Programmatic

Setting Up Google PAIR in DV360: Step-by-Step Ad Ops Guide

September 21, 2026

Setting up Google Publisher Audience Interactions Engine (PAIR) in Display & Video 360 (DV360) requires linking an approved clean room or data onboarding partner—such as LiveRamp or InfoSum—to your DV360 advertiser account, performing client-side SHA-256 encryption on your CRM data, and matching encrypted identifiers directly with publisher first-party data. Once linked and matched, the encrypted audience segments populate under your DV360 First-Party Audience inventory, ready to be targeted on private marketplace (PMP) or Programmatic Guaranteed (PG) deals with participating publishers.

Key Takeaways

  • Triple-encryption security: PAIR uses client-side SHA-256 hashing combined with three independent encryption keys (advertiser, publisher, and clean room) so no raw PII or cross-site user tracking keys are ever exposed to Google or third parties.
  • 1:1 Publisher direct matching: PAIR audience segments do not run across open auction inventory; they can only be targeted against specific publishers who have onboarded and matched the exact same user list.
  • Clean room infrastructure required: Activation demands an integration with an enterprise clean room vendor like LiveRamp, InfoSum, Habu, or Google Cloud BigQuery Data Clean Rooms.
  • Scale depends on overlap: Because PAIR matches known high-intent users directly, match scale is tighter than traditional third-party audience buys, requiring precise deal setup to prevent delivery bottlenecks.

Architecture of Google PAIR: Cryptographic Mechanics

Understanding PAIR requires looking at its underlying cryptographic protocol. Traditional third-party audience onboarding relied on uploading raw CRM data or basic single-hashed SHA-256 emails (HEMs) to a Demand-Side Platform (DSP), which then matched those strings against centralized sync tables or third-party cookie graphs. PAIR eliminates centralized match tables altogether.

PAIR operates on a triple-encryption architecture designed to guarantee that neither the buyer, the publisher, Google, nor the clean room vendor can read the underlying user identifier across properties. The encryption workflow follows three discrete cryptographic stages:

  • Stage 1 (Advertiser Encryption): The advertiser cleanses raw first-party data (emails or E.164-formatted phone numbers) and applies a standard SHA-256 hash. The client then encrypts this string using a unique, private advertiser secret key ($K_a$).
  • Stage 2 (Publisher Encryption): The participating publisher cleanses, hashes, and encrypts its own logged-in user data using a unique, private publisher secret key ($K_p$).
  • Stage 3 (Clean Room Key Application): Both encrypted datasets are sent to a shared clean room vendor (e.g., LiveRamp or InfoSum). The clean room applies a third encryption key ($K_c$) to both datasets.

When an intersection (match) occurs between the advertiser payload and the publisher payload, the clean room generates a non-reversible, match-specific key string. This match string is passed directly into DV360 as a custom targeting segment linked explicitly to that publisher's inventory source. Because the key string is tied exclusively to the relationship between Advertiser X and Publisher Y, it cannot be reverse-engineered or used by any other advertiser or publisher across the programmatic ecosystem.

Prerequisites & Data Preparation

Before initiating the technical configuration inside DV360, your data infrastructure and administrative permissions must meet specific operational requirements.

1. User Permissions and Platform Access

To configure PAIR connections, ensure your user profile holds the following permissions:

  • DV360: Partner Admin or Advertiser Admin access with write permissions for Data Management and Audience Uploads.
  • Clean Room Provider: Enterprise Admin access to LiveRamp (RampID / PAIR module), InfoSum (Bunker/Vault), Habu, or Google Cloud BigQuery.
  • Publisher Direct Relationships: Established PMP or PG deal IDs with publisher partners who have configured PAIR on their Supply-Side Platforms (SSPs) such as Google Ad Manager 360.

2. First-Party Data Formatting and Sanitization

Data quality dictates match quality. Before running client-side encryption scripts, format your CRM data strictly according to standard data-hygiene protocols:

  • Email Addresses: Strip all leading and trailing whitespace, convert all characters to lowercase, and remove special characters (except standard email syntax). Do not strip domain extensions. Example: user.name@domain.com.
  • Phone Numbers: Must follow the international E.164 formatting rule. Remove all spaces, dashes, brackets, and leading zeros. Include the country code prefix. Example: +14155552671.
  • Hashing: Compute SHA-256 digests over the normalized UTF-8 string. The output must be a 64-character hexadecimal string.

Step-by-Step DV360 PAIR Configuration Workflow

Step 1: Link Clean Room Partner to DV360 Advertiser

To enable the flow of encrypted match keys into DV360, you must establish an authorized partner connection inside the user interface.

Navigate to Advertiser Settings > Integrations > Linked Accounts in DV360. Select Link New Account and select your designated clean room partner (e.g., LiveRamp or InfoSum). Input your Clean Room Account ID / Tenant ID provided by your data platform representative. Approve the data-sharing policy terms and confirm the linkage.

Step 2: Generate Advertiser Encryption Keys in the Clean Room

Log into your clean room workspace. Locate the PAIR integration module and generate your client-side encryption keypair. Store your salt keys in a secure key vault (such as AWS KMS or HashiCorp Vault). Never distribute raw secret keys over unencrypted communication channels or commit them to public code repositories.

