user by multiple different publishers. This reduces the amount of time required to identify the various types of content that should be considered for distribution to the user, thereby improving the performance of the system itself (e.g., reducing latency in content selection).

[0103] Once the service identifier mapped to a given client identifier has been stored in the list of matching service identifiers, the given client identifier can be deleted (316). In some implementations, the given client identifier is deleted from the service device to further protect user privacy, for example, by restricting the possible distribution of the client identifier.

[0104] In some cases, tag information including a given publisher identifier and a given client identifier can be received along with different service identifiers (318). For example, suppose a user first accesses a publisher resource using a mobile device and later uses a tablet device, as discussed above. In this case, the service identifier assigned to the user will be different for each device. However, the given client identifier and the given publisher identifier can be the same. In this case, only one instance of the service identifier can be mapped to the given client identifier. In some implementations, the mapping from the given service identifier to the given client identifier is deleted (320), and different mappings from different service identifiers to the given client identifier are created in a manner similar to that described above (322). This particular solution chooses to maintain the mapping between the most recently received service identifiers, thereby discarding older service identifiers. Of course, older service identifiers (and the original mapping) can be retained while later mappings are deleted or the creation of later mappings is avoided. When a new / different mapping replaces an existing mapping that the service identifier has already been included in the matching service identifier list, the different service identifier can be stored in the matching service identifier list (314).

[0105] In some implementations, when a new service identifier replaces an older (or different) service identifier representing the same user, mapping modifications can be made to maintain the mapping between (multiple) publisher identifiers and their corresponding content without requiring further action on the publisher portion. For example, suppose SID1a is assigned to a user who has already been assigned SID1. In this case, the existing association between SID1 and publisher identifiers (e.g., PID1 and / or any other PID) can be remapped to SID1a. In this example, the resulting mapping can replace the existing mapping, so the publisher does not need to take any further action to ensure the user is still eligible to distribute user-specific content that the user is already eligible to receive (e.g., by being included in a list of client identifiers previously specified by the publisher). Thus, even when the initially assigned service identifier changes, the system is able to maintain the association between the lists of client identifiers, publisher identifiers, and service identifiers.

[0106] Content requests (324) are received from multiple different client devices accessing a service provided by the service provider. In some implementations, the content request is a component request, as described in the reference. Figure 1The content request discussed here can be a request for third-party content to be delivered to a client device for inclusion in a portion of the display (or user interface) on the client device. In some cases, the inclusion of third-party content in a portion of the display (or user interface) can occur at the client end. In some cases, third-party content can be included at the service device and delivered along with the service content provided by the service device. In some cases, a content request is not required for delivering content within the service provided by the service device. For example, the service device may insert third-party content into the service before or when the user accesses the service. In this case, a separate content request is not required.

[0107] The response to a content request (326) depends on whether the client device provides a service identifier included in the matching service identifier list. For example, when the client device provides a corresponding service identifier included in the matching service identifier list, primary content reserved for users specified by the publisher (e.g., user-specified) can be sent to the client device. For example, suppose the publisher has specified that specific content (e.g., images, messages, or videos) be provided to users represented by a list of client identifiers uploaded by the publisher. In this case, the corresponding service identifiers of those users will be included in the matching service identifier list, and based on the client device having submitted a service identifier included in the service identifier list, the specific content can be sent (or otherwise distributed) to the client device. When a user accesses a service provided by a service device, user-specific information can be delivered so that content is presented when the user accesses a second-level domain different from the publisher's domain.

[0108] When the client device does not provide a corresponding service identifier included in the matching service identifier list, different content not reserved for the matching identifier list is sent to the client device. For example, based on reference Figure 1 The one or more factors discussed, and the different content, can be any content that can be otherwise used for distribution to client devices. In some implementations, when the client device does not provide a corresponding service identifier included in the list of matching service providers, third-party content will not be provided for presentation alongside the service being accessed by the user.

[0109] Figure 4This is a block diagram of an example computer system 400 that can be used to perform the operations described above. System 400 includes a processor 410, memory 420, storage device 430, and input / output device 440. Each of components 410, 420, 430, and 440 may be interconnected, for example, using a system bus 450. Processor 410 is capable of processing instructions for execution within system 400. In one embodiment, processor 410 is a single-threaded processor. In another embodiment, processor 410 is a multi-threaded processor. Processor 410 is capable of processing instructions stored in memory 420 or on storage device 430.

[0110] Memory 420 stores information within system 400. In one embodiment, memory 420 is a computer-readable medium. In one embodiment, memory 420 is a volatile memory cell. In another embodiment, memory 420 is a non-volatile memory cell.

