Secure Chek Politics

Note:
On January 20, 2025-- White House/President issued the initial memorandum ordering the freeze and directing OMB/OPM to act.
Office of Management and Budget (OMB) issued implementing guidance and memoranda to agencies specifying scope, exemptions, and reporting requirements.
Agency heads (department and agency leadership) enforced the freeze for their workforce and for agency-controlled hiring, applying OMB guidance, approving exemptions, and directing HR offices and contracting/grants offices to halt or restrict non-federal hiring tied to agency funds.

Not only did hiring freezes occur, but in the process, digital discrimination and suppression services have also occurred and have hurt the financial living standards of several workers--especially OLDER WORKERS.

THE BASICS: HOW IT ALL HAPPENS
According to research, an SSP (supply-side platform) “warehouse” (often a data/identity layer or user ID warehouse used by website owners/buyers) categorizes web visitors by combining signals into user identifiers so publishers/website owners can package inventory for programmatic buyers and advertisers. But this information can also be segmented and categorized for exclusionary purposes as well. 

Website visitors/users are categorized by:
Identifiers(impressions): cookie IDs, device IDs, hashed email/IDs from login, or probabilistic device graphs.
Demographics: age range, gender, household income bands from third-party segments or modeled data.
Contextual / content interests: topics, categories, and keywords of pages viewed (e.g., sports, finance).
Behavioral / engagement: pages visited, time on site, recency/frequency, purchase intent signals, conversion events.
First-party audiences: publisher-defined segments (subscribers, logged-in users, cart abandoners).
Third-party segments: commercial user buckets/categories sold by data providers (e.g., auto intenders, frequent travelers).
Location: coarse geolocation (country, region, city) from IP or device signals.
Device & technical: Operating System (OS), browser, connection type, device class (mobile/desktop), app vs. web.
Ad interaction / frequency controls: past ad exposures, suppression lists, do-not-track flags.
Privacy/safety labels: consent status, GDPR/CCPA flags, hashed PII handling, blocked categories (sensitive verticals).

How categorization is built and used:
Through signaling. Signals are raw pieces of data collected about a user, device, or page that are used to infer attributes or decide targeting. Signal ingestion collects real-time page/context signals (impressions/user IDs).
Identity resolution: map signals to persistent identifiers or probabilistic graphs.
Segmenting: evaluate rules or machine-learning models to assign audience labels (e.g., “Auto Intenders — 30d”).
Packaging & exposure: expose segments to buyers via bid requests (pre-bid or via auction) with privacy constraints and price floors.
Updating & expiry: segments refresh on time windows, recency thresholds, or event triggers.
Privacy and enforcement:
Categories respect consent and regulatory flags (GDPR/CCPA); PII is typically hashed or removed.
SSPs/apply suppression for blocked content, sensitive categories, or users who opted out.
Granularity often coarsened to meet privacy/identity-signal limits (e.g., fewer deterministic identifiers after cookie deprecation).
Practical examples:
“Logged-in subscriber — sports fan — seen 3 articles last 7 days”
“Probabilistic travel intender — device cluster X — top 10% engagement”
“Geo: Chicago metro — high income — view recency < 24h”

What does all of this have to do with suppression and job applicants?

1. Applicant visits a job website or a job link or simple website.
2. The applicant is identified (cookies, browsers, device IDs, demographics, etc.) through "signaling" impressions or collections of raw pieces of data about the user, converted to a label or score (profiling) used to decide targeting or categorization of the user. (Warehouse)
3. Models and the label or score are applied towards the user.
Examples:
Match campaign rules: serve "Brand X creative" only to users labeled “auto intender” in top 10% score.
Bid logic: increase bid by 30% for users with "high purchase-intent score and household-income" > threshold.
Exclusions: block ads when consent flag = denied or user is on a suppression list. This means that the user has agreed to tracking/targeted ads (e.g., GDPR purpose consent, CCPA opt‑out, or publisher “no targeting” choice).
4.When the flag indicates that the user did not agree to tracking or "no consent" (or limited consent) using personal data, the SSP/warehouse will stop using identifiers or signal impressions tied to the user for profiling or targeting of personal data and apply suppression so requests can either omit the user or mark them as non-targetable.
a custom flag looks like this: ("targeting allowed=false"), 

5. User identifiers are checked and run in the real-time path before forming an outbound/API request.

6. Matching is done against hashed keys to avoid exposing specific Personal Identifier Information (PII) like full name, email address, phone number, postal address, national ID (SSN), date of birth, biometric data, and direct persistent identifiers like cookie IDs or device IDs. Sensitive PII includes things like financial, health, or government ID numbers, but systems can still recognize and group users using non‑PII signals such as publisher device tokens or website or app owner identifiers (IDFA/GAID) that use short strings of information that can identify the users of their websites or apps, device graphs (Oracle)-- IP addresses, User Agent (UA)--short text that the user's browser or app sends to a website that identifies what browser and device the user is using (e.g., "Chrome on Windows" or "Safari on iPhone"). , screen size, time zone that link visits to the same user device or browser, compact fingerprinting--consistent language, fonts, resolution, etc., session signals of repeated patterns (same IP + browsing patterns) used to recognize repeat users, Cohorts/segment IDs: user assigned to a special category (e.g., “sports interest”) represented by a segment ID, not personal data, and Probabilistic matching from the previous input of short informational strings or data that come from partners where partners  link user identities without sharing actual user identifiers. All of these are further identifiers without using specifics to identify the user.