Step 3: Execute Match Jobs and Push Datasets

Upload your sanitized, pre-hashed SHA-256 data payload to your clean room instance. Execute the PAIR matching job by selecting the targeted publisher's PAIR identity node or Bunker endpoint.

Once the clean room computes the double-encrypted key intersection, select DV360 as the destination export target. Select your linked DV360 Advertiser ID. Name the audience segment systematically using a clean naming convention (e.g., PAIR_AdvertiserName_PublisherName_LapsedBuyers_Q32024).

Step 4: Verify Audience Import in DV360

Once exported from the clean room, allow 12 to 24 hours for DV360 to process and populate the audience segment. To verify receipt, navigate to Audiences > All Audiences > First-Party Data in DV360.

Search for your segment name. Confirm that the Type column reflects PAIR Segment and that the population status displays active status. DV360 will display an estimated audience size, which represents the total encrypted matches available across that specific publisher's ecosystem.

Activating PAIR Audiences on DV360 Line Items

PAIR audiences cannot be attached to open auction line items. Because PAIR keys are publisher-specific, targeting a PAIR audience requires attaching it directly to line items that target that publisher's inventory via Private Marketplace (PMP) or Programmatic Guaranteed (PG) deals.

Line Item Setup Workflow

  1. Navigate to your Campaign and open the relevant Line Item (Display or Video).
  2. Under Inventory Sources, select Deals and assign the specific PMP or PG Deal ID negotiated with the PAIR partner publisher.
  3. Navigate to Audience Targeting > First-Party Data.
  4. Select the corresponding PAIR segment matched specifically for that publisher. Do not attach PAIR segments created for Publisher A to deals running on Publisher B; doing so will result in zero delivery due to key mismatch.
  5. Save the line item and verify that bid requests begin registering in the Line Item Troubleshooter.

If you encounter pacing issues after launching your line items, consult our guide on troubleshooting DV360 PMP deals that fail to spend to isolate potential floor price or bid request mismatches.

Troubleshooting PAIR Delivery and Scale Bottlenecks

When running PAIR segments in production, programmatic traders commonly encounter three operational failure modes: small targetable match sizes, delivery underpacing, and pre-bid verification filtering drops.

1. Low Match Rates and Addressability Bottlenecks

Because PAIR relies on strict 1:1 user matching on authenticated (logged-in) inventory, total reachable impressions will be smaller than traditional third-party cookie or UID2 audiences. Expect overall match rates between an advertiser CRM list and a single publisher's authenticated user base to range between 10% and 35%, depending on user overlap and login registration rates on the publisher site.

If your final targetable pool drops below viable execution thresholds, expand the initial seed CRM file size or bundle multiple participating PAIR publishers into parallel line items rather than forcing a single publisher deal to deliver full campaign budgets. For automated deal setups facing scale issues, refer to our step-by-step framework for fixing DV360 Programmatic Guaranteed underdelivery.

2. Bid Request Mismatches and Key Failures

If the line item shows impressions requested but zero impressions won, open the DV360 Line Item Troubleshooter and check the Lost Bids diagnostic tab. The most common technical cause is an encryption salt mismatch, which occurs when the clean room export key does not align with the key installed on the publisher's SSP setup. If keys do not align, the bid stream fails to decrypt the match key, and DV360 drops the bid request automatically to protect data privacy.

3. Verification Vendor Over-Filtering

High pre-bid verification blocking can unexpectedly suppress PAIR line item delivery. Third-party brand safety vendor wrappers (e.g., IAS, DoubleVerify) appended to PAIR line items may block inventory at the pre-bid stage before the PAIR token is evaluated. Ensure your verification settings are appropriately calibrated by reviewing troubleshooting high IAS and DoubleVerify block rates to keep verification filters from dropping legitimate matched impressions.

Frequently Asked Questions

How does Google PAIR differ from Customer Match in DV360?

Customer Match allows advertisers to target uploaded first-party data across Google-owned properties (YouTube, Search, Gmail) using Google's centralized user identity graph. Google PAIR, by contrast, is designed specifically for non-Google, open-web publisher inventory, leveraging a decentralized, clean-room-based triple-encryption model where Google never retains or views the underlying user identifiers.

Can I target PAIR audience segments in open auction bidding?

No. PAIR segments cannot be activated in open-auction buying because the underlying encryption keys are generated exclusively for a 1:1 relationship between one advertiser and one specific publisher. PAIR targeting requires executing campaigns through PMP or Programmatic Guaranteed deals set up directly with the matching publisher.

What match rates should programmatic teams expect with PAIR?

PAIR match rates typically range from 10% to 35% against a single publisher's user base, depending heavily on the publisher's site authentication rate. Because PAIR requires both the buyer and the publisher to hold verified CRM/login records for the same individual user, match scale is tighter but offers significantly higher intent and addressability precision.

Does Google PAIR rely on third-party cookies or IP addresses?

No. PAIR operates completely independent of third-party cookies, device IDs, and IP addresses. It relies strictly on hashed, authenticated first-party data strings (such as email addresses or phone numbers) processed via client-side clean room encryption before reaching the DV360 bid stream.