[0111] Storage device 430 provides high-capacity storage for system 400. In one embodiment, storage device 430 is a computer-readable medium. In various other embodiments, storage device 430 may include, for example, a hard disk drive, an optical disk drive, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other high-capacity storage device.

[0112] Input / output device 440 provides input / output operations for system 400. In one embodiment, input / output device 440 may include one or more network interface devices, such as Ethernet cards, serial communication devices (e.g., RS-232 ports), and / or wireless interface devices (e.g., 802.11 cards). In another embodiment, input / output device may include a driver configured to receive input data and transmit output data to other input / output devices (e.g., keyboards, printers, and display devices 360). However, other embodiments, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc., may also be used.

[0113] Although already Figure 4 An example processing system is described herein, but implementations of the subject matter and functional operations described herein may be implemented in other types of digital electronic circuits, or in computer software, firmware, or hardware that includes the structures disclosed herein and their equivalents, or in a combination of one or more of them.

[0114] An electronic document (for simplicity, it will be referred to as a document) does not necessarily correspond to a file. A document may be stored as a part of a file that contains other documents, as a single file dedicated to the document in question, or as multiple coordinating files.

[0115] Embodiments of the subject matter and operations described in this specification can be implemented in digital electronic circuits, or in computer software, firmware, or hardware that includes the structures disclosed in this specification and their equivalents, or in a combination of one or more of these. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more computer program instruction modules encoded on a computer storage medium (or multiple media) for execution by or control of the operation of a data processing apparatus. Alternatively or additionally, program instructions can be encoded on artificially generated propagated signals, such as machine-generated electrical, optical, or electromagnetic signals, which are generated to encode information for transmission to a suitable receiver device for execution by the data processing apparatus. The computer storage medium can be or is included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these. Furthermore, while the computer storage medium is not a propagated signal, it can be a source or destination of computer program instructions encoded in artificially generated propagated signals. The computer storage medium can also be or be included in one or more separate physical components or media (e.g., multiple CDs, disks, or other storage devices).

[0116] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0117] The term "data processing apparatus" encompasses all kinds of devices, apparatuses, and machines used for processing data, including programmable processors, computers, systems-on-a-chip, or a combination thereof. The apparatus may include special-purpose logic circuit systems, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, the apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. The apparatus and execution environment can implement various different computing model infrastructures, such as network services, distributed computing, and grid computing infrastructures.

[0118] Computer programs (also known as programs, software, software applications, scripts, or code) can be written in any programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as standalone programs or as modules, components, subroutines, objects, or other units suitable for use in a computing environment. Computer programs can, but are not required to, correspond to files in a file system. A program can be stored as a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinating files (e.g., a file storing one or more modules, subroutines, or portions of code). Computer programs can be deployed to execute on a single computer or on multiple computers located at a site or distributed across multiple sites and interconnected via a communication network.

[0119] The processes and logic flows described in this specification can be executed by one or more programmable processors that execute one or more computer programs to perform actions by manipulating input data and generating outputs. The processes and logic flows can also be executed by a dedicated logic circuit system, and the apparatus can be implemented as a dedicated logic circuit system, such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit).

[0120] For example, processors suitable for executing computer programs include general-purpose microprocessors and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or be operatively coupled to one or more mass storage devices to receive data from or transfer data to one or more mass storage devices, or both. However, a computer does not require such a device. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name just a few. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices, like EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented or incorporated into dedicated logic circuitry systems.

[0121] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and a keyboard and pointing device, such as a mouse or trackball, through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.

[0122] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes back-end components, such as a data server, or middleware components, such as an application server, or front-end components, such as a client computer with a graphical user interface or a web browser through which a user interacts with embodiments of the subject matter described in this specification, or any combination of one or more such back-end, middleware, or front-end components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), interconnected networks (e.g., the Internet) and peer-to-peer networks (e.g., self-organizing peer-to-peer networks).

[0123] A computing system may include clients and servers. Clients and servers are typically geographically separated and generally interact via a communication network. The relationship between clients and servers is based on computer programs running on their respective computers, and a client-server relationship exists between them. In some embodiments, the server transmits data (e.g., HTML pages) to the client device (e.g., for the purpose of displaying data to a user interacting with the client device and receiving user input from the user interacting with the client device). Data generated at the client device (e.g., the result of user interaction) may be received at the server from the client device.

[0124] While this specification contains numerous specific details of implementation, these should not be construed as limiting any invention or potentially claimed scope, but rather as descriptions of features specific to particular embodiments of a particular invention. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations, or even initially claimed in this way, in some cases one or more features from a claimed combination may be removed from that combination, and the claimed combination may be for sub-combinations or variations thereof.

