A visitor browses on their phone, adds something to a cart, then finishes the order on a laptop three days later. Without identity resolution, that is two anonymous sessions and one order, three disconnected fragments. With it, that is one customer, seen twice before they bought. Identity resolution is the step that turns raw events into a single, durable record of a person.
What gets merged, and on what evidence
Every event carries whatever identifiers are available at the time: an anonymous device id set on first visit, and, once a customer identifies themselves, an email or phone (hashed), or a logged-in customer id. Identity resolution links these into one profile whenever two events share a strong identifier, most often an email or phone hash appearing on both an anonymous session and a later order.
A weak identifier (a device id, a session id) never merges two profiles on its own. Only a strong, personally-scoped one does. That distinction is what keeps identity resolution accurate instead of merging strangers who happened to share a browser.
Why this has to happen server-side
A browser only knows what happened in that browser, in that session. It cannot see that the same email placed an order on a different device last month. Identity resolution requires a server-side record that persists independently of any single visit, checked and updated on every event, not reconstructed from cookies that expire or get cleared.
The merge has to be safe against duplicates and races
Two events for the same customer can arrive close together, sometimes concurrently. If identity resolution runs the merge twice, or reads a profile before a previous write has settled, a customer's order count and lifetime value can be counted twice, permanently. Resolving identity correctly means serializing access to a given profile so that concurrent events for the same person are applied one at a time, not in parallel.
What a resolved profile actually contains
Once merged, a profile accumulates what matters for marketing and reporting: lifetime value, order count, repeat-buyer status, first and last touch, and every identifier ever seen for that person (hashed, where the identifier itself is personal data). That profile is what gets segmented, activated to ad platforms as an audience, and shown back to you when you look up a customer.
What identity resolution does not do
It does not guess. Two anonymous sessions with no shared strong identifier stay two separate, anonymous records, even if a human glancing at the data might suspect they are the same person. A merge that is not backed by real evidence is worse than no merge: it silently mixes two customers' histories. Identity resolution should be conservative by design, and stay that way even when it means a slightly higher count of anonymous profiles.
The point of identity resolution is not a bigger number of "unified" profiles. It is a customer record you can trust enough to activate, report on, and open up and read, knowing it is actually one person.