“We are aware of and have addressed this practice within the Programmatic Supply Chain Working Group, where we are actively exploring methods and updates to Open RTB to ensure transparency and full disclosure,” said Anthony Katsur, CEO of IAB Tech Lab. “We are actively engaged with industry stakeholders to gather proposals and collaborate on developing industry-wide standards that address these concerns.”
Whether this type of ID bridging is deceptive depends on whether DSPs had any reason to know that the sell-side was using these techniques. Not everyone at a DSP might know the structure of their deals with the sell-side, said Paul Bannister, chief strategy officer at Raptive.
“There is missing communication between business teams and technical teams on the buy side,” Bannister said.
Not precise or privacy-safe
Buyers are particularly concerned the techniques the sell-side is using instead of cookies—particularly in cookieless environments—are not always precise or privacy-safe.
Often mentioned was ID bridging, where the ad-tech firm tries to link a user in a cookieless environment like Safari with who they might be on Chrome, by using a signal like an IP address or email to match the user. Not only are the privacy ethics of this practice debated, but it’s a technique that won’t work once Chrome fully deprecates third-party cookies.
“This smells to me as a desperate way to recover some of that revenue,” that came from cookies, said the DSP executive. “It is very myopic. What happens when the cookiepacoplyse comes? This is no longer possible.”
Publishers and their tech partners might use other probabilistic techniques to guess who a user might be without cookies, said Peter Day, chief technology officer at DSP Quantcast.
“What’s the probability that the person I saw on this website is on this other website or has this other email address?” Day said, noting the kinds of calculations these identifiers might make. “Probabilistic methods are fine as long as you know they’re probabilistic.”
Legit alternatives
Not all the ways the sell-side might identify audiences without cookies are based on soon-to-disappear or shaky evidence.
An SSP executive, who requested anonymity to discuss sensitive industry relations, said their company only works with identifiers that have some legitimate method to identify users in cookieless environments, like email addresses, and rejects vendors with weaker privacy controls or questionable data sources.
“On one side [are solutions that] sound great and then you’ve got people who are inserting IDs that have no connection whatsoever … that are completely fraudulent and completely should not be allowed,” said Bannister. “Then you got a ton of stuff in between. The important thing is where is the line. What is good? What is consistent with how buyers want to buy and what crosses that line?”
