Note:
On January 20, 2025-- White House issued the initial memorandum ordering the freeze and directing OMB/OPM to act.
Office of Management and Budget (OMB) issued implementing guidance and memoranda to agencies specifying scope, exemptions, and reporting requirements.
Agency heads (department and agency leadership) enforced the freeze for their workforce and for agency-controlled hiring, applying OMB guidance, approving exemptions, and directing HR offices and contracting/grants offices to halt or restrict non-federal hiring tied to agency funds.
Not only did hiring freezes occur, but in the process, digital exclusion and suppression services have also occurred-- hurting the living standards of the Middle-Class American worker--especially OLDER WORKERS.
THE BASICS: HOW DIGITAL HIRING "EXCLUSION" HAPPENS
According to research, an SSP (supply-side platform) “warehouse” is used by website owners/buyers. The SSP then categorizes the web visitors by combining "signals"(cookies, device IDs, email IDs, etc.) to identify users so publishers and website owners can compile and package inventory for buyers and advertisers. This information can also be segmented and categorized for exclusionary purposes as well.
Before understanding how digital exclusions are made, read the definitions below:
Website visitors/users are categorized by:
Signals-- raw pieces of data collected about a user, device, or page that are used to infer attributes or decide targeting.
Identifiers(impressions): cookie IDs, device IDs, hashed email/IDs from login, or probabilistic device graphs.
Demographics: age range, gender, household income bands from third-party segments or modeled data.
Contextual / content interests: topics, categories, and keywords of pages viewed (e.g., sports, finance).
Behavioral / engagement: pages visited, time on site, recency/frequency, purchase intent signals, conversion events.
First-party audiences: publisher-defined segments (subscribers, logged-in users, cart abandoners).
Third-party segments: commercial user buckets/categories sold by data providers (e.g., auto intenders, frequent travelers).
Location: coarse geolocation (country, region, city) from IP or device signals.
Device & technical: Operating System (OS), browser, connection type, device class (mobile/desktop), app vs. web.
Ad interaction / frequency controls: past ad exposures, suppression lists, do-not-track flags.
Privacy/safety labels: consent status, GDPR/CCPA flags, hashed PII handling, blocked categories (sensitive verticals).
How exclusion works:
Through "signaling". Signals are raw pieces of data collected about a user, device, or page that are used to infer attributes or decide targeting towards the user. Signal ingestion collects real-time page/context signals (impressions/user IDs).
Identity resolution: map signals to persistent identifiers or probabilistic graphs.
Segmenting: evaluate rules or machine-learning models to assign audience labels (e.g., “Auto Intenders — 30d”).
Packaging & exposure: expose segments to buyers via bid requests (pre-bid or via auction) with privacy constraints and price floors.
Updating & expiry: segments refresh on time windows, recency thresholds, or event triggers.
Privacy and enforcement:
Categories respect consent and regulatory flags (GDPR/CCPA); PII is typically hashed or removed.
SSPs/apply suppression for blocked content, sensitive categories, or users who opted out.
Granularity often coarsened to meet privacy/identity-signal limits (e.g., fewer deterministic identifiers after cookie deprecation).
Practical examples:
“Logged-in subscriber — sports fan — seen 3 articles last 7 days”
“Probabilistic travel intender — device cluster X — top 10% engagement”
“Geolocation: Chicago metro — high income — view recency < 24h”
What does all of this have to do with suppression and job applicants?
1. Applicant visits a website or a job link website.
2. The applicant is identified (cookies, browsers, device IDs, demographics, etc.) through "signaling" or collections of raw pieces of data about the user, then user behavior is converted to a score (profiling) used to decide targeting or categorization of the user. (Warehouse)
3. A.I. score is applied towards the user. (Risk or likelihood? A score given for employment hire, for loan approval, insurance coverage, criminality, sentencing, parole, incarceration admittance, medical coverage, medical care, etc.)
Examples:
Match campaign rules: serve "ads for sneakers" only to users labeled “exercisers” in top 10% score.
Bid logic: increase bid by 30% for users with "high purchase- score and high household-income" > threshold.
Exclusions: block ads when consent flag = denied, or user is on a suppression list. This means that the user has agreed to tracking/targeted ads (e.g., GDPR purpose consent, CCPA opt‑out, or publisher “no targeting” choice).
4.When the flag indicates that the user did not agree to tracking or "no consent" (or limited consent) using personal data, the SSP/warehouse will stop using identifiers or signals tied to the user for profiling or targeting of personal data and apply "suppression" so requests can either omit the user or mark them as non-targetable. This is EXCLUSION.
A custom flag looks like this: ("targeting allowed=false"),
5. User identifiers are checked and run in the real-time path before forming an outbound/API request.
6. Matching is done against hashed keys to avoid exposing specific Personal Identifier Information (PII) like full name, email address, phone number, postal address, national ID (SSN), date of birth, biometric data, and direct persistent identifiers like cookie IDs or device IDs. Sensitive PII includes things like financial, health, or government ID numbers, but systems can still recognize and group users using non‑PII signals such as publisher device tokens or website or app owner identifiers (IDFA/GAID) that use short strings of information that can identify the users of their websites or apps, device graphs
(Oracle)-- IP addresses, User Agent (UA)--short text that the user's browser or app sends to a website that identifies what browser and device the user is using (e.g., "Chrome on Windows" or "Safari on iPhone"), screen size, time zone that link visits to the same user device or browser, compact fingerprinting--consistent language, fonts, resolution, etc., session signals of repeated patterns (same IP + browsing patterns) used to recognize repeat users, Cohorts/segment IDs: user assigned to a special category (e.g., “sports interest”) represented by a segment ID, not personal data, and Probabilistic matching from the previous input of short informational strings or data that come from partners where partners link user identities without sharing actual user identifiers. All of these are further identifiers without using specifics to identify the user.
