- The campaign targets a collection of places drawn on the map and bids when a device is inside one of them, without the identity of whoever carries it ever entering the equation.
- The location the model relies on already travels in every ad request at auction, under the OpenRTB standard, before any identifier is looked up.
- Paired with store-level sales data, the same logic shows where to win share, where to defend a lead and where to grow the category.
- Results are measured with geographic experiments (geo-lift), which compare regions with and without the campaign using the same data that chose where to advertise.
A runner, an ad and a question
Seven in the morning at Ibirapuera Park, in São Paulo. Between laps, a runner slows down, pulls her phone from her armband and opens a news app. While the page loads, the app sends out an ad request (a bid request, in industry jargon) to a real-time auction where several buyers decide, in a fraction of a second, how much to pay to appear on that screen. For two decades, the question driving that decision has been who the person on the other end is.
To answer it, the industry built an entire machine. Data management platforms (DMPs), identity graphs that tie one user to several devices, and cookie syncing between companies all exist, at bottom, to match a phone’s identifier against a list of targets. That machine underpins the economics of digital advertising and, at the same time, concentrates the industry’s biggest risks, whether legal, operational or a matter of dependence on the large platforms.
The paper by Cesar Augusto Felix de Moura, of Insper, starts from a much simpler question: where is the runner? If the phone is inside the park, the running-shoe brand already has what it needs to decide on the bid, and the owner’s name, age and browsing history stay unknown to everyone involved.
The proposal arrives at a curious moment. The long-announced death of the cookie was postponed when, in April 2025, Google dropped its plan to remove third-party cookies from Chrome. Even so, the identifier keeps losing ground through a slower erosion that is harder to reverse, advancing on three fronts at once.
- 01ATT
Most people decline tracking.
Ever since Apple began asking for explicit permission to track users across apps, through App Tracking Transparency (ATT), most people have said no.
- 02Blocking
Those who still have an identifier block or delete it.
More and more people block, reject or clear their IDs, which wears down any strategy that depends on them.
- 03LGPD
Compliance keeps getting costlier.
Under the LGPD, Brazil’s data protection law and its counterpart to the GDPR, a device identifier is personal data, and processing it demands an ever larger compliance effort.
When identifiers were abundant and cheap, giving them up cost precision. Now that they’re scarce, expensive and risky, whoever never depended on them starts out ahead.
That is the bet the paper makes. The author proposes using the physical place as the unit of targeting, running on the auction protocol itself, and deciding each purchase with a geometric test that checks whether the device sits inside the outline of a place. In this design, privacy is built in from the start, a principle the literature calls privacy by design.
Read the full study.
Fill this in once and every study in the Índice HYPR opens for you in this browser. No password, no account.
- How buying by place works
- The value lies in knowing what the place is
- From the park to the supermarket
- How to measure results without tracking anyone
- Limits and caveats the author points out
How buying by place works
In traditional targeting, the audience is a list of identifiers. When an ad request comes in, the system checks whether that device’s ID is on the list and, if it is, places a bid. The paper’s model swaps that list for a set of geometries, each one the outline of a real place such as a park or a store, and bids when the coordinate in the request falls inside any of them. Each rule fits on a single line.
Classic bid(d) = 1 if id(d) ∈ { id₁, id₂, …, idₙ }
By place bid(d) = 1 if there is gᵢ ∈ { g₁, …, gₘ } with p(d) ∈ gᵢUnder the first rule, the decision hinges on id(d), an attribute of the person that has to be collected and stored. Under the second, it hinges on p(d), the device’s position at that instant, which already arrives with the request and reveals nothing about who is carrying it.
Engineers call the second rule a point-in-polygon test. Given a point on the map and an outline, the algorithm answers whether the point lies inside or outside it. The diagram below shows the logic, along with the reason the paper prefers the exact outline to the familiar radius drawn around an address.
- Actual outline of the place (GeoJSON)
- Request inside the outline: gets a bid
- Request outside the outline: no bid
- Simple radius around the center
The raw material for this decision is already flowing through the auction. OpenRTB, the technical standard that organizes real-time media buying, carries an object called Geo in every request, nested in the device information. It holds latitude and longitude, the signal source (type 1 when it comes from GPS or the device’s location services, 2 when it is estimated from the IP address), accuracy in meters and the age of the reading. Together, these fields describe the media opportunity, meaning the place and the moment, without saying anything about the profile of whoever is holding the phone, and they arrive before any identifier is looked up. The industry has always treated them as a secondary filter, and the model puts them at the center of the decision.
The value lies in knowing what the place is
If the mechanism is this simple, where is the advantage? The paper itself acknowledges that, on its own, it is worth little. The auction is open, the Geo object is documented and point-in-polygon is textbook material. A coordinate inside an outline only becomes valuable once you know, with confidence, what that outline represents. For that, the model relies on two layers of data, one that identifies and qualifies the place and another that shows what happens there commercially. The figure below sums up the full chain.
- 01Coordinate
Arrives in the ad request, with the signal’s source and accuracy.
- 02Polygon
Identifies the outline of the place that contains that coordinate.
- 03Qualified place
Gets a name, category and size from geoIQ, powered by Places Graph.
