Identity Graph Buyer's Checklist for 2026

Teams shopping for an identity graph usually open with a match rate and a record count. Both are fair questions, and both come too early. A graph can post a strong number and still be the wrong product, because it links the wrong keys, reaches the wrong markets, or arrives in a shape your warehouse cannot use. Work through the list below first, then argue about match rates.

1. Which Identifier Types Does the Graph Resolve?

"Identity graph" covers very different products. Some link mobile advertising IDs (MAIDs) to hashed emails (HEMs). Some group devices into households. Some stitch cross-device activity to a single person. Some do all three, at different levels of confidence. Write down the pairing your use case actually needs before you look at a single vendor deck.

If you are activating mobile audiences from a CRM file, you need device-to-email linkage. If you are measuring household reach on connected TV, you need household grouping. A graph that is excellent at one and silent on the other is a mismatch, not a bargain. The test is simple: list your input keys and your output keys, and ask the vendor to show which of those pairs they resolve directly.

Put that pairing in writing. A one-page compatibility matrix, your input keys down one side and the graph's resolvable outputs across the top, turns a sales conversation into a specification your data engineering team can hold the vendor to after signature, not just during the pitch.

2. Deterministic, Probabilistic, or a Blend?

Deterministic links come from a shared, observed identifier. Probabilistic links are inferred from signals such as IP address, timing, and behavior. Neither is wrong. They are tools with different failure modes, and the blend a vendor uses tells you what kind of errors you will be paying to absorb. A graph that is mostly inferred tends to reach further and mislink more.

Ask for the mix per identifier pair, not a single blended label. Then decide where your use case can tolerate inference: broad prospecting usually can, suppression and measurement usually cannot. The operational cost of deterministic versus probabilistic matching is worth reading before this conversation. How to turn that mix into enforceable match rate and decay terms is its own topic, covered in our guide to identity graph SLAs.

3. Where Does the Coverage Actually Reach?

A single headline number hides where a graph is deep and where it is thin. Ask for coverage split by country and, for US buyers, by market. Domestic and international reach are usually built from different supply and should be quoted separately. For reference, GSDSI's MAID Feed catalogs roughly 200M+ US MAID-to-HEM linkages and 700M+ international device IDs across 150+ countries, listed as two figures because they describe two different populations.

Then test the slice you care about. If most of your spend sits in a handful of markets, national coverage is trivia. A seed-match test on your own records in those markets tells you more than any catalog page.

4. Will It Land Cleanly in Your Stack?

An identity graph you cannot load is shelfware. Confirm the file formats and destinations before procurement signs: flat files, columnar formats, cloud storage drops, SFTP, or a warehouse share. The MAID Feed, for example, ships as CSV or Parquet through S3, SFTP, or a Snowflake share. Ask how schema changes are announced, too, because a renamed column breaks a pipeline faster than a coverage gap.

Refresh cadence belongs on the same list. Identifiers reset and devices change hands, so a graph loaded once and left alone drifts away from reality. A daily refresh, which is how the MAID Feed is published, only helps if your ingestion runs on a matching schedule. Decide whether you want full replacements or incremental deltas, and size your jobs accordingly. This is what separates a graph that powers audience targeting and cross-channel measurement from one that sits in a bucket.

5. What Is Each Identifier Key Licensed For?

Permitted use is not a property of the graph. It is a property of each key and its source. A HEM collected under one consent flow may be cleared for activation, while a MAID from a different supply path is cleared only for measurement. Ask for a permitted-use matrix by identifier type, and make sure your legal team reads it before your engineers build on it.

The FTC's privacy and security guidance for businesses and the NIST Privacy Framework are useful anchors for how to document those boundaries internally. For the source-app and consent-chain questions specific to mobile IDs, use our MAID feed diligence checklist rather than reinventing it.

Run these five checks in order and the shortlist usually shrinks to the few graphs that fit your keys, your markets, and your stack. That is the point to compare match rates on your own data. If device-to-person linkage is the gap you are filling, request a MAID Feed sample and run it against your file.