7. This "other" user data is then used to match with a one-way algorithm: meaning that the other data is turned into a fixed string of data. The system then compares those fixed strings to previous entries in its lists so it can find matches without ever sharing the original personal data. In other words,
The system turns a user ID (like an email or cookie) into a fixed code by using a one-way function (algorithm). That fixed code looks like a random string of data and can't be turned back into the original ID. The system or platform then checks if that code appears in its already stored list of codes. If it finds the same code, it treats the visit as the same user. Because it only compares codes, the original personal user data (like we think about) isn't shared, but it really is shared--just in another way..
Simple Terms
Think of an algorithmic function like a blender recipe:
Input: you put in any data (an email, ID, or text).
Process/blend: the algorithm or "recipe" mixes with the data and outputs a fixed‑length code (a long string of letters/numbers).
Properties or ingredients:
Same input or ingredients → same code every time.
Different input or ingredients → usually a very different code.
You cannot turn the code back into the original input.
So, the system compares the algorithm code to the previous user identifier data to see if these two items are the same person without sharing the original data.
It's like using the snake venom as the cure:
You turn sensitive user IDs into harmless codes (the "venom") by mixing with the algorithm and then use that code to block matches (the "cure") without exposing the original user's sensitive data. *Logging and metrics track suppressed impressions for reporting without storing identifiable data.
In short: signals → modeling/rules → user labels/scores → targeting or exclusion actions.
Suppression Lists and Discrimination
When a page impression or user Id (groups or individuals) arrives, employer server extracts the user ID (email, cookie, device tokens) and hashes it the same way the ad for the employer website/publisher did. The server checks if that hashed value appears in its stored suppression list (a database or in‑memory set of hashes).
If matched: the system enforces the rule — common actions:
drop the ad or continue entirely (don’t send any interview request), or
remove user identifiers and user data from the ad/interview request, or add a flag (e.g., targeting_allowed=false) so that employers treat it as non‑personalized. Non-personalization means it can't be reasonably be connected to the person and therefore remains unidentified.
Logging/reporting: the event is recorded (using the hash algorithm or non‑identifying keys) for metrics without revealing raw PII.
In short: hash (run the user identifier through the hashing algorithm e.g.) to produce the fixed code→ lookup → match→ block or neutralize the user identifier before user sees ad or before employer receives resume data.
Suppression System (DSP)
A suppression service is the system or Applicant Tracking Software (internal or third‑party) that holds and enforces blocklists of hashed IDs or inventory from employer ads. But this same process can also be used if an employer gives user identifiers instead of inventory, to third parties to suppress employment.
In simple terms:
1. An employer list people to exclude (emails or phone numbers).
2. Employers then turn each user into a secret code (hash) in their computer database.
3.Employers then give only these codes (not the real emails) to the ad system.
When a user visits an advertised website, the ad system itself makes a code from that user's ID and checks the exclusion or suppression list. If the code matches, the user won’t see job ads and employers won't see the users' resumes submitted from the user and will not be recognized or considered for employment. This also explains why there is no response when a specific user submits a resume or contacts a website for employment--the ad system excluded or suppressed it based on what the employer has submitted.
Third-Party Suppression List Vendors
Below are the primary owners / parent companies or corporate status for each listed vendor (concise) that provide suppression services in the U.S.
LiveRamp — Independent public company (NYSE: RAMP).
InfoSum — Privately held company (venture-backed).
The Trade Desk — Independent public company (NASDAQ: TTD).
Neustar — Division of TransUnion (TransUnion acquired Neustar’s Marketing Solutions).
LiveIntent — Privately held company (venture-backed; leadership/management ownership).
Experian (Advertising Services) — Subsidiary of Experian plc (public company, LON: EXPN).
Epsilon — Owned by Publicis Groupe (acquired from Alliance Data).
Merkle (not Markle)— Owned by Dentsu Group (Dentsu acquired Merkle).
Lotame — Privately held company (venture-backed).
Oracle (Oracle Advertising/ID Graph/Moat) — Owned by Oracle Corporation (public company, NYSE: ORCL).
Signal — Acquired by NCS / Signal (now part of NCS/Signal — corporate consolidation; privately held).
Dataxu — Acquired assets previously by Roku; Dataxu brand discontinued (assets historically sold).
StackAdapt — Privately held company (venture-backed).
Magnite — Public company (NASDAQ: MGNI) — Magnite is the SSP formed from Rubicon Project and Telaria.
Integral Ad Science (IAS) — Publicly traded (NASDAQ: IAS).
DoubleVerify — Publicly traded (NYSE: DV).
LiveIntent often handles the most.
LiveRamp, Oracle and Experian typically cover the widest footprint for email‑centric suppression.
Applicant Tracking Systems:
Ashby (Recruiters),
Oracle Taleo (large corporations and global organizations),
Lever (hiring managers), Greenhouse+Lever (Hollywood Industry, hiring managers),
iCIMS Talent Cloud (healthcare, finance, retail, manufacturing, technology and government)
Workday Recruiting/SAP SuccessFactors, (HR Payroll, Finance systems)
Handshake (Colleges/Universities, internship recruitment),
Symplicity (University/Academy career centers), use criteria such as birthday dates, career dates and college date questions on employment applications, to help "weed" out older adult workers and block older adults from getting employment or good decent paying jobs.
Overall, if a user or group has been marginalized, chances are, they have also been suppressed or excluded from certain ads and applicant tracking systems. If this is the case, then users have also probably been suppressed or excluded from jobs as well, preventing employer outreach and hurting user chances of bettering their lives and the viewing of new ads.
