Preventing data leakage

1. A system for preventing data leakage, the system comprising:

one or more servers each comprising one or more processors;

one or more data storage devices that store:

a plurality of data sets received from publishers, wherein each data set includes (i) one or more user identifiers for users that have visited an electronic resource of the publisher from which the data set was received and, for each user, (ii) activity data describing one or more actions performed by the user with respect to the electronic resource; and

instructions executable by the one or more servers and that upon such execution cause the one or more servers to perform operations comprising:

receiving digital component requests that each specify a user identifier for a user to which a digital component will be provided in response to the digital component request;

providing digital components in response to the digital component requests;

receiving data specifying a given user identifier for a given user specified by a given digital component request; and

preventing leakage of activity data to digital component providers by:

identifying, for a given digital component provider, data sets that (i) include a user identifier for the given user and (ii) are data sets from which the digital component provider is eligible to receive data;

identifying, for the given digital component provider, a maximum number of data sets that the digital component provider is eligible to receive for one or more digital component requests received over each of multiple recurring time periods, wherein the maximum number is less than a total number of the identified data sets;

selecting a specified number of the identified data sets that is less than or equal to a difference between the maximum number of data sets and a current count of data sets provided to the digital component provider during a current time period;

selecting, from the specified number of the identified data sets, the activity data of the given user included in each data set of the specified number of the identified data sets; and

providing the selected activity data to the given digital component.

2. The system of claim 1 , wherein providing the selected activity data to the digital component provider comprises providing, by the one or more servers, the selected activity data to the given digital component provider without providing activity data for the given user included in any data set other than each data set of the specified number of the identified data sets.

3. The system of claim 1 , wherein the selected activity data only comprises data for the given user.

4. The system of claim 1 , wherein the operations comprise providing, by the one or more servers, a digital component of the given digital component provider to a user device of a user identified by the given user identifier based on data received from the given digital component provider in response to receiving the selected activity data.

5. The system of claim 1 , wherein each data set includes one or more tuples of data and each tuple includes data types selected by the publisher from which the data set was received.

6. The system of claim 1 , wherein:

the one or more servers are configured to perform further operations comprising:

receiving data specifying a particular user identifier for a particular user specified by a particular activity data request received from a particular entity;

identifying an additional plurality of data sets that (i) include the particular user identifier for the particular user and (ii) are data sets from which the particular entity is eligible to receive data;

determining that the particular entity has not requested activity data for greater than a threshold number of users during a specified time period;

in response to determining that particular entity has not requested activity data for greater than the threshold number of users during the specified time period:

selecting, from a particular number of the additional plurality of data sets, particular activity data of the particular user included in each data set of the particular number of the additional plurality of data sets; and

providing the selected particular activity data to the particular entity.

7. The system of claim 6 , wherein determining that the particular entity has not requested activity data for greater than a threshold number of users during a specified time period comprises:

determining a number of activity data requests received from the particular entity that specified a user identifier that matched a user identifier of one or more data sets received from a particular publisher; and

determining that the number of activity data requests is not greater than a threshold specified by the particular publisher.

8. A computer-implemented method for preventing data leakage, the method comprising:

receiving, by one or more servers, digital component requests that each specify a user identifier for a user to which a digital component will be provided in response to the digital component request;

providing, by the one or more servers, digital components in response to the digital component requests;

receiving, by the one or more servers, data specifying a given user identifier for a given user specified by a given digital component request; and

preventing, by the one or more servers, leakage of activity data to digital component providers by:

identifying, for a given digital component provider and from a plurality of data sets received from publishers, data sets that (i) include a user identifier for the given user and (ii) are data sets from which the digital component provider is eligible to receive data, wherein each data set includes (i) one or more user identifiers for users that have visited an electronic resource of the publisher from which the data set was received and, for each user, (ii) activity data describing one or more actions performed by the user with respect to the electronic resource;

identifying, for the given digital component provider, a maximum number of data sets that the digital component provider is eligible to receive for one or more digital component requests received over each of multiple recurring time periods, wherein the maximum number is less than a total number of the identified data sets;

selecting a specified number of the identified data sets that is less than or equal to a difference between the maximum number of data sets and a current count of data sets provided to the digital component provider during a current time period;

selecting, from the specified number of the identified data sets, the activity data of the given user included in each data set of the specified number of the identified data sets; and

providing the selected activity data to the given digital component provider.