[0125] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order or sequence shown, or to perform all the shown operations to obtain the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0126] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions listed in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific order or sequence shown to achieve the desired result. In some embodiments, multitasking and parallel processing may be advantageous.

Claims

1. A method for enhancing online privacy, comprising: The service device receives tag information in a network call to the service device, the tag information specifying a given client identifier, the given client identifier (i) being assigned by a publisher different from the service device, and (ii) representing a user in the publisher's publisher domain; The service device obtains a given service identifier, which is (i) assigned by the service device and (ii) represents a user in the service domain of the service device, wherein the service domain is different from the publisher domain; The service device creates a mapping from the given service identifier to the given client identifier in a data structure; The service device receives multiple content requests from multiple different client devices, and the multiple different client devices access services provided by the service device in the service domain; and Responding to the content request based on whether the client device provides a service identifier mapped to the given client identifier includes: When the content request includes a service identifier mapped to the given client identifier, first content is sent for the content request to be reserved from the client device that provides the service identifier mapped to the given client identifier assigned by the publisher; and When the content request does not include a service identifier mapped to the given client identifier, a second content that is not reserved for content requests from client devices that provide a service identifier mapped to the given client identifier assigned by the publisher is sent.

2. The method according to claim 1, further comprising: Generating a hash representation of the user includes: Combine the given publisher identifier and the given client identifier; and Generate a hash of the combination of the given publisher identifier and the given client identifier, wherein: Creating a mapping from the given service identifier to the given client identifier includes mapping the hash representation of the user to the given service identifier.

3. The method according to claim 1, further comprising: Determine that the user is logged into a given service provided by the service device; The user's account identifier is identified based on the user's login service; The account identifier is used to identify different service identifiers, which are assigned to the user for different services provided by the service device; and Create different mappings between the given client identifier and the different service identifiers.

4. The method according to claim 3, wherein: Creating a mapping from the given service identifier to the given client identifier includes creating a mapping from the given service identifier to a first hash value, which is created using the given client identifier and a first hash function or seed; and Creating a distinct mapping between the given client identifier and the distinct service identifiers includes creating a mapping from the distinct service identifiers to a second hash value, the second hash value being created using the given client identifier and a second hash function or seed, wherein the second hash value is different from the first hash value.

5. The method of claim 1, further comprising: Receive the tag information and different service identifiers from different client devices; Remove the mapping from the given service identifier to the given client identifier from the data structure; and Create different mappings from the different service identifiers to the given client identifier in the data structure.

6. The method of claim 5, wherein storing the given service identifier mapped to the given client identifier in a matching service identifier list comprises storing the given service identifier in a data structure entry of a set of publisher identifier-content pairs having a specified publisher list, wherein the publisher list includes the given client identifier and user-specific content to be distributed to users in the publisher list, the method further comprising: In response to determining that the user has been assigned the different service identifier, the list of matching service identifiers is updated, including remapping the existing association between the given service identifier and the set of publisher identifier-content pairs to the different identifier.

7. The method of claim 1, further comprising deleting the given client identifier after storing the given service identifier mapped to the given client identifier in a list of mapped service identifiers.

8. The method of claim 1, wherein when the content request includes a service identifier mapped to the given client identifier, sending first content reserved for a content request from a client device providing a service identifier mapped to the given client identifier assigned by the publisher includes: The first content is presented when the user is accessing a service provided in a second-level domain that is different from the publisher's domain.

9. A system for enhanced online privacy, comprising: Memory devices; and One or more processors are configured to interact with the memory device and perform operations when executing instructions, the operations including: During a network call to a service device, tag information is received, the tag information specifying a given client identifier, the given client identifier (i) being assigned by a publisher different from the service device, and (ii) representing a user in the publisher's publisher domain; Obtain a given service identifier, which is (i) assigned by the service device and (ii) represents the user in the service domain of the service device, wherein the service domain is different from the publisher domain; Create a mapping from the given service identifier to the given client identifier in the data structure; Receive multiple content requests from multiple different client devices, wherein the multiple different client devices access services provided by service devices in the service domain; and Responding to the content request based on whether the client device provides a service identifier mapped to the given client identifier includes: When the content request includes a service identifier mapped to the given client identifier, send first content reserved for a content request from a client device that provides a service identifier mapped to the given client identifier assigned by the publisher; and When the content request does not include a service identifier mapped to the given client identifier, a second content that is not reserved for content requests from client devices that provide a service identifier mapped to the given client identifier assigned by the publisher is sent.