7. This "other" user data is then used to match with a one-way algorithm: meaning that the other data is turned into a fixed string of data. The system then compares those fixed strings to previous entries in its lists so it can find matches without ever sharing the original personal data. In other words,
The system turns a user ID (like an email or cookie) into a fixed code by using a one-way function (algorithm).
That fixed code looks like a random string of data and can't be turned back into the original ID. The system or platform then checks if that code appears in its already stored list of codes. If it finds the same code, it treats the visit as the same user.
Because it only compares codes, the original personal user data isn't shared.

Simple Terms
Think of an algorithmic function like a blender recipe:
Input: you put in any data (an email, ID, or text).
Process/blend: the algorithm or "recipe" mixes with the data and outputs a fixed‑length code (a long string of letters/numbers).
Properties or ingredients:
Same input or ingredients → same code every time.
Different input or ingredients → usually a very different code.
You cannot turn the code back into the original input.
So, the system compares the algorithm code to the previous user identifier data to see if these two items are the same person without sharing the original data.
It's like using the snake venom as the cure:
You turn sensitive user IDs into harmless codes (the "venom") by mixing with the algorithm and then use that code to block matches (the "cure") without exposing the original user's sensitive data.
*Logging and metrics track suppressed impressions for reporting without storing identifiable data.
In short: signals → modeling/rules → user labels/scores → targeting or exclusion actions.

Employer Suppression List and Discrimination
When a page impression or user Id (groups or individuals) arrives,  employer server extracts the user ID (email, cookie, device tokens) and hashes it the same way the ad for the employer website/publisher did. The server checks if that hashed value appears in its stored suppression list (a database or in‑memory set of hashes).
If matched: the system enforces the rule — common actions:
drop the ad/resume entirely (don’t send any interview request), or
remove user identifiers and user data from the ad/interview request, or add a flag (e.g., targeting_allowed=false) so that employers treat it as non‑personalized.
Logging/reporting: the event is recorded (using the hash algorithm or non‑identifying keys) for metrics without revealing raw PII.
In short: hash (run the user identifier through the hashing algorithm e.g.) to produce the fixed code→ lookup → match→ block or neutralize the user identifier before user sees ad or before employer receives resume data.

Suppression System (DSP)
A suppression service is the system or ATS software (internal or third‑party) that holds and enforces blocklists of hashed IDs or inventory from employer ads. But this same process can also be used if an employer gives user identifiers to third parties to suppress employment.

In simple terms:
1. An employer list people to exclude (emails or phone numbers).
2. Employers then turn each user into a secret code (hash) in their computer database.
3.Employers then give only those codes (not the real emails) to the ad system.

When a user visits an advertised website, the ad system itself makes a code from that user's ID and checks the exclusion or suppression list. If the code matches, the user won’t see job ads and employers won't see resumes submitted from the user and will not be recognized. This explains why there is no response when a specific user submits a resume.

Third-Party Suppression List Vendors
Below are the primary owners / parent companies or corporate status for each listed vendor (concise) that provide suppression services in the U.S.

LiveRamp — Independent public company (NYSE: RAMP).
InfoSum — Privately held company (venture-backed).
The Trade Desk — Independent public company (NASDAQ: TTD).
Neustar — Division of TransUnion (TransUnion acquired Neustar’s Marketing Solutions).
LiveIntent — Privately held company (venture-backed; leadership/management ownership).
Experian (Advertising Services) — Subsidiary of Experian plc (public company, LON: EXPN).
Epsilon — Owned by Publicis Groupe (acquired from Alliance Data).
Merkle (not Markle)— Owned by Dentsu Group (Dentsu acquired Merkle).
Lotame — Privately held company (venture-backed).
Oracle (Oracle Advertising/ID Graph/Moat) — Owned by Oracle Corporation (public company, NYSE: ORCL).
Signal — Acquired by NCS / Signal (now part of NCS/Signal — corporate consolidation; privately held).
Dataxu — Acquired assets previously by Roku; Dataxu brand discontinued (assets historically sold).
StackAdapt — Privately held company (venture-backed).
Magnite — Public company (NASDAQ: MGNI) — Magnite is the SSP formed from Rubicon Project and Telaria.
Integral Ad Science (IAS) — Publicly traded (NASDAQ: IAS).
DoubleVerify — Publicly traded (NYSE: DV).
LiveIntent often handles the most.
LiveRamp, Oracle and Experian typically cover the widest footprint for email‑centric suppression.

Applicant Tracking Systems--Ashby, Oracle Taleo, Lever, Greenhouse+Lever, iCIMS Talent Cloud, Workday Recruiting/SAP SuccessFactors, Handshake, Symplicity, etc., use criteria such as birthday dates, career dates and college date questions on employment applications, to help "weed" out older adult workers and block older adults from getting employment or good decent paying jobs.

Overall, if a user or group has been marginalized, chances are, they have also been suppressed or excluded from certain ads. If this is the case, then they have also probably been suppressed or excluded from jobs as well preventing employer outreach.