9. The method of claim 8 , wherein providing the selected activity data to the digital component provider comprises providing, by the one or more servers, the selected activity data to the given digital component provider without providing activity data for the given user included in any data set other than each data set of the specified number of the identified data sets.

10. The method of claim 8 , wherein the selected activity data only comprises data for the given user.

11. The method of claim 8 , further comprising providing, by the one or more servers, a digital component of the given digital component provider to a user device of a user identified by the given user identifier based on data received from the given digital component provider in response to receiving the selected activity data.

12. The method of claim 8 , wherein each data set includes one or more tuples of data and each tuple includes data types selected by the publisher from which the data set was received.

13. The method of claim 8 , further comprising:

receiving, from a particular entity, a particular activity data request that specifies a particular user identifier for a particular user;

identifying an additional plurality of data sets that (i) include the particular user identifier for the particular user and (ii) are data sets from which the particular entity is eligible to receive data;

determining that the particular entity has not requested activity data for greater than a threshold number of users during a specified time period;

in response to determining that the particular entity has not requested activity data for greater than the threshold number of users during the specified time period:

selecting, from a particular number of the additional plurality of data sets, particular activity data of the particular user included in each data set of the particular number of the additional plurality of data sets; and

providing the selected particular activity data to the particular entity.

14. The method of claim 13 , wherein determining that the particular entity has not requested activity data for greater than a threshold number of users during a specified time period comprises:

determining a number of activity data requests received from the particular entity that specified a user identifier that matched a user identifier of one or more data sets received from a particular publisher; and

determining that the number of activity data requests is not greater than a threshold specified by the particular publisher.

15. A non-transitory computer storage medium encoded with a computer program, the program comprising instructions that when executed by one or more data processing apparatus cause the data processing apparatus to perform operations comprising:

receiving digital component requests that each specify a user identifier for a user to which digital component will be provided in response to the digital component request;

providing digital components in response to the digital component requests;

receiving data specifying a given user identifier for a given user specified by a given digital component request; and

preventing leakage of activity data to digital component providers by:

identifying, for a given digital component provider and from a plurality of data sets received from publishers, data sets that (i) include a user identifier for the given user and (ii) are data sets from which the digital component provider is eligible to receive data, wherein each data set includes (i) one or more user identifiers for users that have visited an electronic resource of the publisher from which the data set was received and, for each user, (ii) activity data describing one or more actions performed by the user with respect to the electronic resource;

identifying, for the given digital component provider, a maximum number of data sets that the digital component provider is eligible to receive for one or more digital component requests received over each of multiple recurring time periods, wherein the maximum number is less than a total number of the identified data sets;

selecting a specified number of the identified data sets that is less than or equal to a difference between the maximum number of data sets and a current count of data sets provided to the digital component provider during a current time period;

selecting, from the specified number of the identified data sets, the activity data of the given user included in each data set of the specified number of the identified data sets; and

providing the selected activity data to the given digital component provider.

16. The non-transitory computer storage medium of claim 15 , wherein providing the selected activity data to the digital component provider comprises providing, by the data processing apparatus, the selected activity data to the given digital component provider without providing activity data for the given user included in any data set other than each data set of the specified number of the identified data sets.

17. The non-transitory computer storage medium of claim 15 , wherein the selected activity data only comprises data for the given user.

18. The non-transitory computer storage medium of claim 15 , wherein the operations further comprise providing a digital component of the given digital component provider to a user device of a user identified by the given user identifier based on data received from the given digital component in response to receiving the selected activity data.

19. The non-transitory computer storage medium of claim 15 , wherein each data set includes one or more tuples of data and each tuple includes data types selected by the publisher from which the data set was received.

20. The non-transitory computer storage medium of claim 15 , wherein the operations further comprise:

receiving, from a particular entity, a particular activity data request that specifies a particular user identifier for a particular user;

identifying an additional plurality of data sets that (i) include a particular user identifier for the particular user and (ii) are data sets from which the particular entity is eligible to receive data;

determining that the particular entity has not requested activity data for greater than a threshold number of users during a specified time period;

in response to determining that the particular entity has not requested activity data for greater than the threshold number of users during the specified time period:

selecting, from a particular number of the additional plurality of data sets, particular activity data of the particular user included in each data set of the particular number of the additional plurality of data sets; and

providing the selected particular activity data to the particular entity.