I see this get discussed all the time and have always meant to flag it.

I have spent a lot of time deep in ad tech and a ton of time specifically thinking about identity resolution for ads - i have never seen a DSP make a conscious effort to do "target every cookie that belongs to a specific IP address" as a default rule (or even an option) but I see DSPs automatically opting in to the Liveramp cross device map - is this what causes this behaviour? I am even skeptical that Liveramp can robustly provide this data at scale and fast enough, so I wonder if its almost alway coincidence?

"target every cookie that belongs to a specific IP address"

That shouldn't work if the GP uses a VPN, as theg'd have a perceivably different IP address.

More likely they are logged into youtube, and their account has been associated with their girlfriend's account (location data from gmail/android phones/maps/etc, probably not using the VPN 24/7, etc)

How is it correlating that two devices on different networks (as far as it can see) are in the same house? I can understand device-level fingerprinting associating device@vpn <-> device@office, but I'm not seeing where deviceA@vpn <-> deviceB@home have anything in common to tie them together.

Bluetooth. Device A and Device B can see eachother, occassionally throughout the day, via bluetooth. An app using either the Google or Criteo Framework records these and through knowing that one devices has VPN on, knows that it's endpoint is likely not real and assigns the two devices together.

Even better, thanks to criteo's bluetooth beacon service, if you go to pick up your pizza, they will know you bought it and can present you with further ads from that specific pizza chain.

If you think Criteo isn't doing that, you should check out their marketing material.

A simpler explanation is both devices have location services on, or are on the same WiFi network (same SSID).

Criteo's framework relies on Bluetooth more than Wifi IIRC. They love telling you about how accurate their bluetooth beacons are.

This is true and the reason I register all my Bluetooth devices while on business trips.

Typically on a busy train or plane

"Hey honey, wanna order pizza?" ... and one Android device listens....

Spooooky!