Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for correlating data for user network events in a secure and privacy preserving manner. In one aspect, a method includes receiving, by a secure network measurement system comprising a trusted execution environment (TEE) and from a first device, presentation data for a presentation of a digital component at the first device. The presentation data includes an encrypted first identifier. The encrypted first identifier is generated by encrypting a first identifier that identifies a user of the first device using a first encryption key. The system receives, from a second device, network event data sent in response to a user of the second device performing a specified action following the presentation of the digital component at the first device. The network event data includes an encrypted second identifier.

Abstract: A method for improving accuracy of distributing content from a plurality of publishers to a multiplicity of users while maintaining user privacy is disclosed herein. An example method includes generating a statistical model of presentations of content from the plurality of publishers to the multiplicity of users; determining, using the statistical model for each of the multiplicity of users, one or more user identifiers corresponding to the user, to define a virtual user identifier; determining, using the statistical model and the virtual user identifiers, how many of the multiplicity of users are associated with multiple ones of the plurality of publishers; generating, using an overlap metric, a respective frequency capping value for each of the plurality of publishers; and causing each of the plurality of publishers to limit a number of times a content element is provided to the multiplicity of users in accordance with the respective frequency capping value.

Abstract: Routing data is copied from a primary data store to a local data store of a computing device. As the routing data is being copied by the computing device, changes to the data continue to occur. After copying all or a portion of the data, the computing device uses a value of a global sequence number (GSN) to determine if mutations have been made to the primary data. The routing data in the local data store is not consistent with the routing data stored in the primary data store when the value of the GSN is larger after the copying of the routing data as compared to the initial value of the GSN when the copying started. When changes have been made to the data, the computing device integrates the changes into the local data store before beginning routing operations.