- 04Commercial reality
Shows what sells there and at what share, from revIQ, powered by Groundflow.
- 05Segment and creative
Sets the message that makes sense in that place, at that moment.
The numbers show that the engineering fits comfortably within the auction’s time limit. Each bid has to be decided in under 100 milliseconds, and the test, backed by a spatial index that rules out distant outlines up front, takes microseconds. A competitor could copy an architecture like this in a few weeks. Much harder to reproduce is the base that gives the geometries meaning, with the coverage and fidelity of its outlines, and the transactional layer that validates each place down to the SKU (the code for each product on the shelf) and each brand’s share.
From the park to the supermarket
Presence and context at Ibirapuera Park
Back to the runner. In the paper’s example, a 23-vertex polygon outlines roughly 1.37 km² of Ibirapuera. The places base classifies the area as an urban park and outdoor sports space, which yields a natural segment: “park-goers and people who work out.” Throughout the day, any ad request coming from inside that perimeter can receive, say, a running-shoe brand’s creative. The campaign reaches the people running in the park, and at no point does the media buyer learn who owns any device or build a profile of anyone.
Product-level intelligence at a premium supermarket
The second example takes the same logic inside a store. It is a premium supermarket in Itaim Bibi, also in São Paulo, drawn as a polygon of about 1,237 m². The geometry by itself says little beyond the size. The places base adds that the store belongs to a premium chain, and the transactional base attaches signals of what happens inside, aggregated by store and anonymized, such as the categories and SKUs sold, volume and each brand’s share. The unit of analysis remains the store, and no information drills down to the shopper.
With that data, you can calculate how much a product weighs within its category at each store. The math is simple, and a companion paper by the same author showed how widely the result can swing from one neighborhood to the next.
Share (%) = target-SKU sales ÷ total category sales × 100In the companion paper (SSRN No. 5655730), a single product accounted for about 42% of category sales in one district and under 10% in another.
A gap that wide calls for different strategies. Instead of treating every store the same way, a brand can choose the role media plays in each one, and the paper describes three paths.
| Mode | Where to activate | What for |
|---|---|---|
| Conquest | Stores where the brand is underrepresented | Compete for share precisely where the competitor leads |
| Defense | Stores where the brand leads but a competitor is gaining ground | Shore up the position before losses pile up |
| Category | Stores where the category itself sells below its potential | Grow the category instead of merely reshuffling share among brands |
From the park to the supermarket, the privacy posture stays the same. What grows from one example to the next is how much is known about the place, which in the store’s case reaches down to every product sold.
How to measure results without tracking anyone
That leaves the question any media manager would ask next: without an identifier, how do you know the campaign worked? Without a persistent ID, classic attribution, which links a click to a later purchase on the same device, does indeed go away. It is the most common objection to any ID-free model, and the paper treats it as a reason to retire a method that already had serious problems.
Last-touch attribution, which gives all the credit to the last ad seen before a conversion, is correlational and ends up rewarding sales that would have happened anyway. Media mix models, which work with aggregate data, run into collinearity (several channels rise and fall together, making it hard to separate the effect of each) and lack randomization, the random assignment of groups that lets you speak of cause and effect.
The proposed alternative is geographic experiments, known as geo-lift. One set of regions gets the campaign, a comparable set goes without it and serves as the control, and the incremental effect, meaning the sales that exist only because of the media, is calculated against an estimate of what would have happened without the campaign, the so-called counterfactual.
Lift (%) = (exposed sales − control sales) ÷ control sales × 100Because the regions in each group are assigned in advance and the baseline is modeled, geo-lift measures the effect the campaign caused, and conversions that merely followed an ad stay out of the count.
There is a rare coherence in this design. The same transactional base that indicates where to activate, with sales, visits, units by SKU and share at fine granularity, is the outcome signal geo-lift reads once the campaign ends. Media bought by place ends up measured by place, with the same data at both ends.
Limits and caveats the author points out
None of this makes the model a solution without rough edges. The paper is explicit about the conditions under which it works well and about the points that still call for care, and there are four of them.
- 01Signal
Not every ad request carries a good coordinate.
Location estimated from the IP address is coarse, and some inventory sellers truncate coordinates. So the model filters requests by source, accuracy and age of the reading, and holds off on bidding when the signal can’t support the decision, giving up some reach in exchange for precision.
- 02Data
Enrichment depends on the quality of the base.
Coverage of competing SKUs varies from store to store. Incomplete capture can skew local share and, with it, the choice between conquest and defense.
- 03Privacy
Location is also an LGPD matter.
The risk arises when the data is stored and tied to someone. The model processes the signal ephemerally, with no ID, no history and no retention, which still doesn’t remove the need for a legal review of each inventory source.
- 04Fraud
Coordinates can be spoofed.
Consistency checks, trusted-supplier lists and plausibility analysis reduce the problem, as with any media bought at auction.
For media planners, the study’s main consequence is a change in the question they ask. Rather than hunting for specific people, a brand picks the places where its message makes sense, uses what sells in each one to decide the campaign’s role and measures results in those same places. With identifiers growing scarcer, it is a way to stay precise without carrying the risk of knowing who everyone is. In the end, the runner at Ibirapuera sees the running-shoe ad, and nobody in the buying chain had to find out who she is.