10. The system according to claim 9, wherein, The instructions cause the one or more processors to perform an operation, the operation further including: Generating a hash representation of the user includes: Combine the given publisher identifier and the given client identifier; and Generate a hash of the combination of the given publisher identifier and the given client identifier, wherein: Creating a mapping from the given service identifier to the given client identifier includes mapping the hash representation of the user to the given service identifier.

11. The system according to claim 9, wherein, The instructions cause the one or more processors to perform an operation, the operation further including: Determine that the user is logged into a given service provided by the service device; The user's account identifier is identified based on the user's login service; The account identifier is used to identify different service identifiers, which are assigned to the user for different services provided by the service device; and Create different mappings between the given client identifier and the different service identifiers.

12. The system according to claim 11, wherein: Creating a mapping from the given service identifier to the given client identifier includes creating a mapping from the given service identifier to a first hash value, which is created using the given client identifier and a first hash function or seed; and Creating a distinct mapping between the given client identifier and the distinct service identifiers includes creating a mapping from the distinct service identifiers to a second hash value, the second hash value being created using the given client identifier and a second hash function or seed, wherein the second hash value is different from the first hash value.

13. The system according to claim 9, wherein, The instructions cause the one or more processors to perform an operation, the operation further including: Receive the tag information and different service identifiers from different client devices; Remove the mapping from the given service identifier to the given client identifier from the data structure; and Create different mappings from the different service identifiers to the given client identifier in the data structure.

14. The system of claim 13, wherein storing the given service identifier to be mapped to the given client identifier in a matching service identifier list comprises storing the given service identifier in a data structure entry of a set of publisher identifier-content pairs of publisher identifiers having a specified publisher list, wherein the publisher list includes the given client identifier and user-specific content to be distributed to users in the publisher list, wherein, The instructions cause the one or more processors to perform an operation, the operation further including: In response to determining that the user has been assigned the different service identifier, the list of matching service identifiers is updated, including remapping the existing association between the given service identifier and the set of publisher identifier-content pairs to the different identifier.

15. The system according to claim 9, wherein, The instructions cause the one or more processors to perform an operation, the operation further including deleting the given client identifier after storing the given service identifier mapped to the given client identifier in a list of mapped service identifiers.

16. A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations, the operations including: During a network call to a service device, tag information is received, the tag information specifying a given client identifier, the given client identifier (i) being assigned by a publisher different from the service device, and (ii) representing a user in the publisher's publisher domain; Obtain a given service identifier, which (i) is assigned by the service device (ii) and represents a user in the service domain of the service device, wherein the service domain is different from the publisher domain; Create a mapping from the given service identifier to the given client identifier in the data structure; Receive multiple content requests from multiple different client devices, which access services provided by service devices in the service domain; and Responding to the content request based on whether the client device provides a service identifier mapped to the given client identifier includes: When the content request includes a service identifier mapped to the given client identifier, first content is sent for the content request to be reserved from the client device that provides the service identifier mapped to the given client identifier assigned by the publisher; and When the content request does not include a service identifier mapped to the given client identifier, a second content that is not reserved for content requests from client devices that provide a service identifier mapped to the given client identifier assigned by the publisher is sent.

17. The non-transitory computer-readable medium according to claim 16, wherein, The instructions cause the one or more processors to perform an operation, the operation further including: Generating a hash representation of the user includes: Combine the given publisher identifier and the given client identifier; and Generate a hash of the combination of the given publisher identifier and the given client identifier, wherein: Creating a mapping from the given service identifier to the given client identifier includes mapping the hash representation of the user to the given service identifier.

18. The non-transitory computer-readable medium according to claim 16, wherein, The instructions cause the one or more processors to perform an operation, the operation further including: Determine that the user is logged into a given service provided by the service device; The user's account identifier is identified based on the user's login service; The account identifier is used to identify different service identifiers, which are assigned to the user for different services provided by the service device; and Create different mappings between the given client identifier and the different service identifiers.

19. The non-transitory computer-readable medium according to claim 18, wherein: Creating a mapping from the given service identifier to the given client identifier includes creating a mapping from the given service identifier to a first hash value, which is created using the given client identifier and a first hash function or seed; and Creating a distinct mapping between the given client identifier and the distinct service identifiers includes creating a mapping from the distinct service identifiers to a second hash value, the second hash value being created using the given client identifier and a second hash function or seed, wherein the second hash value is different from the first hash value.

20. The non-transitory computer-readable medium according to claim 16, wherein, The instructions cause the one or more processors to perform an operation, the operation further including: Receive the tag information and different service identifiers from different client devices; Remove the mapping from the given service identifier to the given client identifier from the data structure; and Create different mappings from the different service identifiers to the given client identifier in the data structure.

Images